Nginx的安装与配置
- 前端:AngularJS
- 后端:SpringBoot + Tomcat
前端静态资源放在Nginx服务器上,后端Tomcat置于Nginx后方,访问到Tomcat的请求由Nginx转发,全程访问使用https,访问前端地址为默认地址(如 https://192.168.28.232 ) ,访问后端地址加上/server(如 https://192.168.28.232/server )
SSL证书的生成
首先,进入你想创建证书和私钥的目录,例如:
# cd /usr/local/nginx/conf
创建服务器私钥,命令会让你输入一个口令:
# openssl genrsa -des3 -out server.key 2048
创建签名请求的证书(CSR):
# openssl req -new -key server.key -out server.csr
在加载SSL支持的Nginx并使用上述私钥时不带口令的key:
# openssl rsa -in server.key -out server_nopwd.key
最后标记证书使用上述私钥和CSR:
# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Nginx的安装
Windows平台下的Nginx安装
- 下载地址:
http://nginx.org
文件:nginx-1.9.5.zip - 启动
解压至c:\nginx,运行nginx.exe,默认使用80端口,日志见文件夹C:\nginx\logs - 使用
http://localhost
访问成功后进入Nginx欢迎界面 - 关闭
nginx.exe -s stop 强制关闭
nginx.exe -s quit 优雅的关闭 - 修改配置
修改conf目录下的nginx.conf文件,启用https服务
worker_processes 1;
events {
worker_connections 1024;
}
http {
# 允许加载静态资源
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
server {
server_name localhost;
# 监听443端口,启用https服务
listen 443;
ssl on;
# ssl证书的位置
ssl_certificate C:/nginx-1.9.5/cert/server.crt;
ssl_certificate_key C:/nginx-1.9.5/cert/server_nopwd.key;
ssl_session_timeout 30m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
ssl_prefer_server_ciphers on;
# 加载AngularJS的build之后的文件位置 (gulp build)
location / {
root C:/nginx-1.9.5/apps/web-console/build;
index index.html;
expires 30d;
try_files $uri $uri/ /index.html;
}
# 反向代理Tomcat服务器,将类似htts://localhost/server的请求转发到Tomcat上
location /server {
# /server只是我们定义的请求格式,需要截取/server后面的uri重组url
if ($request_uri ~ ^/server/(.*)$ ){
# 每个服务器都有一个Nginx将请求转发到本地的Tomcat上
proxy_pass http://127.0.0.1:8080/$1;
}
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect off;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}
Linux(CentOS)下的Nginx安装
Nginx需要gcc g++开发库之类的环境:
安装make:
# yum -y install gcc automake autoconf libtool make
安装g++:
# yum install gcc gcc-c++
1.安装PCRE库
通过yum安装pcre库,也可以自己下载并make,这里通过yum快速安装:
# yum search pcre
pcre-devel.i686 : Development files for pcre
pcre-devel.x86_64 : Development files for pcre
pcre-static.i686 : Static library for pcre
pcre-static.x86_64 : Static library for pcre
pcre-tools.x86_64 : Auxiliary utilities for pcre
pcre.i686 : Perl-compatible regular expression library
pcre.x86_64 : Perl-compatible regular expression library
# yum install pcre-static.x86_64
2.安装zlib库
通过yum安装zlib库:
# yum search zlib
zlib-devel.i686 : Header files and libraries for Zlib development
zlib-devel.x86_64 : Header files and libraries for Zlib development
zlib-static.i686 : Static libraries for Zlib development
zlib-static.x86_64 : Static libraries for Zlib development
zlib.i686 : The compression and decompression library
zlib.x86_64 : The compression and decompression library
# yum install zlib-static.x86_64
3.安装OpenSSL
# yum install openssl.x86_64
4.安装Nginx
# cd /usr/local/src
# wget http://nginx.org/download/nginx-1.4.2.tar.gz
# tar -zxvf nginx-1.4.2.tar.gz
# cd nginx-1.4.2
# ./configure --sbin-path=/usr/local/nginx/nginx --with-http_ssl_module
# make
# make install
5.启动
启动前确保80端口没有被占用:
# netstat -ano|grep 80
运行nginx
# /usr/local/nginx/nginx
6.修改Nginx配置支持https服务
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
server {
server_name localhost;
listen 443;
ssl on;
ssl_certificate /usr/local/cert/server.crt;
ssl_certificate_key /usr/local/cert/server_nopwd.key;
ssl_session_timeout 30m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
ssl_prefer_server_ciphers on;
location / {
root /usr/local/apps/webconsole/build;
index index.html index.htm;
try_files $uri $uri/ /index.html;
}
location /server {
if ($request_uri ~ ^/server/(.*)$ ){
proxy_pass http://127.0.0.1:8080/$1;
}
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect off;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}
另外还可以加入如下代码实现80端口重定向到443:
server {
listen 80;=
rewrite ^(.*) https://$host$1 permanent;
# returen效率更高
# return 301 https://$host$request_uri;
}