二进制方式部署minio,并使用nginx代理访问minio的配置--重点推荐

一、下载二进制文件并进行有关配置

# mkdir -p /data/minio/{bin,config,data,logs}
# useradd -s /sbin/nologin -d /var/lib/minio minio
# cd /data/minio/bin
# wget https://dl.min.io/server/minio/release/linux-amd64/minio
# chmod +x minio
# vim /data/minio/config/minio.conf

MINIO_VOLUMES="/data/minio/data"
MINIO_OPTS="--address ':9000' --console-address ':9001' --config-dir /data/minio/config/"
MINIO_ROOT_USER=minio
MINIO_ROOT_PASSWORD=xxxxxxxx
MINIO_REGION_NAME=zh-east-1
MINIO_REGION_COMMENT=中国华北一区
MINIO_LOG_LEVEL=INFO
MINIO_LOG_DIR=/data/minio/logs
MINIO_BROWSER_REDIRECT_URL=https://www.xxx.com/minio/ui  # 注意：找个配置跟使用nginx进行代理使用的方法有关,这里采用的是方法1

# vim /usr/lib/systemd/system/minio.service

[Unit]
Description=MinIO
Documentation=https://docs.min.io
Wants=network-online.target
After=network-online.target
AssertFileIsExecutable=/data/minio/bin/minio

[Service]
User=minio
Group=minio
ProtectProc=invisible
EnvironmentFile=-/data/minio/config/minio.conf
ExecStartPre=/bin/bash -c "if [ -z \"${MINIO_VOLUMES}\" ]; then echo \"Variable MINIO_VOLUMES not set in /etc/default/minio\"; exit 1; fi"
ExecStart=/data/minio/bin/minio server $MINIO_OPTS $MINIO_VOLUMES
Restart=always
LimitNOFILE=65536
TasksMax=infinity
TimeoutStopSec=infinity
SendSIGKILL=no

[Install]
WantedBy=multi-user.target

# chown -R minio:minio /data/minio/

# 重新加载、生效minio.service文件
# systemctl daemon-reload

# 启动、关闭、查看进程状态、开机启动
# systemctl start minio
# systemctl stop minio 
# systemctl status minio
# systemctl enable minio.service

对于日志配置，MinIO支持通过环境变量来设置日志级别和日志文件的位置。以下是一些与日志相关的环境变量：
    MINIO_LOG_LEVEL：设置日志级别，例如DEBUG、INFO、ERROR等。
    MINIO_LOG_DIR：设置日志文件的存储目录。
    MINIO_LOG_FILE：设置日志文件的名称。

二、使用nginx进行代理访问

官方文档地址：https://www.minio.org.cn/docs/minio/linux/integrations/setup-nginx-proxy-with-minio.html

1、方法1

# 官方文档中使用一个网址，是：minio.example.net
# 将 MINIO_BROWSER_REDIRECT_URL 设置为 MinIO 控制台的代理主机 FQDN ( https://example.net/minio/ui )

# 将请求代理到 https://minio.example.net 的根目录到监听在 https://minio.local:9000 的 MinIO 服务器。
# 将请求代理到 https://minio.example.net/minio/ui 子路径到监听在 https://minio.local:9001 的 MinIO 控制台。

# 注意：实际使用的时候 proxy_pass 地址使用http不是https

upstream minio_s3 {
   least_conn;
   server minio-01.internal-domain.com:9000;
   server minio-02.internal-domain.com:9000;
   server minio-03.internal-domain.com:9000;
   server minio-04.internal-domain.com:9000;
}

upstream minio_console {
   least_conn;
   server minio-01.internal-domain.com:9001;
   server minio-02.internal-domain.com:9001;
   server minio-03.internal-domain.com:9001;
   server minio-04.internal-domain.com:9001;
}

server {
   listen       80;
   listen  [::]:80;
   server_name  minio.example.net;

   # Allow special characters in headers
   ignore_invalid_headers off;
   # Allow any size file to be uploaded.
   # Set to a value such as 1000m; to restrict file size to a specific value
   client_max_body_size 0;
   # Disable buffering
   proxy_buffering off;
   proxy_request_buffering off;

   location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_connect_timeout 300;
      # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      chunked_transfer_encoding off;

      proxy_pass https://minio_s3; # This uses the upstream directive definition to load balance
   }

   location /minio/ui/ {
      rewrite ^/minio/ui/(.*) /$1 break;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-NginX-Proxy true;

      # This is necessary to pass the correct IP to be hashed
      real_ip_header X-Real-IP;

      proxy_connect_timeout 300;

      # To support websockets in MinIO versions released after January 2023
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      # Some environments may encounter CORS errors (Kubernetes + Nginx Ingress)
      # Uncomment the following line to set the Origin request to an empty string
      # proxy_set_header Origin '';

      chunked_transfer_encoding off;

      proxy_pass https://minio_console; # This uses the upstream directive definition to load balance
   }
}

实际使用的 => 使用一个网址 https://www.xxx.com

upstream minio_s3 {
    least_conn;
    server 127.0.0.1:9000;
}

upstream minio_console {
    least_conn;
    server 127.0.0.1:9001;
}


server {
    listen 80;
    server_name  www.xxx.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen       443 ssl;
    server_name  www.xxx.com;

    waf on;
    waf_rule_path /etc/nginx/ngx_waf/assets/rules/;
    waf_mode FULL;
    waf_cc_deny rate=1000r/m duration=60m;
    waf_cache capacity=50;

    ssl_certificate "/etc/nginx/cert/*.pem";
    ssl_certificate_key "/etc/nginx/cert/*.key";
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  10m;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_protocols TLSv1.2 TLSv1.3;
     
    ignore_invalid_headers off;
    client_max_body_size 0;
    proxy_buffering off;
    proxy_request_buffering off;

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 300;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        chunked_transfer_encoding off;
        proxy_pass http://minio_s3; 
    }

    location /minio/ui/ {
        rewrite ^/minio/ui/(.*) /$1 break;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-NginX-Proxy true;
        real_ip_header X-Real-IP;
        proxy_connect_timeout 300;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        chunked_transfer_encoding off;
        proxy_pass http://minio_console; 
    }
    
    access_log  /var/log/nginx/minio.access.log  main;
    access_log  /var/log/nginx/minio_access.yml  yaml   if=$waf_log;
    access_log  /var/log/nginx/minio_waf.yml     yaml   if=$waf_blocking_log;
}

访问地址：https://www.xxx.com/minio/ui

2、方法2

# 官方文档中使用两个网址，分别是：minio.example.net和console.example.net
# 将 MINIO_BROWSER_REDIRECT_URL 设置为 MinIO 控制台的代理主机 FQDN（ https://console.example.net/ ）
# 将代理请求转发到子域 minio.example.net ，该子域指向在 https://minio.local:9000 上监听的MinIO服务器。
# 将请求代理到子域 console.example.net ，该子域指向在 https://minio.local:9001 上监听的MinIO控制台。

upstream minio_s3 {
   least_conn;
   server minio-01.internal-domain.com:9000;
   server minio-02.internal-domain.com:9000;
   server minio-03.internal-domain.com:9000;
   server minio-04.internal-domain.com:9000;
}

upstream minio_console {
   least_conn;
   server minio-01.internal-domain.com:9001;
   server minio-02.internal-domain.com:9001;
   server minio-03.internal-domain.com:9001;
   server minio-04.internal-domain.com:9001;
}

server {
   listen       80;
   listen  [::]:80;
   server_name  minio.example.net;

   # Allow special characters in headers
   ignore_invalid_headers off;
   # Allow any size file to be uploaded.
   # Set to a value such as 1000m; to restrict file size to a specific value
   client_max_body_size 0;
   # Disable buffering
   proxy_buffering off;
   proxy_request_buffering off;

   location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_connect_timeout 300;
      # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      chunked_transfer_encoding off;

      proxy_pass http://minio_s3; # This uses the upstream directive definition to load balance
   }
}

server {

   listen       80;
   listen  [::]:80;
   server_name  console.example.net;

   # Allow special characters in headers
   ignore_invalid_headers off;
   # Allow any size file to be uploaded.
   # Set to a value such as 1000m; to restrict file size to a specific value
   client_max_body_size 0;
   # Disable buffering
   proxy_buffering off;
   proxy_request_buffering off;

   location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-NginX-Proxy true;

      # This is necessary to pass the correct IP to be hashed
      real_ip_header X-Real-IP;

      proxy_connect_timeout 300;

      # To support websocket
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      chunked_transfer_encoding off;

      proxy_pass http://minio_console/; # This uses the upstream directive definition to load balance
   }
}