Nginx单服务器托管两个域名配置 解决Bookstack跳转Keycloak问题

故障根因 #

你当前的配置问题出在Bookstack的监听端口设置错误：

• 普通用户访问域名时默认使用HTTP 80端口、HTTPS 443端口，而你配置的Bookstack站点监听的是3480/5443非标准端口
• 80/443端口下仅配置了Keycloak的站点规则，当Nginx收到bookstack.domain.com的80/443端口请求时，找不到对应server_name的匹配规则，就会命中该端口下第一个加载的Keycloak配置，最终出现跳转异常。

Nginx原生支持单IP同端口下通过server_name区分不同站点，无需为不同站点设置不同监听端口。

修正后的完整配置 #

1. Keycloak配置 /etc/nginx/conf.d/keycloak.conf #

仅删除多余的转义符即可，其余逻辑不变：

upstream keycloak {
    # Use IP Hash for session persistence
    ip_hash;
    # List of Keycloak servers
    server 127.0.0.1:8080;
}

server {
    listen 80;
    server_name keycloak.domain.com;
    # Redirect all HTTP to HTTPS
    location / { 
        return 301 https://$server_name$request_uri;
    }
}

server {
    listen 443 ssl http2;
    server_name keycloak.domain.com;

    ssl_certificate /path/to/certificate.crt;
    ssl_certificate_key /path/to/certificate_key.key;
    ssl_session_cache shared:SSL:1m;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://keycloak;
    }
}

2. Bookstack配置 /etc/nginx/conf.d/bookstack.conf #

将监听端口修改为标准的80/443端口即可，其余业务规则保持不变：

server {
    listen 80;
    access_log  /var/log/nginx/bookstack_access.log;
    error_log   /var/log/nginx/bookstack_error.log;
    server_name bookstack.domain.com;
    root        /var/www/bookstack/public;
    # redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    ssl_certificate /path/to/certificate.crt;
    ssl_certificate_key /path/to/certificate_key.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AE;
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/nginx/dhparam.pem;

    server_name bookstack.domain.com;
    #HSTS
    add_header Strict-Transport-Security "max-age=63072000" always;

    root /var/www/bookstack/public;
    access_log  /var/log/nginx/bookstack_access.log;
    error_log  /var/log/nginx/bookstack_error.log;

    client_max_body_size 1G;
    fastcgi_buffers 64 4K;
    index  index.php;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README) {
        deny all;
    }

    location ~ \.php(?:$|/) {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_pass unix:/var/run/php-fpm.sock;
    }

    location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {
        expires 30d;
        access_log off;
    }
}

生效验证步骤 #

1. 执行nginx -t检查配置语法是否合法
2. 语法验证通过后执行systemctl reload nginx重载Nginx配置
3. 清理本地浏览器缓存（301为永久重定向，浏览器会长期缓存旧规则），再分别访问两个域名验证功能正常

内容的提问来源于stack exchange，提问作者Darktortue