Apache 反向代理配置

Apache Reverse Proxy Configuration

概述 (Overview)

反向代理是现代Web架构中的关键组件，能够提供负载均衡、SSL终止、缓存和安全防护等功能。本文将详细介绍Apache反向代理的高级配置技术，包括与各种后端服务的集成、性能优化和故障排除。

Reverse proxy is a key component in modern web architectures, providing load balancing, SSL termination, caching, and security protection. This article will detail advanced configuration techniques for Apache reverse proxy, including integration with various backend services, performance optimization, and troubleshooting.

1. 反向代理基础配置 (Reverse Proxy Basic Configuration)

1.1 基本反向代理设置 (Basic Reverse Proxy Setup)

# 禁用正向代理（安全考虑）
ProxyRequests Off

# 启用必要的代理模块
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so

# 基本反向代理配置
<VirtualHost *:80>
    ServerName www.example.com

    # 保持原始主机头
    ProxyPreserveHost On

    # 反向代理配置
    ProxyPass / http://backend-server:8080/
    ProxyPassReverse / http://backend-server:8080/
</VirtualHost>

1.2 多后端服务配置 (Multiple Backend Services Configuration)

<VirtualHost *:80>
    ServerName www.example.com

    ProxyRequests Off
    ProxyPreserveHost On

    # API服务
    ProxyPass /api/ http://api-server:3000/
    ProxyPassReverse /api/ http://api-server:3000/

    # 管理后台
    ProxyPass /admin/ http://admin-server:9000/
    ProxyPassReverse /admin/ http://admin-server:9000/

    # 静态文件服务
    ProxyPass /static/ http://static-server:8000/
    ProxyPassReverse /static/ http://static-server:8000/

    # 默认后端
    ProxyPass / http://web-server:8080/
    ProxyPassReverse / http://web-server:8080/
</VirtualHost>

2. 与不同后端服务集成 (Integration with Different Backend Services)

2.1 与Tomcat集成 (Integration with Tomcat)

# 启用AJP模块
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so

<VirtualHost *:80>
    ServerName app.example.com

    ProxyRequests Off
    ProxyPreserveHost On

    # 使用AJP协议连接Tomcat
    ProxyPass / ajp://tomcat-server:8009/
    ProxyPassReverse / ajp://tomcat-server:8009/

    # 或者使用HTTP连接
    # ProxyPass / http://tomcat-server:8080/
    # ProxyPassReverse / http://tomcat-server:8080/
</VirtualHost>

2.2 与Node.js集成 (Integration with Node.js)

<VirtualHost *:80>
    ServerName nodeapp.example.com

    ProxyRequests Off
    ProxyPreserveHost On

    # 连接Node.js应用
    ProxyPass / http://localhost:3000/
    ProxyPassReverse / http://localhost:3000/

    # WebSocket支持
    ProxyPass /socket.io/ ws://localhost:3000/socket.io/
</VirtualHost>

2.3 与Python应用集成 (Integration with Python Applications)

<VirtualHost *:80>
    ServerName pythonapp.example.com

    ProxyRequests Off
    ProxyPreserveHost On

    # 连接Python WSGI应用
    ProxyPass / http://localhost:8000/
    ProxyPassReverse / http://localhost:8000/

    # 或者连接Gunicorn
    # ProxyPass / http://localhost:8001/
    # ProxyPassReverse / http://localhost:8001/
</VirtualHost>

3. SSL终止和HTTPS反向代理 (SSL Termination and HTTPS Reverse Proxy)

3.1 SSL终止配置 (SSL Termination Configuration)

<VirtualHost *:443>
    ServerName www.example.com

    # SSL配置
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/example.com.crt
    SSLCertificateKeyFile /etc/ssl/private/example.com.key

    # 反向代理配置
    ProxyRequests Off
    ProxyPreserveHost On

    # 后端使用HTTP（SSL终止）
    ProxyPass / http://backend-server:8080/
    ProxyPassReverse / http://backend-server:8080/

    # 设置后端协议头
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"
</VirtualHost>

3.2 HTTPS到HTTPS代理 (HTTPS to HTTPS Proxy)

<VirtualHost *:443>
    ServerName secure.example.com

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/example.com.crt
    SSLCertificateKeyFile /etc/ssl/private/example.com.key

    ProxyRequests Off
    ProxyPreserveHost On

    # 后端也使用HTTPS
    SSLProxyEngine on
    ProxyPass / https://secure-backend:8443/
    ProxyPassReverse / https://secure-backend:8443/

    # SSL代理设置
    SSLProxyVerify none
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
</VirtualHost>

4. 高级反向代理功能 (Advanced Reverse Proxy Features)

4.1 路径重写和映射 (Path Rewriting and Mapping)

<VirtualHost *:80>
    ServerName www.example.com

    ProxyRequests Off
    ProxyPreserveHost On

    # 路径映射
    ProxyPass /app/ http://backend-server:8080/application/
    ProxyPassReverse /app/ http://backend-server:8080/application/

    # 多个路径映射
    ProxyPass /api/v1/ http://api-v1:8000/
    ProxyPassReverse /api/v1/ http://api-v1:8000/

    ProxyPass /api/v2/ http://api-v2:8001/
    ProxyPassReverse /api/v2/ http://api-v2:8001/
</VirtualHost>

4.2 条件代理 (Conditional Proxying)

<VirtualHost *:80>
    ServerName www.example.com

    ProxyRequests Off

    # 基于用户代理的条件代理
    <If "%{HTTP_USER_AGENT} =~ /Mobile/">
        ProxyPass / http://mobile-backend:8080/
        ProxyPassReverse / http://mobile-backend:8080/
    </If>

    <Else>
        ProxyPass / http://web-backend:8080/
        ProxyPassReverse / http://web-backend:8080/
    </Else>

    # 基于请求头的条件代理
    <If "%{HTTP:X-API-VERSION} == 2">
        ProxyPass /api/ http://api-v2:8000/
        ProxyPassReverse /api/ http://api-v2:8000/
    </If>
</VirtualHost>

5. WebSocket支持 (WebSocket Support)

5.1 WebSocket代理配置 (WebSocket Proxy Configuration)

# 启用必要模块
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so

<VirtualHost *:80>
    ServerName ws.example.com

    ProxyRequests Off
    ProxyPreserveHost On

    # HTTP请求
    ProxyPass / http://backend:8080/
    ProxyPassReverse / http://backend:8080/

    # WebSocket请求
    ProxyPass /ws/ ws://backend:8080/ws/
    ProxyPassReverse /ws/ ws://backend:8080/ws/

    # Socket.IO支持
    ProxyPass /socket.io/ ws://backend:8080/socket.io/
    ProxyPassReverse /socket.io/ ws://backend:8080/socket.io/
</VirtualHost>

5.2 安全WebSocket配置 (Secure WebSocket Configuration)

<VirtualHost *:443>
    ServerName wss.example.com

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/example.com.crt
    SSLCertificateKeyFile /etc/ssl/private/example.com.key

    ProxyRequests Off
    ProxyPreserveHost On

    # HTTPS请求
    ProxyPass / https://backend:8443/
    ProxyPassReverse / https://backend:8443/

    # WSS请求
    SSLProxyEngine on
    ProxyPass /wss/ wss://backend:8443/wss/
    ProxyPassReverse /wss/ wss://backend:8443/wss/
</VirtualHost>

6. 负载均衡集成 (Load Balancing Integration)

6.1 基本负载均衡器 (Basic Load Balancer)

# 启用负载均衡模块
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so

<Proxy "balancer://webcluster">
    BalancerMember http://web1:8080
    BalancerMember http://web2:8080
    BalancerMember http://web3:8080

    ProxySet lbmethod=byrequests
    ProxySet stickysession=JSESSIONID|jsessionid
</Proxy>

<VirtualHost *:80>
    ServerName www.example.com

    ProxyRequests Off
    ProxyPreserveHost On

    ProxyPass / balancer://webcluster/
    ProxyPassReverse / balancer://webcluster/
</VirtualHost>

6.2 高级负载均衡配置 (Advanced Load Balancing Configuration)

<Proxy "balancer://advancedcluster">
    # 带权重和路由的后端
    BalancerMember http://web1:8080 route=web1 loadfactor=3
    BalancerMember http://web2:8080 route=web2 loadfactor=2
    BalancerMember http://web3:8080 route=web3 loadfactor=1

    # 负载均衡方法
    ProxySet lbmethod=bytraffic

    # 会话粘性
    ProxySet stickysession=JSESSIONID|jsessionid

    # 健康检查
    ProxySet retry=60
    ProxySet timeout=30

    # 故障转移
    ProxySet failonstatus=503
</Proxy>

<VirtualHost *:80>
    ServerName www.example.com

    ProxyRequests Off
    ProxyPreserveHost On

    ProxyPass / balancer://advancedcluster/
    ProxyPassReverse / balancer://advancedcluster/

    # 负载均衡管理界面
    <Location "/balancer-manager">
        SetHandler balancer-manager
        Require ip 192.168.1.0/24
    </Location>
</VirtualHost>

7. 性能优化 (Performance Optimization)

7.1 连接池优化 (Connection Pool Optimization)

<VirtualHost *:80>
    ServerName www.example.com

    ProxyRequests Off
    ProxyPreserveHost On

    # 连接池设置
    ProxyPass / http://backend:8080/ retry=0
    ProxyPassReverse / http://backend:8080/

    # 优化参数
    ProxySet disablereuse=Off
    ProxySet keepalive=On
    ProxySet lbmethod=bytraffic

    # 超时设置
    ProxyTimeout 300
    ProxyPassReverseCookies On
</VirtualHost>

7.2 缓存集成 (Cache Integration)

# 启用缓存模块
LoadModule cache_module modules/mod_cache.so
LoadModule cache_disk_module modules/mod_cache_disk.so

<VirtualHost *:80>
    ServerName www.example.com

    ProxyRequests Off

    # 缓存设置
    CacheRoot /var/cache/apache2/proxy
    CacheEnable disk /
    CacheDefaultExpire 3600

    ProxyPass / http://backend:8080/
    ProxyPassReverse / http://backend:8080/

    # 静态文件缓存
    <Location "/static/">
        CacheQuickHandler on
        CacheHeader on
    </Location>

    # 动态内容不缓存
    <Location "/api/">
        CacheDisable on
    </Location>
</VirtualHost>

8. 监控和故障排除 (Monitoring and Troubleshooting)

8.1 详细日志配置 (Detailed Log Configuration)

# 自定义日志格式
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %V %p %R %X" proxy_detailed

<VirtualHost *:80>
    ServerName www.example.com

    ProxyRequests Off

    ProxyPass / http://backend:8080/
    ProxyPassReverse / http://backend:8080/

    # 详细代理日志
    CustomLog /var/log/apache2/proxy_detailed.log proxy_detailed
    ErrorLog /var/log/apache2/proxy_error.log

    # 调试日志
    LogLevel debug
</VirtualHost>

8.2 健康检查脚本 (Health Check Script)

#!/bin/bash
# reverse-proxy-health.sh

check_health() {
    local backend_servers=("http://web1:8080" "http://web2:8080" "http://web3:8080")

    echo "=== Reverse Proxy Health Check ==="

    # 检查后端服务器状态
    for server in "${backend_servers[@]}"; do
        response=$(curl -s -o /dev/null -w "%{http_code}" "$server/health" 2>/dev/null)
        if [ "$response" = "200" ]; then
            echo "✓ $server is healthy"
        else
            echo "✗ $server is unhealthy (HTTP $response)"
        fi
    done

    # 检查负载均衡器状态
    echo
    echo "Load Balancer Status:"
    curl -s http://localhost/balancer-manager | grep -E "(Balancer|Member)" | head -10

    echo
    echo "Health check completed!"
}

check_health

小结 (Summary)

通过本文学习，你应该掌握：

Apache反向代理的基础配置和多后端服务集成
与Tomcat、Node.js、Python等不同后端服务的连接方法
SSL终止和HTTPS反向代理配置
路径重写、条件代理和WebSocket支持
负载均衡器的配置和管理
性能优化技术，包括连接池和缓存集成
监控和故障排除方法

反向代理是构建可扩展、高可用Web应用架构的关键技术。在下一篇文章中，我们将详细介绍Apache负载均衡配置技术。

反向代理配置