AWS EB-将所有流量重定向到https

Question

GET example.com => https://www.example.com

我已经在.ebExtensions文件夹中用以下代码创建了一个配置文件

Resources:
  sslSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      CidrIp: 0.0.0.0/0

files:
  /etc/nginx/conf.d/999_nginx.conf:
    mode: "000644"
    owner: root
    group: root
    content: |

      upstream nodejsserver {
        server 127.0.0.1:8081;
        keepalive 256;
      }

      # HTTP server

      server {
        listen       8080;
        server_name  localhost;
        return        301 https://$host$request_uri;
      }

      # HTTPS server

      server {
        listen       443;
        server_name  localhost;

        ssl                  on;
        ssl_certificate      /etc/pki/tls/certs/server.crt;
        ssl_certificate_key  /etc/pki/tls/certs/server.key;

        ssl_session_timeout  5m;

        ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_prefer_server_ciphers   on;

        location / {
          proxy_pass  http://nodejsserver;
          proxy_set_header   Connection "";
          proxy_http_version 1.1;
          proxy_set_header        Host                $host;
          proxy_set_header        X-Real-IP           $remote_addr;
          proxy_set_header        X-Forwarded-For     $proxy_add_x_forwarded_for;
          proxy_set_header        X-Forwarded-Proto   https;
        }
      }

  /etc/pki/tls/certs/server.crt:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN CERTIFICATE-----
      my crt
      -----END CERTIFICATE-----

  /etc/pki/tls/certs/server.key:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN RSA PRIVATE KEY-----
      my key
      -----END RSA PRIVATE KEY-----

  /etc/nginx/conf.d/gzip.conf:
    content: |
      gzip on;
      gzip_comp_level 9;
      gzip_http_version 1.0;
      gzip_types text/plain text/css image/png image/gif image/jpeg application/json application/javascript application/x-javascript text/javascript text/xml application/xml application/rss+xml application/atom+xml application/rdf+xml;
      gzip_proxied any;
      gzip_disable "msie6";

commands:
   00_enable_site:
    command: 'rm -f /etc/nginx/sites-enabled/*'

我确信aws会考虑我的配置，因为de ssl工作得很好。但http块不工作。没有重定向。

也许我的问题是关于重写EB的原始nginx配置，你知道如何实现这一点吗？

谢谢你

Answer 1

好的，找到了问题，EB创建了一个默认配置文件/etc/nginx/conf.d/00_elastic_beanstalk_proxy.conf，它正在监听8080。因此，由于Nginx使用的是先前为8080定义的规则，所以您的重定向不会被接收。

这是我使用的一个配置文件。它生成的文件将在默认规则之前。

https://github.com/jozzhart/beanstalk-single-forced-ssl-nodejs-pm2/blob/master/.ebextensions/https-redirect.config