如何在Nginx四层配置中转发SSH/22端口流量？

要支持git clone git://my/repo这类基于SSH的Git操作，只需在现有Nginx配置的stream模块中新增22端口的转发规则即可，具体修改如下：

1. 新增SSH上游节点组 #

在stream块内添加指向Kubernetes工作节点22端口的上游组：

upstream ssh {
    server <ip1>:22;
    server <ip2>:22;
    server <ip3>:22;
}

2. 新增22端口转发规则 #

同样在stream块内添加监听本地22端口的server配置，将流量转发到上述上游组：

server {
    listen 22;
    proxy_pass ssh;
}

修改后的完整Nginx配置 #

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
  worker_connections 768;
}

stream {
    upstream http {
        server <ip1>:80;
        server <ip2>:80;
        server <ip3>:80;
    }
    upstream ssl {
        server <ip1>:443;
        server <ip2>:443;
        server <ip3>:443;
    }
    # 新增SSH上游节点组
    upstream ssh {
        server <ip1>:22;
        server <ip2>:22;
        server <ip3>:22;
    }
    server {
        listen 80;
        proxy_pass http;
    }
    server {
        listen 443;
        proxy_pass ssl;
    }
    # 新增22端口转发规则
    server {
        listen 22;
        proxy_pass ssh;
    }
}

http {
    sendfile on;
  tcp_nopush on;
  types_hash_max_size 2048;

  include /etc/nginx/mime.types;
  default_type application/octet-stream;

  ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
  ssl_prefer_server_ciphers on;

  access_log /var/log/nginx/access.log;
  error_log /var/log/nginx/error.log;

  gzip on;

  include /etc/nginx/conf.d/*.conf;
}

注意事项 #

• 确保Kubernetes集群的三个工作节点22端口已开放，且Gitea的SSH服务正确绑定到节点22端口（若通过NodePort暴露，需将上游配置改为对应NodePort端口）
• 修改配置后，先执行nginx -t验证语法正确性，再执行systemctl reload nginx使配置生效

内容的提问来源于stack exchange，提问作者user3142695