guke
48037f03fd
openobserve上报 --------- Co-authored-by: guke <guke@autohome.com.cn> Reviewed-on: #145
58 lines
2.6 KiB
Plaintext
58 lines
2.6 KiB
Plaintext
# OpenObserve 监控台反代(observe.shaguabijia.com)。证书走 Certbot/Let's Encrypt,与 admin-web 一致。
|
|
#
|
|
# 前置(一次性):
|
|
# 1) DNS: observe.shaguabijia.com A 记录 → 本服务器公网 IP
|
|
# 2) 证书: sudo certbot certonly --nginx -d observe.shaguabijia.com
|
|
# (options-ssl-nginx.conf / ssl-dhparams.pem 首次跑 certbot 时已生成,admin-web 在用即已存在)
|
|
# 3) OpenObserve 只绑 127.0.0.1:5080(见 docker-compose.prod.yml),本文件把它反代出公网
|
|
# 4) nginx -t 通过后 systemctl reload nginx
|
|
#
|
|
# 安全:OO 有自身登录。监控台不必对全网裸开——本机办公网无固定出口 IP,故在 nginx 层加 Basic Auth 兜底;
|
|
# 将来有固定 IP 可改用【IP 白名单】块(更省事,可去掉 Basic Auth)。
|
|
|
|
server {
|
|
server_name observe.shaguabijia.com;
|
|
|
|
client_max_body_size 10m;
|
|
|
|
# —— IP 白名单:办公网无固定出口 IP,暂不用;将来有固定 IP 可改用这块(比 Basic Auth 省事)——
|
|
# allow 1.2.3.4; # ← 换成你的真实出口 IP,可多行
|
|
# deny all;
|
|
|
|
# —— Basic Auth:无固定 IP 的兜底密码(生成 .htpasswd_observe 的命令见 README/下方)——
|
|
auth_basic "OpenObserve";
|
|
auth_basic_user_file /etc/nginx/conf.d/.htpasswd_observe;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:5080;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
# OpenObserve 有实时/流式面板,需透传 WebSocket
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 300s;
|
|
}
|
|
|
|
# IPv6 这行不带 ipv6only=on:该选项对 [::]:443 全局只能设一次,admin-web 那个 server 块已设(否则 nginx 报 duplicate listen options)
|
|
listen [::]:443 ssl; # managed by Certbot
|
|
listen 443 ssl; # managed by Certbot
|
|
ssl_certificate /etc/letsencrypt/live/observe.shaguabijia.com/fullchain.pem; # managed by Certbot
|
|
ssl_certificate_key /etc/letsencrypt/live/observe.shaguabijia.com/privkey.pem; # managed by Certbot
|
|
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
|
|
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
|
|
}
|
|
|
|
server {
|
|
if ($host = observe.shaguabijia.com) {
|
|
return 301 https://$host$request_uri;
|
|
} # managed by Certbot
|
|
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name observe.shaguabijia.com;
|
|
return 404; # managed by Certbot
|
|
}
|