Orange--------基于nginx/openresty之API网关(Gateway)实战

Orange 简介

Orange是一个基于OpenResty的API网关。除Nginx的基本功能外，它还可用于API监控、访问控制(鉴权、WAF)、流量筛选、访问限速、AB测试、动态分流等。它有以下特性：

• 提供了一套默认的Dashboard用于动态管理各种功能和配置
• 提供了API接口用于实现第三方服务(如个性化运维需求、第三方Dashboard等)
• 可根据规范编写自定义插件扩展Orange功能

Orange 实战

环境

[root@orange ~]# cat /etc/redhat-release 
CentOS Linux release 7.4.1708 (Core) 
[root@orange ~]# uname -a
Linux orange 3.10.0-693.17.1.el7.x86_64 #1 SMP Thu Jan 25 20:13:58 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
[root@orange ~]# iptables -F
[root@orange ~]# ip addr
[root@orange orange]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:57:b5:ab brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.131/24 brd 192.168.0.255 scope global dynamic eth0
       valid_lft 7081sec preferred_lft 7081sec
    inet6 fe80::3f87:b30b:ff6b:e675/64 scope link 
       valid_lft forever preferred_lft forever

OpenResty下载 [ version > 1.9.7.3 ]

• 下载OpenResty源码包

[root@orange ~]# cd /usr/local/src/
[root@orange src]# wget https://openresty.org/download/openresty-1.13.6.1.tar.gz
--2018-03-06 15:41:59--  https://openresty.org/download/openresty-1.13.6.1.tar.gz
Resolving openresty.org (openresty.org)... 120.26.162.249
Connecting to openresty.org (openresty.org)|120.26.162.249|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4581699 (4.4M) [application/x-gzip]
Saving to: ‘openresty-1.13.6.1.tar.gz’

100%[=================================>] 4,581,699   9.08MB/s   in 0.5s   

2018-03-06 15:42:00 (9.08 MB/s) - ‘openresty-1.13.6.1.tar.gz’ saved [4581699/4581699]

• 解压源码包并进入包内

[root@orange src]# tar xf openresty-1.13.6.1.tar.gz 
[root@orange src]# cd openresty-1.13.6.1

• 创建openresty系统用户

[root@orange openresty-1.13.6.1]# useradd -r -s /sbin/nologin -M openresty

• 安装相关依赖

[root@orange openresty-1.13.6.1]# yum install pcre pcre-devel openssl openssl-devel git -y

• 指定参数生成Makefile文件

[root@orange openresty-1.13.6.1]# ./configure --prefix=/usr/local/openresty-1.13.6.1 --user=openresty --group=openresty --with-http_stub_status_module
……
……
……
Configuration summary
  + using system PCRE library
  + using system OpenSSL library
  + using system zlib library

  nginx path prefix: "/usr/local/openresty-1.13.6.1/nginx"
  nginx binary file: "/usr/local/openresty-1.13.6.1/nginx/sbin/nginx"
  nginx modules path: "/usr/local/openresty-1.13.6.1/nginx/modules"
  nginx configuration prefix: "/usr/local/openresty-1.13.6.1/nginx/conf"
  nginx configuration file: "/usr/local/openresty-1.13.6.1/nginx/conf/nginx.conf"
  nginx pid file: "/usr/local/openresty-1.13.6.1/nginx/logs/nginx.pid"
  nginx error log file: "/usr/local/openresty-1.13.6.1/nginx/logs/error.log"
  nginx http access log file: "/usr/local/openresty-1.13.6.1/nginx/logs/access.log"
  nginx http client request body temporary files: "client_body_temp"
  nginx http proxy temporary files: "proxy_temp"
  nginx http fastcgi temporary files: "fastcgi_temp"
  nginx http uwsgi temporary files: "uwsgi_temp"
  nginx http scgi temporary files: "scgi_temp"

cd ../..
Type the following commands to build and install:
    gmake
    gmake install

• gmake编译

[root@orange openresty-1.13.6.1]# gmake
……
……
……
sed -e "s|%%PREFIX%%|/usr/local/openresty-1.13.6.1/nginx|" \
    -e "s|%%PID_PATH%%|/usr/local/openresty-1.13.6.1/nginx/logs/nginx.pid|" \
    -e "s|%%CONF_PATH%%|/usr/local/openresty-1.13.6.1/nginx/conf/nginx.conf|" \
    -e "s|%%ERROR_LOG_PATH%%|/usr/local/openresty-1.13.6.1/nginx/logs/error.log|" \
    < docs/man/nginx.8 > objs/nginx.8
gmake[2]: Leaving directory `/usr/local/src/openresty-1.13.6.1/build/nginx-1.13.6'
gmake[1]: Leaving directory `/usr/local/src/openresty-1.13.6.1/build/nginx-1.13.6'

• gmake install安装

[root@orange openresty-1.13.6.1]# gmake install
……
……
……
gmake[2]: Leaving directory `/usr/local/src/openresty-1.13.6.1/build/nginx-1.13.6'
gmake[1]: Leaving directory `/usr/local/src/openresty-1.13.6.1/build/nginx-1.13.6'
mkdir -p /usr/local/openresty-1.13.6.1/site/lualib /usr/local/openresty-1.13.6.1/site/pod /usr/local/openresty-1.13.6.1/site/manifest
ln -sf /usr/local/openresty-1.13.6.1/nginx/sbin/nginx /usr/local/openresty-1.13.6.1/bin/openresty

• 创建openrestyl目录软链接

[root@orange openresty-1.13.6.1]# ln -s /usr/local/openresty-1.13.6.1 /usr/local/openresty
[root@orange openresty-1.13.6.1]# ls -l /usr/local/openresty
lrwxrwxrwx. 1 root root 29 Mar  6 18:06 /usr/local/openresty -> /usr/local/openresty-1.13.6.1

• 设置resty和nginx相关环境变量, 并生效

[root@orange openresty-1.13.6.1]# cat /etc/profile.d/openresty.sh 
export OPENRESTY_HOME=/usr/local/openresty
export NGINX_HOME=$OPENRESTY_HOME/nginx
export PATH=$OPENRESTY_HOME/bin:$NGINX_HOME/sbin:$PATH
[root@orange openresty-1.13.6.1]# source /etc/profile
[root@orange openresty-1.13.6.1]# echo $PATH
/usr/local/openresty/bin:/usr/local/openresty/nginx/sbin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin

lor(lua web框架)安装

• 若使用的Orange版本低于v0.6.2则应安装lor v0.2.*版本
• 若使用的Orange版本高于或等于v0.6.2则应安装lor v0.3.0+版本
• git克隆lor代码库，并进入代码包

[root@orange src]# cd /usr/local/src/
[root@orange src]# git clone https://github.com/sumory/lor
Cloning into 'lor'...
remote: Counting objects: 1716, done.
remote: Total 1716 (delta 0), reused 0 (delta 0), pack-reused 1716
Receiving objects: 100% (1716/1716), 335.55 KiB | 8.00 KiB/s, done.
Resolving deltas: 100% (903/903), done.
[root@orange src]# cd lor/

• 安装lor

[root@orange lor]# make install
install lor runtime files to /usr/local/lor
lor runtime files installed.
install lord cli to /usr/local/bin/
lord cli installed.
lor framework installed successfully

MySQL安装 [此处用yum安装Mariadb，MySQL二进制安装点这里]

• 安装MySQL

[root@orange lor]# yum install mariadb-server -y
……
……
……
Installed:
  mariadb-server.x86_64 1:5.5.56-2.el7                                                                                                           

Dependency Installed:
  libaio.x86_64 0:0.3.109-13.el7                   mariadb.x86_64 1:5.5.56-2.el7              perl-Compress-Raw-Bzip2.x86_64 0:2.061-3.el7     
  perl-Compress-Raw-Zlib.x86_64 1:2.061-4.el7      perl-DBD-MySQL.x86_64 0:4.023-5.el7        perl-DBI.x86_64 0:1.627-4.el7                    
  perl-Data-Dumper.x86_64 0:2.145-3.el7            perl-IO-Compress.noarch 0:2.061-2.el7      perl-Net-Daemon.noarch 0:0.48-5.el7              
  perl-PlRPC.noarch 0:0.2020-14.el7               

Complete!

• 启动mysqld，并查看启动状态

[root@orange lor]# systemctl start mariadb.service
[root@orange lor]# systemctl status mariadb.service
● mariadb.service - MariaDB database server
   Loaded: loaded (/usr/lib/systemd/system/mariadb.service; disabled; vendor preset: disabled)
   Active: active (running) since Tue 2018-03-06 16:13:53 CST; 34s ago
  Process: 11775 ExecStartPost=/usr/libexec/mariadb-wait-ready $MAINPID (code=exited, status=0/SUCCESS)
  Process: 11696 ExecStartPre=/usr/libexec/mariadb-prepare-db-dir %n (code=exited, status=0/SUCCESS)
 Main PID: 11774 (mysqld_safe)
   CGroup: /system.slice/mariadb.service
           ├─11774 /bin/sh /usr/bin/mysqld_safe --basedir=/usr
           └─11936 /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib64/mysql/plugin --log-error=/var/log/maria...

Mar 06 16:13:51 orange mariadb-prepare-db-dir[11696]: MySQL manual for more instructions.
Mar 06 16:13:51 orange mariadb-prepare-db-dir[11696]: Please report any problems at http://mariadb.org/jira
Mar 06 16:13:51 orange mariadb-prepare-db-dir[11696]: The latest information about MariaDB is available at http://mariadb.org/.
Mar 06 16:13:51 orange mariadb-prepare-db-dir[11696]: You can find additional information about the MySQL part at:
Mar 06 16:13:51 orange mariadb-prepare-db-dir[11696]: http://dev.mysql.com
Mar 06 16:13:51 orange mariadb-prepare-db-dir[11696]: Consider joining MariaDB's strong and vibrant community:
Mar 06 16:13:51 orange mariadb-prepare-db-dir[11696]: https://mariadb.org/get-involved/
Mar 06 16:13:51 orange mysqld_safe[11774]: 180306 16:13:51 mysqld_safe Logging to '/var/log/mariadb/mariadb.log'.
Mar 06 16:13:51 orange mysqld_safe[11774]: 180306 16:13:51 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
Mar 06 16:13:53 orange systemd[1]: Started MariaDB database server.

• 设置root@localhost密码

[root@orange lor]# mysql
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 4
Server version: 5.5.56-MariaDB MariaDB Server

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> set password = password('123');
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> quit
Bye

安装orange

• 下载orange包

[root@orange lor]# cd /usr/local/src/
[root@orange src]# git clone https://github.com/sumory/orange.git
Cloning into 'orange'...
remote: Counting objects: 3385, done.
remote: Compressing objects: 100% (27/27), done.
remote: Total 3385 (delta 9), reused 5 (delta 2), pack-reused 3356
Receiving objects: 100% (3385/3385), 2.60 MiB | 29.00 KiB/s, done.
Resolving deltas: 100% (2151/2151), done.

• 安装orange [Orange可选择不“安装”即可使用, 需拿start.sh启动程序]

[root@orange orange]# cd ..
[root@orange src]# ls
lor  openresty-1.13.6.1  openresty-1.13.6.1.tar.gz  orange
[root@orange src]# ll
total 4480
drwxr-xr-x.  8 root root     262 Mar  6 16:06 lor
drwxrwxr-x.  6 1000 1000     157 Mar  6 15:50 openresty-1.13.6.1
-rw-r--r--.  1 root root 4581699 Nov 13 13:53 openresty-1.13.6.1.tar.gz
drwxr-xr-x. 12 root root    4096 Mar  6 18:11 orange
[root@orange src]# cd orange/
[root@orange orange]# make install
copy nginx.conf
copy orange.conf
Orange installed.
/usr/local/bin/orange help
Orange v0.6.4, OpenResty/Nginx API Gateway.

Usage: orange COMMAND [OPTIONS]

The commands are:

stop    Stop current Orange
version Show the version of Orange
restart Restart Orange
reload  Reload the config of Orange
store   Init/Update/Backup Orange store
help    Show help tips
start   Start the Orange Gateway

配置文件

[Orange有两个配置文件，一个是conf/orange.conf，用于配置插件、存储方式和内部集成的默认Dashboard，另一个是conf/nginx.conf用于配置Nginx(OpenResty).]

• orange.conf的配置如下，请按需修改:

{
    "plugins": [ //可用的插件列表，若不需要可从中删除，系统将自动加载这些插件的开放API并在7777端口暴露
        "stat",
        "monitor",
        "redirect",
        "rewrite",
        "rate_limiting",
        "property_rate_limiting",
        "basic_auth",
        "key_auth",
        "signature_auth",
        "waf",
        "divide",
        "kvstore"
    ],

    "store": "mysql",//目前仅支持mysql存储
    "store_mysql": { //MySQL配置
        "timeout": 5000,
        "connect_config": {//连接信息，请修改为需要的配置
            "host": "localhost",       // 注意修改修改为本地数据库信息
            "port": 3306,                // 注意修改修改为本地数据库信息
            "database": "orange", // 注意修改修改为本地数据库信息
            "user": "root",              // 注意修改修改为本地数据库信息
            "password": "123",      // 注意修改修改为本地数据库信息
            "max_packet_size": 1048576
        },
        "pool_config": {
            "max_idle_timeout": 10000,
            "pool_size": 3
        },
        "desc": "mysql configuration"
    },

    "dashboard": {//默认的Dashboard配置.
        "auth": false, //设为true，则需用户名、密码才能登录Dashboard,默认的用户名和密码为admin/orange_admin
        "session_secret": "y0ji4pdj61aaf3f11c2e65cd2263d3e7e5", //加密cookie用的盐，自行修改即可
        "whitelist": [//不需要鉴权的uri，如登录页面，无需修改此值
            "^/auth/login$",
            "^/error/$"
        ]
    },

    "api": {//API server配置
        "auth_enable": true,//访问API时是否需要授权
        "credentials": [//HTTP Basic Auth配置，仅在开启auth_enable时有效，自行添加或修改即可
            {
                "username":"api_username",
                "password":"api_password"
            }
        ]
    }
}

• conf/nginx.conf里是一些nginx相关配置，请自行检查并按照实际需要更改或添加配置，特别注意以下几个配置：
• lua_package_path：需要根据本地环境配置适当修改，如lor框架的安装路径
• resolver：DNS解析
• 各个server或是location的权限，如是否需要通过allow/deny指定配置黑白名单ip

数据表导入MySQL

• 在MySQL中创建数据库，名为orange

[root@orange lor]# mysql -uroot -p123
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 7
Server version: 5.5.56-MariaDB MariaDB Server

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> create database orange character set utf8mb4;
Query OK, 1 row affected (0.00 sec)

• SQL脚本(如install/orange-v0.6.4.sql)导入到orange库中

[root@orange lor]# mysql -uroot -p123
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 9
Server version: 5.5.56-MariaDB MariaDB Server

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> use orange
Database changed
MariaDB [orange]> source /usr/local/orange/install/orange-v0.6.4.sql
Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 1 row affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 1 row affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.01 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 1 row affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 1 row affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.01 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 1 row affected (0.00 sec)

Query OK, 0 rows affected (0.01 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 1 row affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.01 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 1 row affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.01 sec)

Query OK, 1 row affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 1 row affected (0.01 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 1 row affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.01 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 1 row affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.01 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

MariaDB [orange]> quit
Bye

启动orange

[root@orange lor]# orange start
[INFO] Orange: 0.6.4
[INFO] ngx_lua: 10011
[INFO] nginx: 1013006
[INFO] Lua: LuaJIT 2.1.0-beta3
[INFO] args:
[INFO]  ngx_conf:/usr/local/orange/conf/nginx.conf
[INFO]  orange_conf:/usr/local/orange/conf/orange.conf
[INFO]  prefix:/usr/local/orange
[INFO] args end.
[INFO] Start orange command execute.
[INFO] ORANGE_CONF=/usr/local/orange/conf/orange.conf nginx -p /usr/local/orange -c /usr/local/orange/conf/nginx.conf

web访问orange dashboard [192.168.0.131为测试主机]