请求配置支持HTTP/HTTPS的Nginx SSL穿透反向代理（保留80端口HTTP）

你的核心问题是HTTP流量无法正确转发到上游服务器，原因是当前http块仅配置了HTTPS重定向，没有针对HTTP流量的代理规则，同时缺少对应80端口的上游服务器定义。另外你的stream块配置存在语法错误，需要先修正。

第一步：修正Stream块的语法错误 #

site3_backend中的两行server配置末尾缺少分号，会导致Nginx启动失败，先补上：

upstream site3_backend {
    server 3.1.1.1:443;
    server 3.1.1.2:443;
}

第二步：添加HTTP流量的上游与代理配置 #

需要为HTTP流量单独定义80端口的上游服务器，并在http块中配置域名匹配规则，将80端口的请求转发到对应上游：

完整修改后的配置示例 #

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

stream {
    map $ssl_preread_server_name $name {
        site1.com site1_backend_ssl;
        site2.com site2_backend_ssl;
        site3.com site3_backend_ssl;
    }

    # HTTPS流量的上游（443端口）
    upstream site1_backend_ssl {
        server 1.1.1.1:443;
        server 1.1.1.2:443;
    }

    upstream site2_backend_ssl {
        server 2.1.1.1:443;
    }

    upstream site3_backend_ssl {
        server 3.1.1.1:443;
        server 3.1.1.2:443;
    }

    server {
        listen 443;
        proxy_pass $name;
        ssl_preread on;
    }
}

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main   '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  90;

    # 定义HTTP流量的上游（80端口）
    upstream site1_backend_http {
        server 1.1.1.1:80;
        server 1.1.1.2:80;
    }

    upstream site2_backend_http {
        server 2.1.1.1:80;
    }

    upstream site3_backend_http {
        server 3.1.1.1:80;
        server 3.1.1.2:80;
    }

    # 为每个域名配置HTTP代理
    server {
        listen 80;
        server_name site1.com;
        proxy_pass http://site1_backend_http;
        # 传递必要的请求头，保证上游服务器获取原始请求信息
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    server {
        listen 80;
        server_name site2.com;
        proxy_pass http://site2_backend_http;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    server {
        listen 80;
        server_name site3.com;
        proxy_pass http://site3_backend_http;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # 处理未匹配的域名请求
    server {
        listen 80 default_server;
        server_name _;
        return 404;
    }
}

简化配置可选方案 #

如果觉得逐个配置server块繁琐，可以用map简化HTTP流量的匹配逻辑：

http {
    # ... 保留原有http块基础配置 ...

    map $host $http_upstream {
        site1.com site1_backend_http;
        site2.com site2_backend_http;
        site3.com site3_backend_http;
    }

    server {
        listen 80;
        server_name _;
        proxy_pass http://$http_upstream;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        # 拦截未匹配的域名请求
        if ($http_upstream = "") {
            return 404;
        }
    }
}

配置验证 #

修改完成后，执行以下命令检查配置语法并重启Nginx：

nginx -t
systemctl restart nginx

内容的提问来源于stack exchange，提问作者Luiz Pasqualetto