Nchan 实时消息 安全配置

备注：

    即时消息的安全对于我们来说是比较重要的，作者在设计Nchan 的时候已经考虑了

a. nchan_authorize_request （Hooks and Callbacks）可以集成后端服务

  配置如下：

  upstream my_app {

    server 127.0.0.1:8080;

  }

  location = /auth {

    proxy_pass http://my_app/pubsub_authorize;

    proxy_pass_request_body off;

    proxy_set_header Content-Length "";

    proxy_set_header X-Subscriber-Type $nchan_subscriber_type;

    proxy_set_header X-Publisher-Type $nchan_publisher_type;

    proxy_set_header X-Prev-Message-Id $nchan_prev_message_id;

    proxy_set_header X-Channel-Id $nchan_channel_id;

    proxy_set_header X-Original-URI $request_uri;

    proxy_set_header X-Forwarded-For $remote_addr;

  }

 

  location ~ /pubsub/auth/(\w+)$ {

    nchan_channel_id $1;

    nchan_authorize_request /auth;

    nchan_pubsub;

    nchan_channel_group test;

  }

                           

b. 使用内部channel ，控制访问ip

                           

// 只能内部访问

http {

  server {

    #available only on localhost

    listen  127.0.0.1:8080;

    location ~ /pub/(\w+)$ {

      nchan_publisher;

      nchan_channel_group my_app_group;

      nchan_channel_id $1;

    }

  }

 

  server {

    #available to the world

    listen 80;

 

    location ~ /sub/(\w+)$ {

      nchan_subscriber;

      nchan_channel_group my_app_group;

      nchan_channel_id $1;

    }

  }

}

  // ip 过滤

  server {

    #available to the world

    listen 80;

    location ~ /pub/(\w+)$ {

      allow 127.0.0.1;

      deny all;

      nchan_publisher;

      nchan_channel_group my_app_group;

      nchan_channel_id $1;

    }

c. 对于重要的，外部服务进行加密

                     

  http {

  server {

    #available only on localhost

    listen  127.0.0.1:8080;

    #...publisher endpoint config

  }

  server {

    #available to the world

    listen 443 ssl;

    #SSL config goes here

    location ~ /sub/(\w+)$ {

      nchan_subscriber;

      nchan_channel_group my_app_group;

      nchan_channel_id $1;

    }

  }

}