【AI工具链】跟着敲一遍⑬:80/443 被占怎么查

http {  server_tokens off;}

http {  limit_req_zone $binary_remote_addr zone=perip:10m rate=10r/s;  limit_conn_zone $binary_remote_addr zone=conn:10m;  limit_req_status 429;  limit_conn_status 429;}server {  limit_req zone=perip burst=20 nodelay;  limit_conn conn 20;}

ssl_certificate /etc/nginx/certs/edge.crt;ssl_certificate_key /etc/nginx/certs/edge.key;ssl_protocols TLSv1.2 TLSv1.3;ssl_ciphers HIGH:!aNULL:!MD5;ssl_session_cache shared:SSL:10m;ssl_session_timeout 10m;

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;add_header X-Content-Type-Options "nosniff" always;add_header X-Frame-Options "SAMEORIGIN" always;add_header Referrer-Policy "strict-origin-when-cross-origin" always;add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

server {    listen 80;    server_name _;    return 301 https://$host$request_uri;}

map $http_upgrade $connection_upgrade {    default upgrade;    '' close;}location / {    proxy_pass http://dify_upstream;    proxy_http_version 1.1;    proxy_set_header Host $host;    proxy_set_header X-Real-IP $remote_addr;    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    proxy_set_header X-Forwarded-Proto $scheme;    proxy_set_header Upgrade $http_upgrade;    proxy_set_header Connection $connection_upgrade;    proxy_read_timeout 300s;    proxy_buffering off;}

[root@LinuxPythonWorkshop ~]# docker run -d --name nginx-edge \  --restart unless-stopped \  -p 80:80 -p 443:443 \  --add-host=host.docker.internal:host-gateway \  -v /root/nginx-edge/conf/nginx.conf:/etc/nginx/nginx.conf:ro \  -v /root/nginx-edge/certs:/etc/nginx/certs:ro \  -v /root/nginx-edge/logs:/var/log/nginx \  nginx:1.27-alpine

[root@LinuxPythonWorkshop ~]# curl -sI https://127.0.0.1/ -k | head -14

HTTP/2 307server: nginx <- ✅ 版本隐藏strict-transport-security: max-age=31536000; includeSubDomainsx-content-type-options: nosniffx-frame-options: DENY <- ⚠️ 上游 Dify 的x-frame-options: SAMEORIGIN <- ⚠️ 我们加的，重复了referrer-policy: strict-origin-when-cross-originpermissions-policy: geolocation=(), microphone=(), camera=()

[root@LinuxPythonWorkshop ~]# curl -s -o /dev/null -w "%{http_code} -> %{redirect_url}\n" http://127.0.0.1/

[root@LinuxPythonWorkshop ~]# echo | openssl s_client -connect 127.0.0.1:443 -servername localhost 2>/dev/null | grep -E "Protocol|Cipher|Verify"

New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384Verify return code: 18 (self signed certificate)

[root@LinuxPythonWorkshop ~]# bash -c 'for i in $(seq 1 120); do curl -s -o /dev/null -w "%{http_code}\n" -k https://127.0.0.1/; done | sort | uniq -c'

[root@LinuxPythonWorkshop ~]# docker exec nginx-edge nginx -T 2>&1 | grep -nE "limit_req|limit_conn"

[root@LinuxPythonWorkshop ~]# bash -c 'time (seq 1 200 | xargs -P 50 -I{} curl -s -o /dev/null -w "%{http_code}\n" -k --http1.1 https://127.0.0.1/ | sort | uniq -c)'

    21 307   179 429real 0m4.185s   

[root@LinuxPythonWorkshop ~]# curl -s -o /dev/null -w "上游=%{http_code}\n" -k https://127.0.0.1/上游=307

x-frame-options: DENY <- 上游 Dify 返回的x-frame-options: SAMEORIGIN <- 边缘层加的

location / {    proxy_pass http://dify_upstream;    proxy_hide_header X-Frame-Options; # 摘掉上游的    proxy_hide_header X-Powered-By; # 顺手隐藏技术栈    ...}

[root@LinuxPythonWorkshop ~]# docker exec nginx-edge nginx -t && docker exec nginx-edge nginx -s reload

server: nginxstrict-transport-security: max-age=31536000; includeSubDomainsx-content-type-options: nosniffx-frame-options: SAMEORIGINreferrer-policy: strict-origin-when-cross-originpermissions-policy: geolocation=(), microphone=(), camera=()