main context
- events 
- http
  - server
    - location

http {
    server {
        listen 8080;           # server监听端口，不指定默认80
        root /data/up1;        # 默认文件查找根目录

        # 将请求按照uri进行分组处理
        location / {           # 选择最常匹配的location，如果不匹配任何location，返回404
            root /data/www;    # 文件查找根目录，覆盖server中的root配置 
        }
    
        # uri路径匹配，优先级低于下面的正则匹配!
        location /images/ {
            root /data;
        }

        # 使用正则表达式匹配(必须带有"~ "前缀)：匹配文件后缀名
        location ~ \.(gif|jpg|png)$ {        # 优先级高于uri路径匹配
            root /data/images;
        }

        # 作为代理服务器的配置方法
        location /proxy/ {                   # 将uri匹配的请求转发到proxy_pass指定的地址 
            proxy_pass http://IP地址:8080;
        }

        # 将请求代理到FastCGI
        # fastcgi_param是按照FastCGI的要求传递的参数，可以有多个，后面的`$XXX`是Nginx变量，拼成了参数的值
        location /fastcgi/ {
            fastcgi_pass  localhost:9000;                                       # fastCGI服务的地址   
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;   # 传给fastCGI服务的参数: SCRIPT_FILENAME
            fastcgi_param QUERY_STRING    $query_string;                        # 传给fastCGI服务的参数: QUERY_STRING
        }
    }
}

Syntax:     gzip on | off;
Default:    gzip off;
Context:    http, server, location, if in location   # 可以使用gzip指令的地方

resolver 10.0.0.1;

upstream dynamic {
    zone upstream_dynamic 64k;

    server backend1.example.com      weight=5;
    server backend2.example.com:8080 fail_timeout=5s slow_start=30s;
    server 192.0.2.1                 max_fails=3;
    server backend3.example.com      resolve;
    server backend4.example.com      service=http resolve;

    server backup1.example.com:8080  backup;
    server backup2.example.com:8080  backup;
}

server {
    location / {
        proxy_pass http://dynamic;
        health_check;
    }
}

worker_processes auto;

error_log /var/log/nginx/error.log info;

events {
    worker_connections  1024;
}

stream {
    upstream backend {
        hash $remote_addr consistent;

        server backend1.example.com:12345 weight=5;
        server 127.0.0.1:12345            max_fails=3 fail_timeout=30s;
        server unix:/tmp/backend3;
    }

    upstream dns {
       server 192.168.0.1:53535;
       server dns.example.com:53;
    }

    server {
        listen 12345;
        proxy_connect_timeout 1s;
        proxy_timeout 3s;
        proxy_pass backend;
    }

    server {
        listen 127.0.0.1:53 udp reuseport;
        proxy_timeout 20s;
        proxy_pass dns;
    }

    server {
        listen [::1]:12345;
        proxy_pass unix:/tmp/stream.socket;
    }
}

./configure --prefix=/opt/nginx \
	 --with-ld-opt="-Wl,-rpath,/path/to/luajit-or-lua/lib" \
	 --add-module=/path/to/ngx_devel_kit \
	 --add-module=/path/to/lua-nginx-module

OpenResty® aims to run your server-side web app completely in the Nginx server, 
leveraging Nginx''s event model to do non-blocking I/O not only with the HTTP 
clients, but also with remote backends like MySQL, PostgreSQL, Memcached, and Redis.

sudo yum install yum-utils
sudo yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo
sudo yum install openresty
sudo yum install openresty-resty

wget https://openresty.org/download/openresty-1.13.6.2.tar.gz
tar -xvf openresty-1.13.6.2.tar.gz
cd openresty-1.13.6.2/
./configure --with-pcre-jit --with-http_ssl_module --with-http_realip_module --with-http_stub_status_module --with-http_v2_module --prefix=/usr/local/bin/openresty
make -j2
make install     //默认安装在--prefix指定的目录：/usr/local/bin/openresty
export PATH=/usr/local/openresty/bin:$PATH

$ tree -L 2 /usr/local/openresty/
/usr/local/openresty/
|-- bin
|   |-- md2pod.pl
|   |-- nginx-xml2pod
|   |-- openresty -> /usr/local/openresty/nginx/sbin/nginx
|   |-- opm
|   |-- resty
|   |-- restydoc
|   `-- restydoc-index
|-- COPYRIGHT
|-- luajit
|   |-- bin
|   |-- include
|   |-- lib
|   `-- share
...

$ openresty -h
nginx version: openresty/1.13.6.2
Usage: nginx [-?hvVtTq] [-s signal] [-c filename] [-p prefix] [-g directives]

Options:
  -?,-h         : this help
  -v            : show version and exit
  -V            : show version and configure options then exit
  -t            : test configuration and exit
  -T            : test configuration, dump it and exit
  -q            : suppress non-error messages during configuration testing
  -s signal     : send signal to a master process: stop, quit, reopen, reload
  -p prefix     : set prefix path (default: /usr/local/openresty/nginx/)
  -c filename   : set configuration file (default: conf/nginx.conf)
  -g directives : set global directives out of configuration file

$ resty -e ''print("hello, world!")''
hello, world!

my $nginx_path = ''/usr/local/openresty/nginx/sbin/nginx'';
...
my @cmd = ($nginx_path, ''-p'', "$prefix_dir/", ''-c'', "conf/nginx.conf");
...

$ cat nginx.conf
worker_processes  1;
error_log logs/error.log;
events {
    worker_connections 1024;
}
http {
    server {
        listen 8080;
        location / {
            default_type text/html;
            content_by_lua ''
                ngx.say("<p>hello, world</p>")
            '';
        }
    }
}

openresty -p `pwd` -c nginx.conf

$ curl 127.0.0.1:8080
<p>hello, world</p>

git clone git://github.com/luarocks/luarocks.git
./configure --lua-suffix=jit --with-lua=/usr/local/openresty/luajit --with-lua-include=/usr/local/openresty/luajit/include/luajit-2.1
make install

git clone https://github.com/Kong/kong.git
cd kong
make install

$ ls bin/
busted  kong

$ cat bin/kong
#!/usr/bin/env resty

require "luarocks.loader"

package.path = "./?.lua;./?/init.lua;" .. package.path

require("kong.cmd.init")(arg)

yum install https://download.postgresql.org/pub/repos/yum/9.6/redhat/rhel-7-x86_64/pgdg-centos96-9.6-3.noarch.rpm
yum install postgresql96
yum install postgresql96-server
export PATH=$PATH:/usr/pgsql-9.6/bin/
postgresql96-setup initdb
systemctl start postgresql-9.6
su - postgres 
psql
CREATE USER kong; CREATE DATABASE kong OWNER kong;
alter user kong with encrypted password ''123456'';
\q

host    kong            kong            127.0.0.1/32            md5

# psql -h 127.0.0.1 -U kong kong -W
Password for user kong:
psql (9.6.10)
Type "help" for help.

kong=>

cp kong.conf.default kong.conf
# 在kong.conf中填入数据地址、用户、密码等

./bin/kong migrations up -c ./kong.conf

./bin/kong start -c ./kong.conf

proxy_listen = 0.0.0.0:8000, 0.0.0.0:8443

admin_listen = 127.0.0.1:8001, 127.0.0.1:8444 ssl

$ curl -i http://localhost:8001/
HTTP/1.1 200 OK
Date: Sat, 29 Sep 2018 08:56:51 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Access-Control-Allow-Origin: *
Server: kong/0.14.1
Content-Length: 5667

{"plugins":{"enabled_in_cluster":[],"availab...

docker run --rm -p 8080:8080 pgbi/kong-dashboard start \
  --kong-url http://kong:8001
  --basic-auth user1=password1 user2=password2

kong stop

kong reload

 curl -i -X POST \
  --url http://localhost:8001/services/ \
  --data ''name=example-service'' \
  --data ''url=http://mockbin.org''

{
    "connect_timeout": 60000,
    "created_at": 1538213979,
    "host": "mockbin.org",
    "id": "ebed2707-e2fb-4694-9e8e-fb66fe9dd7c8",
    "name": "example-service",
    "path": null,
    "port": 80,
    "protocol": "http",
    "read_timeout": 60000,
    "retries": 5,
    "updated_at": 1538213979,
    "write_timeout": 60000
}

 curl -i -X POST \
  --url http://localhost:8001/services/example-service/routes \
  --data ''hosts[]=example.com''

{
    "created_at": 1538185340,
    "hosts": [
        "example.com"
    ],
    "id": "4738ae2c-b64a-4fe5-9e2a-5855e769a9e8",
    "methods": null,
    "paths": null,
    "preserve_host": false,
    "protocols": [
        "http",
        "https"
    ],
    "regex_priority": 0,
    "service": {
        "id": "ebed2707-e2fb-4694-9e8e-fb66fe9dd7c8"
    },
    "strip_path": true,
    "updated_at": 1538185340
}

curl -i -X GET \
  --url http://localhost:8000/ \
  --header ''Host: example.com''

10.10.192.35 example.com

 curl -i -X POST \
  --url http://localhost:8001/services/example-service/plugins/ \
  --data ''name=key-auth''

{
    "config": {
        "anonymous": "",
        "hide_credentials": false,
        "key_in_body": false,
        "key_names": [
            "apikey"
        ],
        "run_on_preflight": true
    },
    "created_at": 1538218948000,
    "enabled": true,
    "id": "f25f3952-d0d4-4923-baac-860554fc2fc1",
    "name": "key-auth",
    "service_id": "ebed2707-e2fb-4694-9e8e-fb66fe9dd7c8"
}

curl -i -X GET \
>   --url http://localhost:8000/ \
>   --header ''Host: example.com''
HTTP/1.1 401 Unauthorized
Date: Sat, 29 Sep 2018 11:03:55 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
WWW-Authenticate: Key realm="kong"
Server: kong/0.14.1
Content-Length: 41

curl -i -X POST \
  --url http://localhost:8001/consumers/ \
  --data "username=Jason"

{
    "created_at": 1538219225,
    "custom_id": null,
    "id": "f2450962-e4bb-477f-8df6-85984eb94e09",
    "username": "Jason"
}

curl -i -X POST \
  --url http://localhost:8001/consumers/Jason/key-auth/ \
  --data ''key=123456''

{
    "consumer_id": "f2450962-e4bb-477f-8df6-85984eb94e09",
    "created_at": 1538219311000,
    "id": "0332d36f-61b9-425a-b563-510c11a85e85",
    "key": "123456"
}

 curl -i -X GET \
  --url http://localhost:8000 \
  --header "Host: example.com" \
  --header "apikey: 123456"

X-Consumer-ID, the ID of the Consumer on Kong
X-Consumer-Custom-ID, the custom_id of the Consumer (if set)
X-Consumer-Username, the username of the Consumer (if set)
X-Credential-Username, the username of the Credential (only if the consumer is not the ''anonymous'' consumer)
X-Anonymous-Consumer, will be set to true when authentication failed, and the ''anonymous'' consumer was set instead.

Basic Auth
HMAC Auth
JWT Auth
Key Auth
LDAP Auth
OAuth 2.0 Auth

Bot Detection (机器人检测)
CORS (跨域请求)
IP Restriction (IP限制)

ACL (访问控制）
Rate Limiting （限速）
Request Size Limiting
Request Termination
Response Rate Limiting

AWS Lambda
Azure Functions
Apache OpenWhisk
Serverless Functions

Datadog
Prometheus
Zipkin

Correlation ID
Request Transformer
Response Transformer

File Log
HTTP Log
Loggly
StatsD
Syslog
TCP Log
UDP Log

# ./bin/kong start -c ./kong.conf
...
ERROR: ./kong/globalpatches.lua:63: module ''socket'' not found:No LuaRocks module found for socket
...

# kong migrations up -c ./kong.conf
...
[postgres error] could not retrieve current migrations: [postgres error] ERROR: function to_regclass(unknown) does not exist (8)
...

yum install https://download.postgresql.org/pub/repos/yum/9.6/redhat/rhel-7-x86_64/pgdg-centos96-9.6-3.noarch.rpm
yum install postgresql96
yum install postgresql96-server

nginx: [emerg] unknown directive "real_ip_header" in /usr/local/kong/nginx-kong.conf:73

./configure --with-pcre-jit --with-http_ssl_module --with-http_realip_module --with-http_stub_status_module --with-http_v2_module
make -j2
make install     //默认安装在/usr/local/bin/openresty
export PATH=/usr/local/openresty/bin:$PATH

第一个容器是InitContainer，负责初始化数据库；

第二个容器是kong-proxy，只开放了admin接口，负责提供Kong的管理API；

第三个容器是kong-ingress-controller，负责Kubernetes资源与Kong的衔接，监测Kubernetes资源的变动，及时调用Kong的管理API，更新Kong的配置。

KongConsumer:   kong的用户
KongPlugin:     kong的插件的配置项
KongCredential: kong用户的认证凭证
KongIngress:    对用户创建的ingress的补充配置

apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: <object name>
  namespace: <object namespace>
username: <user name>
custom_id: <custom ID>

apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: consumer-team-x
username: team-X
custom_id: my_team_x # optional and not recommended, please use `username`

apiVersion: configuration.konghq.com/v1
kind: KongCredential
metadata:
  name: credential-team-x
consumerRef: consumer-team-x
type: key-auth
config:
  key: 62eb165c070a41d5c1b58d9d3d725ca1

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: <object name>
  namespace: <object namespace>
  labels:
    global: "true" # optional, please note the quotes around true
consumerRef: <optional, name of an existing consumer> # optional
disabled: <boolean>  # optional
config:
    key: value
plugin: <name-of-plugin>

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: http-svc-consumer-ratelimiting
consumerRef: consumer-team-x
config:
  hour: 1000
  limit_by: ip
  second: 100
plugin: rate-limiting

apiVersion: configuration.konghq.com/v1
kind: KongIngress
metadata:
  name: configuration-demo
upstream:
  hash_on: none
  hash_fallback: none
  healthchecks:
    active:
      concurrency: 10
      healthy:
        http_statuses:
        - 200
        - 302
        interval: 0
        successes: 0
      http_path: "/"
      timeout: 1
      unhealthy:
        http_failures: 0
        http_statuses:
        - 429
        interval: 0
        tcp_failures: 0
        timeouts: 0
    passive:
      healthy:
        http_statuses:
        - 200
        successes: 0
      unhealthy:
        http_failures: 0
        http_statuses:
        - 429
        - 503
        tcp_failures: 0
        timeouts: 0
    slots: 10
proxy:
  protocol: http
  path: /
  connect_timeout: 10000
  retries: 10
  read_timeout: 10000
  write_timeout: 10000
route:
  methods:
  - POST
  - GET
  regex_priority: 0
  strip_path: false
  preserve_host: true
  protocols:
  - http
  - https

wget https://raw.githubusercontent.com/Kong/kubernetes-ingress-controller/master/deploy/manifests/custom-types.yaml
kubectl create -f custom-types.yaml

wget https://raw.githubusercontent.com/Kong/kubernetes-ingress-controller/master/deploy/manifests/namespace.yaml
kubectl create -f namespace.yaml

wget https://raw.githubusercontent.com/Kong/kubernetes-ingress-controller/master/deploy/manifests/rbac.yaml
kubectl create -f rbac.yaml

wget https://raw.githubusercontent.com/Kong/kubernetes-ingress-controller/master/deploy/manifests/postgres.yaml
kubectl create -f postgres.yaml

...
      volumes:
      - name: datadir
        persistentVolumeClaim:
          claimName: datadir
  volumeClaimTemplates:
  - metadata:
      name: datadir
    spec:
      accessModes:
        - "ReadWriteOnce"
      resources:
        requests:
          storage: 1Gi

wget https://raw.githubusercontent.com/Kong/kubernetes-ingress-controller/master/deploy/manifests/ingress-controller.yaml
kubectl create -f ingress-controller.yaml

wget https://raw.githubusercontent.com/Kong/kubernetes-ingress-controller/master/deploy/manifests/kong.yaml
kubectl create -f kong.yaml

---
apiVersion: v1
kind: Service
metadata:
  name: kong-proxy
  namespace: kong
spec:
  type: NodePort
  ports:
  - name: kong-proxy
    port: 80
    targetPort: 8000
    protocol: TCP
  - name: kong-proxy-ssl
    port: 443
    targetPort: 8443
    protocol: TCP
  selector:
    app: kong

$ kubectl -n kong get pod -o wide
NAME                                     READY     STATUS    RESTARTS   AGE       IP             NODE
kong-54875c6bd7-8ttgf                    1/1       Running   0          15s       192.168.78.8   10.10.173.203
kong-ingress-controller-cfc7dc7d-vnp64   2/2       Running   7          15m       192.168.78.6   10.10.173.203
postgres-0                               1/1       Running   0          17m       192.168.78.5   10.10.173.203

$ kubectl -n kong get svc
NAME                      TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                      AGE
kong-ingress-controller   NodePort    10.254.147.53   <none>        8001:31627/TCP               27m
kong-proxy                NodePort    10.254.237.61   <none>        80:32057/TCP,443:31552/TCP   52s
postgres                  ClusterIP   10.254.77.113   <none>        5432/TCP                     47m

---
apiVersion: v1
kind: Service
metadata:
  name: kong-dashboard
  namespace: kong
spec:
  type: NodePort
  ports:
  - name: kong-dashboard
    port: 80
    targetPort: 8080
    protocol: TCP
  selector:
    app: dashboard
---

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: dashboard
  namespace: kong
spec:
  template:
    metadata:
      labels:
        name: dashboard
        app: dashboard
    spec:
      containers:
      - name: kong-dashboard
        args:
        - start
        - --kong-url http://kong-ingress-controller:8001
        - --basic-auth admin=admin
        image: pgbi/kong-dashboard:latest
        ports:
        - name: http
          containerPort: 8080
          protocol: TCP

$ kubectl create -f https://raw.githubusercontent.com/introclass/kubernetes-yamls/master/all-in-one/webshell-all-in-one.yaml
namespace "demo-webshell" created
ingress "webshell-ingress" created
service "webshell" created
deployment "webshell" created

Service                     Methods    Protocols    Hosts          Paths    Priority    
demo-webshell.webshell.80   (none)     http         webshell.com   /        0

Name                        Protocol    Host                         Port    PATH
demo-webshell.webshell.80   http        demo-webshell.webshell.80    80      /

// kong-proxy的采用NodePort方式，端口是32057
kong-proxy                NodePort    10.254.237.61   <none>        80:32057/TCP,443:31552/TCP   52s

$ curl -v -H "Host: webshell.com" 10.10.173.203:32057
* About to connect() to 10.10.173.203 port 32057 (#0)
*   Trying 10.10.173.203...
* Connected to 10.10.173.203 (10.10.173.203) port 32057 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Accept: */*
> Host: webshell.com
>
< HTTP/1.1 200 OK < Content-Type: text/html; charset=utf-8 < Content-Length: 382 < Connection: keep-alive < Date: Mon, 08 Oct 2018 10:59:08 GMT < X-Kong-Upstream-Latency: 3 < X-Kong-Proxy-Latency: 9 < Via: kong/0.14.1 < <html> <head> <meta content="text/html; charset=utf-8"> <title>WebShell</title> </head> <body> <form method="post" accept-charset="utf-8"> Command: <input type="text" name="command" width="40%" value="hostname"> Params : <input type="text" name="params" width="80%" value=""> <input type="submit" value="submit"> </form> <pre> webshell-cc785f4f8-2vp6c </pre> </body> </html>