為 MinIO 伺服器設定 NGINX 代理

以下文件提供了在 Linux 環境中設定 NGINX 將請求代理到 MinIO 的基準。它並非旨在作為 NGINX、代理或一般反向代理的全面方法。請根據您的基礎架構修改設定。

此文件假設以下條件

現有的 NGINX 部署
現有的 MinIO 部署
唯一識別 MinIO 部署的 DNS 主機名稱

有兩種模型可將請求代理到 MinIO 伺服器 API 和 MinIO 主控台

專用 DNS

為 MinIO 服務建立或設定專用的 DNS 名稱。

對於 MinIO 伺服器 S3 API，將請求代理到該網域的根目錄。對於 MinIO 主控台 Web GUI，將請求代理到 /minio 子路徑。

例如，假設主機名稱為 minio.example.net

將對根目錄 https://minio.example.net 的請求代理到在 https://minio.local:9000 上接聽的 MinIO 伺服器。
將對子路徑 https://minio.example.net/minio/ui 的請求代理到在 https://minio.local:9001 上接聽的 MinIO 主控台。

以下位置區塊提供了在您獨特的環境中進行進一步自訂的範本

upstream minio_s3 {
   least_conn;
   server minio-01.internal-domain.com:9000;
   server minio-02.internal-domain.com:9000;
   server minio-03.internal-domain.com:9000;
   server minio-04.internal-domain.com:9000;
}

upstream minio_console {
   least_conn;
   server minio-01.internal-domain.com:9001;
   server minio-02.internal-domain.com:9001;
   server minio-03.internal-domain.com:9001;
   server minio-04.internal-domain.com:9001;
}

server {
   listen       80;
   listen  [::]:80;
   server_name  minio.example.net;

   # Allow special characters in headers
   ignore_invalid_headers off;
   # Allow any size file to be uploaded.
   # Set to a value such as 1000m; to restrict file size to a specific value
   client_max_body_size 0;
   # Disable buffering
   proxy_buffering off;
   proxy_request_buffering off;

   location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_connect_timeout 300;
      # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      chunked_transfer_encoding off;

      proxy_pass https://minio_s3; # This uses the upstream directive definition to load balance
   }

   location /minio/ui/ {
      rewrite ^/minio/ui/(.*) /$1 break;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-NginX-Proxy true;

      # This is necessary to pass the correct IP to be hashed
      real_ip_header X-Real-IP;

      proxy_connect_timeout 300;

      # To support websockets in MinIO versions released after January 2023
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      # Some environments may encounter CORS errors (Kubernetes + Nginx Ingress)
      # Uncomment the following line to set the Origin request to an empty string
      # proxy_set_header Origin '';

      chunked_transfer_encoding off;

      proxy_pass https://minio_console; # This uses the upstream directive definition to load balance
   }
}

S3 API 簽名計算演算法不支援您託管 MinIO 伺服器 API 的代理方案，例如 example.net/s3/。

您還必須為 MinIO 部署設定以下環境變數

將 MINIO_BROWSER_REDIRECT_URL 設定為 MinIO 主控台的代理主機 FQDN (https://example.net/minio/ui)

子網域

為 MinIO 伺服器 S3 API 和 MinIO 主控台 Web GUI 建立或設定單獨且唯一的子網域。

例如，假設根網域為 example.net

將對子網域 minio.example.net 的請求代理到在 https://minio.local:9000 上接聽的 MinIO 伺服器
將對子網域 console.example.net 的請求代理到在 https://minio.local:9001 上接聽的 MinIO 主控台

以下位置區塊提供了在您獨特的環境中進行進一步自訂的範本

upstream minio_s3 {
   least_conn;
   server minio-01.internal-domain.com:9000;
   server minio-02.internal-domain.com:9000;
   server minio-03.internal-domain.com:9000;
   server minio-04.internal-domain.com:9000;
}

upstream minio_console {
   least_conn;
   server minio-01.internal-domain.com:9001;
   server minio-02.internal-domain.com:9001;
   server minio-03.internal-domain.com:9001;
   server minio-04.internal-domain.com:9001;
}

server {
   listen       80;
   listen  [::]:80;
   server_name  minio.example.net;

   # Allow special characters in headers
   ignore_invalid_headers off;
   # Allow any size file to be uploaded.
   # Set to a value such as 1000m; to restrict file size to a specific value
   client_max_body_size 0;
   # Disable buffering
   proxy_buffering off;
   proxy_request_buffering off;

   location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_connect_timeout 300;
      # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      chunked_transfer_encoding off;

      proxy_pass http://minio_s3; # This uses the upstream directive definition to load balance
   }
}

server {

   listen       80;
   listen  [::]:80;
   server_name  console.example.net;

   # Allow special characters in headers
   ignore_invalid_headers off;
   # Allow any size file to be uploaded.
   # Set to a value such as 1000m; to restrict file size to a specific value
   client_max_body_size 0;
   # Disable buffering
   proxy_buffering off;
   proxy_request_buffering off;

   location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-NginX-Proxy true;

      # This is necessary to pass the correct IP to be hashed
      real_ip_header X-Real-IP;

      proxy_connect_timeout 300;

      # To support websocket
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      chunked_transfer_encoding off;

      proxy_pass http://minio_console/; # This uses the upstream directive definition to load balance
   }
}

S3 API 簽名計算演算法不支援您在子路徑（例如 minio.example.net/s3/）上託管 MinIO 伺服器 API 的代理方案。

您還必須為 MinIO 部署設定以下環境變數

將 MINIO_BROWSER_REDIRECT_URL 設定為 MinIO 主控台的代理主機 FQDN (https://console.example.net/)