version: '2'
services:
     nginx:
      image: 'nginx:latest'
      restart: always
      container_name: nginx
      ports:
        - '80:80'
        - '443:443'
      volumes:
        - '/app/nginx/conf.d:/etc/nginx/conf.d'
        - '/app/nginx/logs:/etc/nginx/logs'
      command:  nginx -g 'daemon off;'

mkdir -p /app/nginx/logs
mkdir -p /app/nginx/conf.d

server {
    listen       80;
    server_name localhost;
    #自定義日志路徑，log格式使用main(默認(rèn))
    access_log logs/access_service.log main; 
   location / {
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header Host $http_host;
       proxy_pass http://xxx.com;
       client_max_body_size    100m;
      }

     error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
}

awk ‘{print $1}' access_service.log |sort |uniq -c|sort -n

server {
    listen       80;
    server_name localhost;
    access_log  logs/access_service.log  main; 
     # 將禁止ip放在server級(jí)別
      deny 172.20.0.1; 
   location / {
      # 將禁止ip放在location級(jí)別
      # deny 172.20.0.1; 
      allow 172.20.0.1;

       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header Host $http_host;
       proxy_pass http://test.xylink.cn;
       client_max_body_size    100m;
      }
     error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
}

//屏蔽單個(gè)ip訪問(wèn)
deny IP; 
//允許單個(gè)ip訪問(wèn)
allow IP; 
//屏蔽所有ip訪問(wèn)
deny all; 
//允許所有ip訪問(wèn)
allow all; 
//屏蔽整個(gè)段即從123.0.0.1到123.255.255.254訪問(wèn)的命令
deny 123.0.0.0/8
//屏蔽IP段即從123.45.0.1到123.45.255.254訪問(wèn)的命令
deny 124.45.0.0/16
//屏蔽IP段即從123.45.6.1到123.45.6.254訪問(wèn)的命令
deny 123.45.6.0/24
//如果你想實(shí)現(xiàn)這樣的應(yīng)用，除了幾個(gè)IP外，其他全部拒絕，
//那需要你在guolv_ip.conf中這樣寫(xiě)
allow 1.1.1.1; 
allow 1.1.1.2;
deny all;