如何用Nginx配置OpenStack Swift代理？能否绕过REST接口传大文件？

Absolutely, this approach is totally feasible—and it’s actually a go-to pattern for optimizing large file uploads to OpenStack Swift when you want to skip some of the REST API overhead. Let me walk you through how to make this work with Nginx, plus critical things to keep in mind.

Short answer: Yes. By configuring Nginx as a reverse proxy that forwards upload requests directly to Swift storage nodes, you can avoid the full Swift proxy REST API stack (which adds minor latency for large transfers) while still leveraging Swift’s underlying storage capabilities.

Here’s a sample Nginx config tailored for this use case—adjust values to match your cluster’s setup:

server {
    listen 8080;
    server_name swift-direct-upload;

    # Tune for large files - set max size to your typical upload limit
    client_max_body_size 10G;
    client_body_buffer_size 128k;
    client_body_timeout 300s; # Longer timeout for big transfers

    location / {
        # Replace with your Swift storage node's internal IP and port (usually 6000 for object storage)
        proxy_pass http://your-swift-storage-node-ip:6000;
        
        # Pass required Swift authentication headers (clients need valid Keystone tokens)
        proxy_set_header X-Storage-User $http_x_storage_user;
        proxy_set_header X-Storage-Token $http_x_storage_token;
        proxy_set_header X-Container-Name $http_x_container_name;
        proxy_set_header X-Object-Name $http_x_object_name;
        
        # Disable buffering to stream large files directly to storage
        proxy_buffering off;
        proxy_request_buffering off;
        
        # Timeout settings for stable large transfers
        proxy_connect_timeout 30s;
        proxy_send_timeout 300s;
        proxy_read_timeout 300s;
    }
}

• Authentication Can’t Be Skipped: Swift still needs to validate user permissions. You have two options:
  • Have clients fetch a valid token from Keystone first, then pass X-Storage-Token and X-Storage-User headers with their upload request.
  • Use Nginx modules like lua-nginx-module to integrate Keystone auth checks directly in Nginx, so clients don’t handle tokens themselves.
• Storage Node Redundancy: Hardcoding a single storage node creates a single point of failure. Use Nginx’s upstream block to list multiple storage nodes for load balancing:

  upstream swift-storage-nodes {
      server storage-node-1:6000;
      server storage-node-2:6000;
      server storage-node-3:6000;
  }
  

  Then replace proxy_pass with http://swift-storage-nodes;.
• Large File Best Practices: For files larger than 5GB, use Swift’s Static Large Object (SLO) or Dynamic Large Object (DLO) patterns. Nginx can still proxy these segmented uploads—just ensure each segment request is forwarded correctly to storage nodes.
• Network & Firewall Access: Make sure Nginx’s server has unrestricted access to Swift storage nodes’ internal ports (typically 6000, 6001, 6002). Adjust storage node firewalls to allow traffic from your Nginx server.
• Logging & Monitoring: Add detailed logging to Nginx to track upload success/failure, file sizes, and latency. Monitor storage node disk IO and network bandwidth to catch bottlenecks early.

Swift itself supports direct uploads to storage nodes via its internal API—Nginx just simplifies client access by hiding storage node IPs from end-users. The core logic of authenticating and targeting the right storage path remains consistent.

内容的提问来源于stack exchange，提问作者Santhosh