192.xxx.xxx.72（主，weight=1，文件服务器）
192.xxx.xxx.40（从，weight=3）
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"'
'"$ssl_cipher" "$ssl_client_serial"'
'"$http_cookie" "$http_des_systems"';
upstream target_port{
server 192.xxx.xxx.72:6125 weight=1;
server 192.xxx.xxx.40:6125 weight=3;
}
limit_req_zone $binary_remote_addr zone=one:10m rate=10000r/s;
server {
listen 5000 ssl;
server_name localhost;
access_log logs/$http_user_agent main;
ssl_certificate /home/xxx/certs/SS.crt;
ssl_certificate_key /home/xxx/certs/SS.key;
ssl_enc_certificate /home/xxx/certs/SE.crt;
ssl_enc_certificate_key /home/xxx/certs/SE.key;
ssl_verify_client on;
# client use the soft cert
ssl_client_certificate /home/xxx/certs/CA.crt;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
client_max_body_size 5000m;
location / {
limit_req zone=one burst=10000 nodelay;
proxy_set_header X-SSL-Cipher $ssl_cipher;
proxy_set_header X-SSL-Client-Cert $ssl_client_cert;
proxy_set_header X-SSL-Client-Serial $ssl_client_serial;
proxy_set_header X-SSL-Client-S-DN $ssl_client_s_dn;
proxy_set_header X-SSL-Client-I-DN $ssl_client_i_dn;
proxy_set_header X-SSL-Client-addr $remote_addr;
proxy_pass http://192.xxx.xxx.72:5002;
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
server {
listen 5002;
server_name localhost;
location / {
include uwsgi_params;
uwsgi_pass target_port;
}
location /V2/send_file {
include uwsgi_params;
uwsgi_pass 0.0.0.0:6125;
}
location /V2/get_file {
include uwsgi_params;
uwsgi_pass 0.0.0.0:6125;
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
server {
listen 5001 ssl;
server_name localhost;
ssl_certificate /home/xxx/certs/SS.crt;
ssl_certificate_key /home/xxx/certs/SS.key;
ssl_enc_certificate /home/xxx/certs/SE.crt;
ssl_enc_certificate_key /home/xxx/certs/SE.key;
ssl_verify_client on;
# client use the soft cert
ssl_client_certificate /home/xxx/certs/CA.crt;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
proxy_pass http://192.xxx.xxx.72:5002;
}
}
