1.1常用shell#!/bin/sh # 文件名 quit.sh # 退出caddy ./caddy stop exit 0 ---------------------------------- #!/bin/sh # 文件名reload.sh # 重新加载caddy配置文件 ./caddy reload --config ./Caddyfile ---------------------------------- #!/bin/sh # 文件名start.sh # 启动caddy # ./caddy start --config /home/datum/program/caddyapp/Caddyfile # cd /home/datum/program/caddyapp ./caddy start --config ./Caddyfile exit 0 ---------------------------------- #!/bin/sh # 文件名validate.sh # 验证caddy配置文件 # ./caddy validate --config /home/datum/program/caddyapp/Caddyfile # cd /home/datum/program/caddyapp ./caddy validate --config ./Caddyfile2.1文件夹目录转成http服务示例# 公开文件用于下载传输 https://ac1.mydomain.com:443 { handle_path /openfile/* { root * /home/check/openfile file_server { hide *.git browse } } }2.2代理本地的静态网页使其能通过http访问http://www.mydomain.com:80 https://www.mydomain.com:443 { handle_path /* { file_server { hide .git index index.html } root * /home/webapp/myhtml try_files {path} /index.html } }2.3代理http指定的端口# http后端接口 http://www.mydomain.com:80, https://www.mydomain.com:443 { import cors # 代理本地 15003 端口的http服务 route /* { #uri strip_prefix /taobao8-api reverse_proxy * { to http://localhost:15003 lb_policy client_ip_hash header_down -proxy-connection flush_interval 300ms transport http { dial_timeout 10s keepalive 10m } } } # 代理本地 15008 端口的http服务url中的域名后面的路径要加/taobao8-api/ route /taobao8-api/* { uri strip_prefix /taobao8-api reverse_proxy * { to http://localhost:15008 lb_policy client_ip_hash header_down -proxy-connection flush_interval 300ms transport http { dial_timeout 10s keepalive 10m } } } # 将xxl-job的整理服务放出来 handle_path /xxljob/* { uri strip_prefix /xxljob reverse_proxy * { to http://localhost:15038 lb_policy client_ip_hash header_down -proxy-connection flush_interval 300ms transport http { dial_timeout 10s keepalive 10m } } } }2.4, api和网页在同一个域名端口下面的示例# api和网页在同一个域名端口下面的示例https://m2.mydomain.com:3033 {# 反向代理apihandle_path /api/* {uri strip_prefix /apireverse_proxy * http://127.0.0.1:8080 {header_down -proxy-connectionflush_interval 300mstransport http {dial_timeout 10skeepalive 10m}}}# 开放网页handle_path /* {file_server {index index.html}root * /home/page/www/try_files {path} /index.html}}2.5, 配置非www的主域名跳转到www子域名http自动到https# 非 www → www (http https 都会 301 跳转到 https://www.abc.com)http://abc.com, https://abc.com {redir https://www.abc.com{uri} permanent}# www 主站 (强制 https)https://www.abc.com {handle_path /* {root * /home/abcdir/uvp/app-page# 处理根路径 的情况rewrite 到 /index.htmlroot {path }rewrite root /index.htmltry_files {path} /index.htmlfile_server}log {output file /home/datum/program/caddy-linux/logs/access.log {roll_size 10mbroll_keep 5roll_keep_for 48h}level INFO}}2.6 负载均衡代理api配置示例2.6.1# 关于block__common和block__handle_strip_path_and_proxy_args(block__common) {import block__sub_header#import block__logger#import block__corsimport block__html_no_cacheimport block__handle_hide_gitimport block__compress}########### 代理参数(block__handle_strip_path_and_proxy_args) {handle /{args[0]} {uri strip_prefix /{args[1]}reverse_proxy {args[2]} {header_down -proxy-connectionflush_interval 300mstransport http {dial_timeout 10skeepalive 10mkeepalive_idle_conns 10240}}}}########### 静态网页单节点后端api负载均衡2个节点10.0.0.11:3211 和 10.0.0.12:3211 的示例# 验证负载均衡的网页http://dapp2.abc.top, https://dapp2.mydomain.com {import block__commonimport block__handle_strip_path_and_proxy_args * * 10.0.0.11:3901}# 的两台机器负载均衡http://api2.mydomain.com, https://api2.mydomain.com {import block__common# 转发所有请求到两个上游节点默认使用负载均衡round_robinreverse_proxy * {to http://10.0.0.11:3211to http://10.0.0.12:3211# 可选健康检查health_uri /v1/open/healthhealth_interval 30shealth_timeout 5s# 可选负载策略默认是随机/轮询lb_policy round_robin# 可选当某个节点不可用时快速切换fail_duration 30smax_fails 2}}# end2.6.2https://www.my-domain.com, http://www.my-domain.com { import block__cors # dapp页面 handle_path /* { file_server { hide .git index index.html } root * /www/app-page/dist try_files {path} /index.html } # 静止actuator的所有接口 handle /api/actuator/* { respond Access Denied 403 { close } } # 静止manage的所有接口 handle /api/v1/manage/* { respond Access Denied 403 { close } } # /api/v1/claim 这个路径转发到机器 10.0.1.2 handle /api/v1/claim { uri strip_prefix /api log_append route_name api_springboot log_append real_ip {http.request.client_ip} log_append original_uri {http.request.uri} log_append upstream {http.reverse_proxy.upstream.hostport} reverse_proxy 10.0.1.2:3710 { } } # api转发到 10.0.1.3和 10.0.1.4 这两个机器 使用ip hash, handle_path /api/* { uri strip_prefix /api reverse_proxy 10.0.1.3:3820 10.0.1.4:3715 { # 使用IP HASH lb_policy ip_hash transport http { read_timeout 50s } } } }2.6.3 代理websocket示例https://d6.domain1.com:443 { import block__cors # ---------------------------- # 永续 WebSocket 代理 # 访问示例 wss://d6.domain1.com:443/ws/bn/perp/ws 会访问到 wss://fstream.domain2.com/ws handle /ws/bn/perp/* { # 不做额外的 uri 改写handle_path 会去掉 /ws/bn/perp 前缀 reverse_proxy * https://fstream.domain2.com { header_up Host fstream.domain2.com #header_up Connection {Connection} #header_up Upgrade {Upgrade} header_down -Proxy-Connection transport http { #versions 1.1 dial_timeout 10s keepalive 10m } } } # 现货 WebSocket 代理 # 访问示例 wss://d6.domain1.com:443/ws/bn/perp/ws 会访问到 wss://stream.domain2.com:9443/ws handle /ws/bn/spot/* { # 不做额外的 uri 改写handle_path 会去掉 /ws/bn/spot 前缀 reverse_proxy * https://stream.domain2.com:9443 { header_up Host fstream.domain2.com #header_up Connection {Connection} #header_up Upgrade {Upgrade} header_down -Proxy-Connection transport http { #versions 1.1 dial_timeout 10s keepalive 10m } } } # 下面可以添加其它的配置-比如https的代理 }2.7 caddy请求api接口代理时给api添加上下文根# API反向代理-验证【去掉url中的2api添加上下文根project-ctx】。假设java的api的请求url为http://5.5.7.10:13225 java实例的上下文根为project-ctx网页请求java的根为2api# 请求示例 https://www.my-domain.com/2api/v1/dev/open/mbr/getImgCode# 转到java为 https://www.my-domain.com/project-ctx/v1/dev/open/mbr/getImgCodehttp://www.my-domain.com, https://www.my-domain.com {handle_path /2api/* {rewrite * /project-ctx{uri}reverse_proxy http://5.5.7.10:13225 {header_down -Proxy-Connectionflush_interval 300mstransport http {dial_timeout 10skeepalive 10m}}}}2.8 通过IP地址配置caddy文件下载# 通过IP地址配置caddy文件下载 # 假设ip为11.7.98.47 端口为 23113下载路径 /check/iso/ 文件位置/mnt1/openfile 则下载链接为 http://11.7.98.47:23113/check/iso/ # vim open_app.conf # 公开文件用于下载传输 http://:23113 { # 公用的文件下载。谨慎 handle_path /check/openfile/* { root * /home/datum/check/openfile file_server { hide *.git browse } } # 操作系统安装文件iso下载 handle_path /check/iso/* { root * /mnt1/openfile file_server { hide *.git browse } } }3.1caddy另外指定域名的证书先在caddy根目录下创建文件夹ssl_dir把证书都放进去假设静态网页在机器 10.0.0.5 上对外 端口是8081域名为 www.mydomain.com证书为 mydomain.pem 私钥为 mydomain.keyhttps://www.mydomain.com {tls ./ssl_dir/mydomain.pem ./ssl_dir/mydomain.keyimport block__handle_strip_path_and_proxy_args * * http://10.0.0.5:8081}6HTTP的反向代理。通过https://ta1.abc.com来访问https://www.efg.vn 便于开发人员本地调试# HTTP的反向代理。通过https://ta1.abc.com来访问https://www.efg.vn 便于开发人员本地调试https://ta1.abc.com {handle_path /* {reverse_proxy * https://www.efg.vn {header_up Host www.efg.vnheader_down -proxy-connectionflush_interval 300mstransport http {tlsdial_timeout 10skeepalive 10m}}}}7负载均衡配置# end