为了方便做日志和限流，给RSSHub配个和好伙伴openresty(NGINX的一个支持lua的分支)写了一下反代的配置，只说一下自己写的功能吧：
- 请求头会说自己是SpringBoot应用，因为我最恶心的就是spring全家桶了。
- 请求会记录在rsshub代理等待了多久。
- rsshub查询错误的话直接返回状态码，响应体直接放空，省点流量。
- stat 给出一些简单的性能数据和热点IP
1http {
2
3 ##
4 # Basic Settings
5 ##
6
7 sendfile on;
8 tcp_nopush on;
9 tcp_nodelay on;
10 keepalive_timeout 65;
11 types_hash_max_size 2048;
12 server_tokens off;
13
14 # server_names_hash_bucket_size 64;
15 # server_name_in_redirect off;
16
17 include /etc/nginx/mime.types;
18 default_type application/octet-stream;
19
20 ##
21 # SSL Settings
22 ##
23
24 ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
25 ssl_prefer_server_ciphers on;
26
27 ##
28 # Logging Settings
29 ##
30
31 access_log off;
32 error_log /var/log/nginx/error.log;
33
34 ##
35 # Gzip Settings
36 ##
37
38 gzip on;
39
40 gzip_vary on;
41 # gzip_proxied any;
42 gzip_comp_level 6;
43 # gzip_buffers 16 8k;
44 gzip_http_version 1.1;
45 gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
46 gzip_min_length 1024;
47
48 ##
49 # Virtual Host Configs
50 ##
51
52 # include /etc/nginx/conf.d/*.conf;
53 # include /etc/nginx/sites-enabled/*;
54
55 lua_shared_dict rss_limit_req_store 10m;
56
57 init_by_lua_block {
58 package.path = "/etc/openresty/lua/?.lua;" .. package.path
59 }
60
61 upstream rsshub {
62 server 127.0.0.1:1222 max_fails=3 fail_timeout=30s;
63 keepalive 8;
64 }
65
66 server {
67 listen 1200;
68 listen [::]:1200;
69 server_name "";
70
71 access_by_lua_block {
72 local rtime = require "rtime"
73 rtime.start()
74 }
75
76 header_filter_by_lua_block {
77 ngx.header["Server"] = "spring-boot"
78
79 local rtime = require "rtime"
80 local process_time = rtime.get_duration_ms()
81 ngx.header["x-wait-for"] = process_time
82 }
83
84 log_by_lua_block {
85 local log_path = "/var/log/nginx/access.log"
86
87 local now = os.date("%Y-%m-%d %H:%M:%S")
88 local method = ngx.var.request_method or "-"
89 local uri = ngx.var.request_uri or "-"
90 local rt_ms = tonumber(ngx.var.request_time) * 1000
91 if not rt_ms then rt_ms = 0 end
92
93 local srcip = ngx.var.remote_addr or "-"
94 local dstip = ngx.var.server_addr or "-"
95 local bytes = tonumber(ngx.var.body_bytes_sent) or 0
96
97 -- 获取 User-Agent
98 local ua = ngx.var.http_user_agent or "-"
99
100 -- 构造日志
101 local log_lines = {
102 string.format("%s [%s] %s %.1fms", now, method, uri, rt_ms),
103 string.format("[%s] <=> [%s] Byte: %d", srcip, dstip, bytes),
104 ua,
105 "" -- 空行分隔
106 }
107
108 -- 安全写入
109 local fp, err = io.open(log_path, "a")
110 if not fp then
111 ngx.log(ngx.ERR, "Failed to open log file: ", err)
112 return
113 end
114
115 for _, line in ipairs(log_lines) do
116 local ok, err = fp:write(line, "\n")
117 if not ok then
118 ngx.log(ngx.ERR, "Failed to write log line: ", err)
119 break
120 end
121 end
122 fp:close()
123 }
124
125 location = /stat {
126 stub_status;
127 access_log off;
128
129 access_by_lua_block {
130 local addr = ngx.var.remote_addr
131
132 if not addr:match("^10%.126%.126%.%d+$") then
133 ngx.log(ngx.ERR, "IP not allowed: ", addr, " for /stat, redirect to @fallback")
134 ngx.exit(503)
135 end
136 }
137
138 error_page 503 = @fallback;
139 }
140
141 location ~ /(telegram|twitter)/ {
142 access_by_lua_block {
143 ngx.exit(503)
144 }
145
146 error_page 503 = @fallback_gfw;
147 }
148
149 location / {
150
151 access_by_lua_block {
152 local rtime = require "rtime"
153 rtime.start()
154
155 local limit_req = require "resty.limit.req"
156 local lim, err = limit_req.new("rss_limit_req_store", 10, 20)
157 if not lim then
158 ngx.log(ngx.ERR, "failed to instantiate a resty.limit.req object: ", err)
159 ngx.exit(500)
160 end
161
162 local key = ngx.var.binary_remote_addr
163 local delay, err = lim:incoming(key, true)
164
165 if not delay then
166 if err == "rejected" then
167 ngx.log(ngx.WARN, "rate limited, key: ", key)
168 ngx.exit(429)
169 end
170 ngx.log(ngx.ERR, "failed to limit req: ", err)
171 ngx.exit(500)
172 end
173
174 if delay > 0 then
175 ngx.sleep(delay)
176 end
177 }
178
179 proxy_pass http://rsshub;
180 # 代理统一用HTTP1.1
181 proxy_http_version 1.1;
182
183 # 传递真实客户端信息
184 proxy_set_header Host $host;
185 proxy_set_header X-Real-IP $remote_addr;
186 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
187 proxy_set_header X-Forwarded-Proto $scheme;
188 # proxy_set_header X-Forwarded-Host $host;
189 proxy_set_header X-Forwarded-Port $server_port;
190
191 # 支持 WebSocket
192 proxy_set_header Upgrade $http_upgrade;
193 proxy_set_header Connection "upgrade";
194
195 # 超时设置
196 proxy_connect_timeout 60s;
197 proxy_send_timeout 60s;
198 proxy_read_timeout 60s;
199
200 # 错误处理
201 proxy_next_upstream error timeout;
202 proxy_intercept_errors on;
203 error_page 503 = @fallback;
204 }
205
206 location ~* \.(jpg|jpeg|gif|ico|css|js|woff|woff2|ttf|svg|eot)$ {
207 expires 1d;
208 add_header Cache-Control "public, immutable";
209
210 # 仍代理到后端（如果你的服务自己处理静态资源）
211 proxy_pass http://rsshub;
212 proxy_set_header Host $host;
213 proxy_set_header X-Real-IP $remote_addr;
214 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
215 proxy_set_header X-Forwarded-Proto $scheme;
216
217 proxy_http_version 1.1;
218 proxy_pass_request_headers on;
219 }
220
221 location ~* \.(png)$ {
222 empty_gif;
223 }
224
225 location @fallback {
226 internal;
227 content_by_lua_block {
228 ngx.status = 503
229 ngx.print()
230 ngx.exit(ngx.status)
231 }
232 }
233
234 location @fallback_gfw {
235 internal;
236 content_by_lua_block {
237 ngx.status = 503
238 ngx.header["Content-Type"] = "text/plain"
239 ngx.print("we cannot access GFW site.")
240 ngx.exit(ngx.status)
241 }
242 }
243 }
244
245}
1-- ip_cidr.lua
2
3local _M = {}
4
5local bit = require "bit"
6
7local internal_ipset = {
8 "10.0.0.0/8",
9 "172.16.0.0/12",
10 "192.168.0.0/16"
11}
12
13local function ip_to_num(ip)
14 -- 将 IPv4 字符串（如 "192.168.1.1"）转换为 32 位整数
15 local parts = {}
16 for part in ip:gmatch("%d+") do -- 提取所有数字部分（如 "192", "168"）
17 table.insert(parts, tonumber(part))
18 end
19
20 if #parts ~= 4 then
21 return nil, "invalid IPv4 address: 不是有效的 IPv4 格式"
22 end
23
24 for _, p in ipairs(parts) do
25 if p < 0 or p > 255 then
26 return nil, "invalid IPv4 address: 八位组超出 0-255 范围"
27 end
28 end
29
30 -- 计算 32 位整数（大端序）
31 -- 傻瓜也能听懂的讲解：也算是帮我复习了
32 -- IP地址每个位最大255 也就是 FF = 1111 1111
33 -- 192.168.1.1 经过上面转成parts就是 [192, 168, 1 ,1]
34 -- 现在你要把这些数字转成一个整数，当然你可以直接乘10的倍数变成19216811
35 -- 但是这样子网掩码计算就比较复杂，并且乘法在计算机底层上算不上很高效率的指令
36 -- 所以这里用左移，上面说了每个位最大255也就是8个1
37 -- 那么最前面的192是从右数第4位那就移动 8 * 4 = 24
38 -- 以此类推，最后这个32位二进制数，8位的16进制数就是ip地址
39 local part1 = bit.lshift(parts[1], 24) -- 左移 24 位
40 local part2 = bit.lshift(parts[2], 16) -- 左移 16 位
41 local part3 = bit.lshift(parts[3], 8) -- 左移 8 位
42 local part4 = parts[4] -- 无需移位
43 return bit.bor(part1, part2, part3, part4), nil -- 按位或合并
44end
45
46function _M.match(target_ip, cidr)
47
48 if target_ip == nil or type(target_ip) ~= "string" or target_ip == "" then
49 return false, nil
50 end
51
52 local cidr_ip_str, prefix_str = cidr:match("^([^/]+)/(%d+)$")
53 if not cidr_ip_str or not prefix_str then
54 return false, "invalid CIDR format: 错误 = " .. cidr
55 end
56
57 local prefix = tonumber(prefix_str)
58 if prefix < 0 or prefix > 32 then
59 return false, "invalid prefix: 前缀长度需为 0-32 的整数"
60 end
61
62 -- 步骤 2：将 CIDR 中的 IP 转换为整数
63 local cidr_ip_num, err = ip_to_num(cidr_ip_str)
64 if not cidr_ip_num then
65 return false, "CIDR IP error: " .. err
66 end
67
68 -- 生成掩码位
69 -- 傻瓜也能听懂的讲解：
70 -- 打个比方，最常用的24，32 - 24 = 8
71 -- 0xFFFFFFFF << 8 = 0xFFFFFFF00
72 -- 然后去掉高位，转回32位(这个是16进制，1位当4位算)
73 -- 0xFFFFFF00 按照子网掩码转成可读的方式
74 -- FF FF FF 00 = 255 255 255 0
75 -- 如果这还听不懂，那只能是根本不知道进制之间的转换是怎么算的
76
77 local mask = 0
78
79 if prefix ~= 0 then
80 mask = bit.lshift(0xFFFFFFFF, 32 - prefix)
81 mask = bit.band(mask, 0xFFFFFFFF)
82 end
83
84 -- 网段
85 local cidr_network = bit.band(cidr_ip_num, mask)
86
87 local target_ip_num, err = ip_to_num(target_ip)
88
89 if not target_ip_num then
90 return false, "Target IP error: " .. err
91 end
92
93 local target_ip_cidr = bit.band(target_ip_num, mask)
94
95 print(target_ip_cidr)
96 print(cidr_network)
97 print(mask)
98
99 return target_ip_cidr == cidr_network, nil
100end
101
102function _M.is_internal(target_ip)
103
104 for _, t in ipairs(internal_ipset) do
105 local ok, err = _M.match(target_ip, t)
106 if ok and err == nil then return ok, err end
107 end
108
109 return false, nil
110end
111
112return _M
1-- ngx_log.lua
2local _M = {}
3
4local cjson = require "cjson"
5
6function _M.req_info()
7 local log_path = "/var/log/nginx/access.log"
8
9 local now = os.date("%Y-%m-%d %H:%M:%S")
10 local method = ngx.var.request_method or "-"
11 local uri = ngx.var.request_uri or "-"
12 local rt_ms = tonumber(ngx.var.request_time) * 1000
13 if not rt_ms then rt_ms = 0 end
14
15 local srcip = ngx.var.remote_addr or "-"
16 local dstip = ngx.var.server_addr or "-"
17 local bytes = tonumber(ngx.var.body_bytes_sent) or 0
18
19 -- 获取 User-Agent
20 local ua = ngx.var.http_user_agent or "-"
21
22 -- 构造日志
23 local log_lines = {
24 string.format("%s [%s] %s %.1fms", now, method, uri, rt_ms),
25 string.format("[%s] <=> [%s] Byte: %d", srcip, dstip, bytes),
26 ua,
27 "" -- 空行分隔
28 }
29
30 -- 安全写入
31 local fp, err = io.open(log_path, "a")
32 if not fp then
33 ngx.log(ngx.ERR, "Failed to open log file: ", err)
34 return
35 end
36
37 local ok, err = pcall(function()
38 for _, line in ipairs(log_lines) do
39 local ok, err = fp:write(line, "\n")
40 if not ok then
41 ngx.log(ngx.ERR, "Failed to write log line: ", err)
42 break
43 end
44 end
45 end)
46
47 fp:close()
48 if not ok then ngx.log(ngx.ERR, "Logging error: ", err) end
49end
50
51return _M
1-- ngx_log.lua
2
3local _M = {}
4
5function _M.start()
6 ngx.ctx.start_time = ngx.now()
7end
8
9function _M.get_duration_ms()
10 local start = ngx.ctx.start_time
11 if not start then return 0 end
12 return string.format("%.1fms", (ngx.now() - start) * 1000)
13end
14
15return _M