使用Puppet/Nginx模块+Hiera配置Nginx时location指令异常

我之前在使用Vox Pupuli的puppet/nginx模块（0.9.0版本），配合Puppet 4.10.9、Hiera 3.3.2部署Nginx 1.12.2时，碰到了一个棘手的配置问题：配置泛域名的非SSL和SSL站点后，生成的SSL配置文件中location指令被放到了server块外部，直接导致Nginx无法启动。哪怕我简化配置去掉SSL和PHP相关指令，问题依然存在。

最初的错误配置 #

nginx::nginx_servers:
  'devops-alldomains':
    server_name:
      - '~^(?<fqdn>.+?)$'
    www_root: '/var/www/$fqdn'
    index_files:
      - 'index.php'
    try_files:
      - '$uri'
      - '$uri/'
      - '/index.php?$args'
    access_log: '/var/log/nginx/devops-alldomains-access.log'
    error_log: '/var/log/nginx/devops-alldomains-error.log'
  'devops-alldomains-ssl':
    server_name:
      - '~^(?<fqdn>.+?)$'
    listen_port: '443'
    www_root: '/var/www/$fqdn'
    ssl: true
    ssl_key: '/etc/ssl/www/$fqdn.key'
    ssl_cert: '/etc/ssl/www/$fqdn.crt'
    index_files:
      - 'index.php'
    try_files:
      - '$uri'
      - '$uri/'
      - '/index.php?$args'
    access_log: '/var/log/nginx/devops-alldomains-access-ssl.log'
    error_log: '/var/log/nginx/devops-alldomains-error-ssl.log'
nginx::nginx_locations:
  'devops-alldomains':
    location: '~ \.php$'
    www_root: '/var/www/$fqdn'
    server: 'devops-alldomains'
    fastcgi: 'unix:/var/run/php7-fpm.sock'
    fastcgi_split_path: '^(.+\.php)(/.*)$'
    fastcgi_index: 'index.php'
    fastcgi_param:
      'SCRIPT_FILENAME': '$document_root$fastcgi_script_name'
  'devops-alldomains-ssl':
    location: '~ \.php$'
    www_root: '/var/www/$fqdn'
    server: 'devops-alldomains-ssl'
    fastcgi: 'unix:/var/run/php7-fpm.sock'
    fastcgi_split_path: '^(.+\.php)(/.*)$'
    fastcgi_index: 'index.php'
    fastcgi_param:
      'SCRIPT_FILENAME': '$document_root$fastcgi_script_name'

修正后的正确配置 #

nginx::nginx_servers:
  'devops-alldomains':
    server_name:
      - '~^(?<fqdn>.+?)$'
    www_root: '/var/www/$fqdn'
    index_files:
      - 'index.php'
    try_files:
      - '$uri'
      - '$uri/'
      - '/index.php?$args'
    access_log: '/var/log/nginx/devops-alldomains-access.log'
    error_log: '/var/log/nginx/devops-alldomains-error.log'
  'devops-alldomains-ssl':
    server_name:
      - '~^(?<fqdn>.+?)$'
    listen_port: '443'
    ssl_port: '443'
    www_root: '/var/www/$fqdn'
    ssl: true
    ssl_key: '/etc/ssl/www/$fqdn.key'
    ssl_cert: '/etc/ssl/www/$fqdn.crt'
    index_files:
      - 'index.php'
    try_files:
      - '$uri'
      - '$uri/'
      - '/index.php?$args'
    access_log: '/var/log/nginx/devops-alldomains-access-ssl.log'
    error_log: '/var/log/nginx/devops-alldomains-error-ssl.log'
nginx::nginx_locations:
  'devops-alldomains-loc':
    location: '~ \.php$'
    www_root: '/var/www/$fqdn'
    server: 'devops-alldomains'
    fastcgi: 'unix:/var/run/php7-fpm.sock'
    fastcgi_split_path: '^(.+\.php)(/.*)$'
    fastcgi_index: 'index.php'
    fastcgi_param:
      'SCRIPT_FILENAME': '$document_root$fastcgi_script_name'
  'devops-alldomains-ssl-loc':
    location: '~ \.php$'
    www_root: '/var/www/$fqdn'
    server: 'devops-alldomains-ssl'
    ssl: true
    ssl_only: true
    fastcgi: 'unix:/var/run/php7-fpm.sock'
    fastcgi_split_path: '^(.+\.php)(/.*)$'
    fastcgi_index: 'index.php'
    fastcgi_param:
      'SCRIPT_FILENAME': '$document_root$fastcgi_script_name'

问题根源与修复要点 #

• SSL Location需添加关键标识参数：针对SSL站点的location条目，必须添加ssl: true和ssl_only: true，这样puppet/nginx模块才能正确识别该location属于SSL server块，将其嵌入到对应的server内部，而不是生成在外部。
• SSL Server需同时配置双端口参数：SSL server的配置中，除了设置listen_port: '443'，还必须添加ssl_port: '443'，确保模块能正确关联SSL相关的配置项，避免配置关联异常。
• Location名称修改为可选优化：我修改了location的命名（比如从devops-alldomains-ssl改为devops-alldomains-ssl-loc），这一步只是为了更清晰区分非SSL和SSL的location条目，对功能没有实质影响。

内容的提问来源于stack exchange，提问作者patok