分类目录归档：Information techonology

Nginx在反向代理连接失败时回退到本地文件的配置

需求：用户连接时，默认显示反向代理的内容，如果后端服务器无法连接，则显示预先渲染好的本地文件。

实现：

server {
    # ... #

    # define a named location block for static files
    location @local_static_files {
        root /var/www/html;
        index index.html;
        try_files $uri $uri/index.html =404;
        break;
    }

    location / {
        # try proxy first
        proxy_pass http://backend-server:8080/;
        
        # set a relative smaller timeout to minimize user wait time
        client_max_body_size    16m;
        client_body_buffer_size 128k;
        proxy_connect_timeout   2s;
        proxy_send_timeout      1s;
        proxy_read_timeout      1s;
        proxy_buffers           32 4k;

        # see https://github.com/Jamesits/oh-my-nginx/blob/master/conf.d/templates/transparent-proxy.conf
        include conf.d/templates/transparent-proxy.conf;

        # if the backend is down (502), we fallback to our local static files
        error_page 502 = @local_static_files;

        # if you need to mask more proxy failures: 
        # proxy_intercept_errors on; # intercept all >300 return code if you need
    }

    # ... #
}

server {

# ... #

# define a named location block for static files

location @local_static_files {

root /var/www/html;

index index.html;

try_files $uri $uri/index.html =404;

break;

}

location / {

# try proxy first

proxy_pass http://backend-server:8080/;

# set a relative smaller timeout to minimize user wait time

client_max_body_size 16m;

client_body_buffer_size 128k;

proxy_connect_timeout 2s;

proxy_send_timeout 1s;

proxy_read_timeout 1s;

proxy_buffers 32 4k;

# see https://github.com/Jamesits/oh-my-nginx/blob/master/conf.d/templates/transparent-proxy.conf

include conf.d/templates/transparent-proxy.conf;

# if the backend is down (502), we fallback to our local static files

error_page 502 = @local_static_files;

# if you need to mask more proxy failures:

# proxy_intercept_errors on; # intercept all >300 return code if you need

}

# ... #

}

Ubuntu 18.04安装GoodERP

发表评论

GoodERP是Odoo的中国特色插件集合，也非常中国特色地只给了Windows下的安装说明。简单记述一下怎么在Linux上安装它。

继续阅读 →

Proxmox VE 5.4不停机修改主机名

发表评论

今天修理一台坏掉的Proxmox VE。打开网页管理面板一看，本来是单节点工作的机子上显示了两个节点，但是corosync并没有在运行。更为诡异的是，其中一个节点显示了本机的存储池，另一个节点显示了本机的虚拟机，各种状态API则是有的好有的坏。检查后发现，这台机子的主机名被人改过，但是PVE的一些设置没有同步，导致API出现了各种问题。这里就体现出了PVE的缺点：有些地方过度设计（例如用DNS查询来寻找所有节点），有些地方欠缺考虑（例如主机名不和系统同步），有些地方文档几乎没有。

经过研究，单节点的PVE修改主机名还算简单，只需要将几个不同地方的配置文件同步上即可。至于集群的PVE主机，我的建议是能少折腾尽量少折腾，毕竟身体最重要。

继续阅读 →

Grafana使用Azure Active Directory的OAuth2登录

发表评论

首先在Azure Portal创建应用。

Azure AD -> App registrations -> New application registration，Display name 随便填，Reply URL 填http://example.com/login/generic_oauth（域名部分根据你的真实情况填写）。点创建。创建完成后，前往Settings -> Keys，在Password表中随便填一个description，expires选Never expires，点保存，value中会显示一个随机字符串key，记下这个字符串。

然后你需要复制：

Azure AD的GUID（点击Portal右上角Directory + subscription后可以看到）
你刚创建的应用的Application ID（在Registered app页面可以看到）
Secret，即你刚创建的Key

接着编辑Grafana配置文件/etc/grafana/grafana.ini：

#################################### Generic OAuth ##########################
[auth.generic_oauth]
enabled = true
name = Azure AD
allow_sign_up = true
client_id = <Application GUID>
client_secret = <Secret>
scopes = openid email name
auth_url = https://login.microsoftonline.com/<Directory GUID>/oauth2/authorize
token_url = https://login.microsoftonline.com/<Directory GUID>/oauth2/token
api_url = 
team_ids =
allowed_organizations =
;tls_skip_verify_insecure = false
;tls_client_cert =
;tls_client_key =
;tls_client_ca =

; Set to true to enable sending client_id and client_secret via POST body instead of Basic authentication HTTP header
; This might be required if the OAuth provider is not RFC6749 compliant, only supporting credentials passed via POST payload
;send_client_credentials_via_post = false

#################################### Generic OAuth ##########################

[auth.generic_oauth]

enabled = true

name = Azure AD

allow_sign_up = true

client_id = <Application GUID>

client_secret = <Secret>

scopes = openid email name

auth_url = https://login.microsoftonline.com/<Directory GUID>/oauth2/authorize

token_url = https://login.microsoftonline.com/<Directory GUID>/oauth2/token

api_url =

team_ids =

allowed_organizations =

;tls_skip_verify_insecure = false

;tls_client_cert =

;tls_client_key =

;tls_client_ca =

; Set to true to enable sending client_id and client_secret via POST body instead of Basic authentication HTTP header

; This might be required if the OAuth provider is not RFC6749 compliant, only supporting credentials passed via POST payload

;send_client_credentials_via_post = false

重启Grafana，大功告成。

ifupdown禁用一个接口上的IPv6 RA

发表评论

iface eth0 inet6 static
        accept_ra 0
        autuconf 0

iface eth0 inet6 static

accept_ra 0

autuconf 0

写iface eth0 inet6 manual是没有用的哦。

Drown in Codes

I was sixteen with an open heart…

分类目录归档：Information techonology

Nginx在反向代理连接失败时回退到本地文件的配置

Ubuntu 18.04安装GoodERP

Proxmox VE 5.4不停机修改主机名

Grafana使用Azure Active Directory的OAuth2登录

ifupdown禁用一个接口上的IPv6 RA