nginx整合lua、jwt、cjson、redis、mysql模块镜像构建

基于centos:centos7.9.2009基础镜像，nginx整合lua、jwt、cjson、redis、mysql模块，构建基础镜像，为实现灰度/蓝绿发布提供参考，避免了频繁的构建，同时也为服务上云提供镜像支持。 ponylee/centos7-nginx:latest 镜像，有相似的需求可以拿来直接用。

一、基础组件下载

1. luajit2-2.1-20220411.tar.gz #luajit官网存在一定的坑，下载openresty的优化版本
   https://github.com/openresty/luajit2/archive/refs/tags/v2.1-20220411.tar.gz
2. lua-nginx-module-0.10.22.tar.gz # 0.10.16 以后都需要 lua-resty-core和lua-resty-lrucache
   https://github.com/openresty/lua-nginx-module/archive/refs/tags/v0.10.22.tar.gz
3. lua-resty-core-0.1.24.tar.gz [lua-nginx-module依赖]
   https://github.com/openresty/lua-resty-core/archive/refs/tags/v0.1.24.tar.gz
4. lua-resty-lrucache-0.12.tar.gz [lua-nginx-module依赖]
   https://github.com/openresty/lua-resty-lrucache/archive/refs/tags/v0.12.tar.gz
5. ngx_devel_kit-0.3.2.tar.gz
   https://github.com/vision5/ngx_devel_kit/archive/refs/tags/v0.3.2.tar.gz
6. nginx-1.21.6.tar.gz
   http://nginx.org/download/nginx-1.21.6.tar.gz
7. lua-cjson-2.1.0.9.tar.gz
   https://github.com/openresty/lua-cjson/archive/refs/tags/2.1.0.9.tar.gz
8. lua-resty-string-0.15.tar.gz
   https://github.com/openresty/lua-resty-string/archive/refs/tags/v0.15.tar.gz
9. lua-resty-jwt-0.1.11.tar.gz
   https://github.com/SkyLothar/lua-resty-jwt/archive/refs/tags/v0.1.11.tar.gz
10. lua-resty-hmac-0.06.tar.gz
    https://github.com/jkeys089/lua-resty-hmac/archive/refs/tags/v0.06.tar.gz
11. lua-resty-redis-0.29.tar.gz
    https://github.com/openresty/lua-resty-redis/archive/refs/tags/v0.29.tar.gz
12. lua-resty-mysql-0.26.tar.gz
    https://github.com/openresty/lua-resty-mysql/archive/refs/tags/v0.26.tar.gz

二、组件本地安装

1. luajit安装

编译

cd /opt/lua/
tar -zxvf luajit2-2.1-20220411.tar.gz
cd luajit2-2.1-20220411
make install PREFIX=/usr/local/luajit
--卸载
make uninstall PREFIX=/usr/local/luajit

加载

ln -s /usr/local/luajit/lib/libluajit-5.1.so.2 /lib64/liblua-5.1.so.2
echo "/usr/local/luajit/lib" >> /etc/ld.so.conf
ldconfig

配置环境变量

vi /etc/profile
#增加下面内容
echo "export LUAJIT_INC=/usr/local/luajit/include/luajit-2.1" >> /etc/profile
echo "export LUAJIT_LIB=/usr/local/luajit/lib" >>/etc/profile
#立刻生效
source /etc/profile

2. lua-resty-core安装

cd /opt/lua/
tar -zxvf lua-resty-core-0.1.24.tar.gz
cd lua-resty-core-0.1.24
make install PREFIX=/usr/local/lua_core

3. lua-resty-lrucache安装

cd /opt/lua/
tar -zxvf lua-resty-lrucache-0.12.tar.gz
cd lua-resty-lrucache-0.12
make install PREFIX=/usr/local/lua_core

4. lua-nginx-module安装

cd /opt/lua/
tar -zxvf lua-nginx-module-0.10.22.tar.gz

5. ngx_devel_kit安装

cd /opt/lua/
tar -zxvf ngx_devel_kit-0.3.2.tar.gz

6. nginx加载lua模块

cd /opt/lua/
tar -zxvf nginx-1.21.6.tar.gz
cd nginx-1.21.6/ 

./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx  --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx \
--with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie' \
--add-module=/opt/lua/ngx_devel_kit-0.3.2 \
--add-module=/opt/lua/lua-nginx-module-0.10.22

make -j2 && make install

需要特殊配置：

--prefix=/etc/nginx 
--sbin-path=/usr/sbin/nginx
--add-module=/opt/lua/ngx_devel_kit-0.3.2 
--add-module=/opt/lua/lua-nginx-module-0.10.22

增加lua测试代码

location /hello { 
  default_type 'text/plain'; 
  content_by_lua 'ngx.say("hello, lua")'; 
}

nginx.conf配置文件中，http模块增加包依赖

lua_package_path "/usr/local/lua_core/lib/lua/?.lua;;";

检查配置
/opt/nginx/sbin/nginx -t
加载配置
/opt/nginx/sbin/nginx -s reload

访问curl http://127.0.0.1/hello，返回hello,lua，说明nginx集成lua成功

至此已经可以使用lua基本功能了，笔者因想使用lua实现jwt校验，所以后续还需要安装cjson和retry-http

7. lua-cjson安装

cd /opt/lua
tar -zxvf lua-cjson-2.1.0.10.tar.gz
cd lua-cjson-2.1.0.10

修改Makefile，指定luajit

vi Makefile
将LUA_INCLUDE_DIR的值$(PREFIX)/include改为/usr/local/luajit/include/luajit-2.1

make && make install PREFIX=/usr/local/cjson
#cp /usr/local/cjson/lib/lua/5.1/cjson.so /usr/local/luajit/lib/lua/5.1/
cp /usr/local/cjson/lib/lua/5.1/cjson.so /usr/local/lib/lua/5.1
chmod 755 /usr/local/lib/lua/5.1/cjson.so

验证
cd /usr/local/luajit/bin
./luajit
print(require “cjson”)
–或者
local json = require(“cjson”)

8. lua-resty-string安装

cd /opt/lua/
tar -zxvf lua-resty-string-0.15.tar.gz
cd lua-resty-string-0.15
make install PREFIX=/usr/local/lua_core

9.lua-resty-jwt安装

cd /opt/lua/
tar -zxvf lua-resty-jwt-0.1.11.tar.gz
cp lua-resty-jwt-0.1.11/lib/resty/* /usr/local/lua_core/lib/lua/resty

10. lua-resty-hmac安装

cd /opt/lua/
tar -zxvf lua-resty-hmac-0.06.tar.gz
cp lua-resty-hmac-0.06/lib/resty/* /usr/local/lua_core/lib/lua/resty

11. lua-resty-redis安装

cd /opt/lua/
tar -zxvf  lua-resty-redis-0.29.tar.gz
cp  lua-resty-redis-0.29/lib/resty/* /usr/local/lua_core/lib/lua/resty

12. lua-resty-mysql安装

cd /opt/lua/
tar -zxvf  lua-resty-mysql-0.26.tar.gz
cp  lua-resty-mysql-0.26/lib/resty/* /usr/local/lua_core/lib/lua/resty

至此，redis、mysql、lua和jwt都集成完成，可以通过下面样例进行测试

nginx.conf配置文件中，http模块增加包依赖
lua_package_path “/usr/local/lua_core/lib/lua/?.lua;;”;

增加lua测试代码

location /verify {
	default_type text/html;
	content_by_lua '
	local redis = require("resty.redis")
	local mysql = require("resty.mysql")
	local cjson = require "cjson"
	local jwt = require "resty.jwt"
	local secret = "lua-resty-jwt"
	local jwt_token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9" ..
					".eyJmb28iOiJiYXIifQ" ..
					".VAoRL1IU0nOguxURF2ZcKR0SGKE1gCbqwyh8u2MLAyY"
	local jwt_obj = jwt:verify(secret, jwt_token)
	ngx.say(jwt_obj.verified)
	ngx.say(cjson.encode(jwt_obj))
	';
}

访问:

curl http://127.0.0.1/verify

返回:

{
	"reason": "everything is awesome~ :p",
	"valid": true,
	"payload": {
	"foo": "bar"
	},
	"signature": "VAoRL1IU0nOguxURF2ZcKR0SGKE1gCbqwyh8u2MLAyY",
	"raw_payload": "eyJmb28iOiJiYXIifQ",
	"header": {
	"alg": "HS256",
	"typ": "JWT"
	},
	"raw_header": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9",
	"verified": true
	}

三、镜像构造

容器内部构建

启动容器

docker run -itd --name centos -p 8080:80 \
-v /opt/lua:/opt/lua \
centos:centos7.9.2009

复制编译完成的文件

docker  cp   /etc/nginx centos:/etc
docker  cp   /usr/sbin/nginx centos:/usr/sbin
docker cp    /usr/local/luajit centos:/usr/local
docker cp    /usr/local/lua_core centos:/usr/local
docker cp    /usr/local/cjson/lib/lua/5.1/cjson.so  centos:/usr/local/lib/lua/5.1

容器内部执行

#加载
	ln -s /usr/local/luajit/lib/libluajit-5.1.so.2 /lib64/liblua-5.1.so.2
	echo "/usr/local/luajit/lib" >> /etc/ld.so.conf
	ldconfig

#配置环境变量
	echo "export LUAJIT_INC=/usr/local/luajit/include/luajit-2.1" >> /etc/profile
	echo "export LUAJIT_LIB=/usr/local/luajit/lib" >>/etc/profile
	source /etc/profile

提交本地容器作为镜像

docker commit -m=“centos7.9.2009 with nginx/1.21.6” -a=“pony” centos ponylee/centos7-nginx:v1

构建最终镜像

Dockerfile

FROM ponylee/centos7-nginx:v1
MAINTAINER ponylee
# 注意，日志软链，控制台打印日志
RUN  ln -sf /dev/stdout /var/log/nginx/access.log && \
        ln -sf /dev/stderr /var/log/nginx/error.log

EXPOSE 80
EXPOSE 443
VOLUME [ "/var/log/nginx","/etc/nginx/conf.d" ]

CMD ["nginx", "-g", "daemon off;"]

构建

docker build -t ponylee/centos7-nginx:latest ./

启动容器

docker run --rm --name=ngx_lua -it  -p 8088:80 \
-v /etc/nginx/nginx.conf:/etc/nginx/nginx.conf:rw \
-v /etc/nginx/conf.d:/etc/nginx/conf.d:rw \
-v /data/nginx:/var/log/nginx:rw \ # 日志挂载，控制台不打印日志
--privileged=true \
ponylee/centos7-nginx:latest

访问

curl http://127.0.0.1:8088/hello
curl http://127.0.0.1:8088/verify

nginx reload

docker exec -it ngx_lua nginx -s reload