（基础）NGINX 第一章 NGINX目录结构规范

网络拓扑结构

大概思路是：所有请求都是从80/443端口进入，根据不同的域名跳转到不同的host。这里仅仅适合不同的域名来用同一个端口对应多个server的情况。

NGINX 目录

正常情况下，NGINX的目录按如下结构进行规范。

NGINX.CONF

#user  nobody;
worker_processes  2;

events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    keepalive_timeout  65;
	# 引入vhost文件夹下的虚拟主机
    include vhost/*.conf;
    # 不同域名对应不同测试端口
    upstream vip.xx.com{
      server 127.0.0.1:8080;
    }
    
	upstream user-vip.xx.com{
      server 127.0.0.1:8081;
    }

    server {
        listen       80;
        server_name  localhost;

        location / {
            root   html;
            index  index.html index.htm;
        }
      
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }

}

VHOST目录

VHOST下的配置文件命名规范如下。
xx.yy.com.conf
如：passport.jd.com.conf

单独每个虚拟主机的配置

示例1

server {
        listen 80;
        client_max_body_size 10M;
		ssl_certificate D:/Software/nginx1.4/conf/ssl/server.crt;
        ssl_certificate_key D:/Software/nginx1.4/conf/ssl/server.key;
		listen 443 ssl;
		# server名字，如果可以匹配多级域名，可以使用该方式  ~^(.+)?\.domain\.com$;
        server_name vip.xx.com;
        charset utf-8;
        index index.html index.htm;
        location / {
			set $meshttps "";
                if ($scheme = "http") {
                    set $meshttps "1";
                }
                if ($uri ~* ^(.*)/login(.*)$) {
                    set $meshttps "1${meshttps}";
                }
                if ($meshttps = "11") {
                    rewrite ^(.*)$ https://$host$uri break;
                }
				
				proxy_set_header        Host  $host;
				set $SSL "";
				if ($scheme = "https") {
					set $SSL SSL;
				}       
				proxy_set_header X-Proto $SSL;
				
                proxy_pass http://vip.xx.com;
                proxy_connect_timeout 500s;
                proxy_read_timeout 500s;
                proxy_send_timeout 500s;
        }
       
		
		location /mes {
			set $meshttps "";
                if ($scheme = "http") {
                    set $meshttps "1";
                }
                if ($uri ~* ^(.*)/login(.*)$) {
                    set $meshttps "1${meshttps}";
                }
                if ($meshttps = "11") {
                    rewrite ^(.*)$ https://$host$uri break;
                }
			rewrite ^/mes/(.*) /$1 break;
			proxy_set_header Host $host;
			proxy_pass http://vip.xx.com;
		}
}

示例2

server {

        listen 80;
        client_max_body_size 10M;
		ssl_certificate D:/Software/nginx1.4/conf/ssl/server.crt;
        ssl_certificate_key D:/Software/nginx1.4/conf/ssl/server.key;
		listen 443 ssl;
        server_name user-vip.xx.com;
        charset utf-8;
        index index.html index.htm;
        location / {
				proxy_set_header        Host  $host;
				set $SSL "";
				if ($scheme = "https") {
					set $SSL SSL;
				}       
				proxy_set_header X-Proto $SSL;
				
                proxy_pass http://user-vip.xx.com/;
                proxy_connect_timeout 500s;
                proxy_read_timeout 500s;
                proxy_send_timeout 500s;
        }
}

证书放置目录ssl

mime.types

types {
    text/html                             html htm shtml;
    text/css                              css;
    text/xml                              xml;
    image/gif                             gif;
    image/jpeg                            jpeg jpg;
    application/x-javascript              js;
    application/atom+xml                  atom;
    application/rss+xml                   rss;

    text/mathml                           mml;
    text/plain                            txt;
    text/vnd.sun.j2me.app-descriptor      jad;
    text/vnd.wap.wml                      wml;
    text/x-component                      htc;

    image/png                             png;
    image/tiff                            tif tiff;
    image/vnd.wap.wbmp                    wbmp;
    image/x-icon                          ico;
    image/x-jng                           jng;
    image/x-ms-bmp                        bmp;
    image/svg+xml                         svg svgz;
    image/webp                            webp;

    application/java-archive              jar war ear;
    application/mac-binhex40              hqx;
    application/msword                    doc;
    application/pdf                       pdf;
    application/postscript                ps eps ai;
    application/rtf                       rtf;
    application/vnd.ms-excel              xls;
    application/vnd.ms-powerpoint         ppt;
    application/vnd.wap.wmlc              wmlc;
    application/vnd.google-earth.kml+xml  kml;
    application/vnd.google-earth.kmz      kmz;
    application/x-7z-compressed           7z;
    application/x-cocoa                   cco;
    application/x-java-archive-diff       jardiff;
    application/x-java-jnlp-file          jnlp;
    application/x-makeself                run;
    application/x-perl                    pl pm;
    application/x-pilot                   prc pdb;
    application/x-rar-compressed          rar;
    application/x-redhat-package-manager  rpm;
    application/x-sea                     sea;
    application/x-shockwave-flash         swf;
    application/x-stuffit                 sit;
    application/x-tcl                     tcl tk;
    application/x-x509-ca-cert            der pem crt;
    application/x-xpinstall               xpi;
    application/xhtml+xml                 xhtml;
    application/zip                       zip;

    application/octet-stream              bin exe dll;
    application/octet-stream              deb;
    application/octet-stream              dmg;
    application/octet-stream              eot;
    application/octet-stream              iso img;
    application/octet-stream              msi msp msm;

    audio/midi                            mid midi kar;
    audio/mpeg                            mp3;
    audio/ogg                             ogg;
    audio/x-m4a                           m4a;
    audio/x-realaudio                     ra;

    video/3gpp                            3gpp 3gp;
    video/mp4                             mp4;
    video/mpeg                            mpeg mpg;
    video/quicktime                       mov;
    video/webm                            webm;
    video/x-flv                           flv;
    video/x-m4v                           m4v;
    video/x-mng                           mng;
    video/x-ms-asf                        asx asf;
    video/x-ms-wmv                        wmv;
    video/x-msvideo                       avi;
}

使用

如果要加入一个网络访问路径，可以如下操作

1.在nginx.conf下增加一个upstream
upstream vip.xx.com{ 
      server 10.0.0.77 weight=5; 
      server 10.0.0.88 weight=10; 
}
2.在vhost新建一个文件名为vip.xx.com.conf
3.拷贝其他vhost的内容进入到该文件，修改如下图所示。server_name为子域名，proxy_pass为代理的虚拟主机，如user-vip.xx.com。

NGINX反向代理

nginx版本至少1.9的版本，版本太低没有stream这个功能。可以参考这篇文章。
https://blog.csdn.net/jijiuqiu6646/article/details/78675891

注意将stream定义在http字段之外。

参考示例如下。

stream {
	    #listen 3306
        upstream tcp_proxy_name13306{
                server 210.74.41.123:3306 max_fails=3 fail_timeout=30s;
        }

        #tcp_proxy_name13306
        server {
                listen 13306;
                proxy_connect_timeout 3s;
                proxy_timeout 3s;
                proxy_pass tcp_proxy_name13306;
        }
}

生产配置

生产真正的location中的配置参考比测试环境要多，如下示例。

 #外网进来的流量

location /gateway/ {
			proxy_buffer_size  128k;
			proxy_buffers      32 32k;
			proxy_busy_buffers_size 128k;
			add_header X-Static transfer;
			proxy_redirect off;
			proxy_set_header Host $host;
			proxy_set_header X-Real-IP  $remote_addr;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_set_header   Cookie $http_cookie;
			proxy_pass http://gateway/;
	}

# 可能会增加lua脚本控制黑名单ip。如下
    server {
        listen       8080;
        server_name  user-vip.xx.com;
        include blacklistClientIp.conf; #增加黑名单配置
    }

http模块中的配置

http {
 
    add_header Access-Control-Allow-Origin *;
    add_header Access-Control-Allow-Credentials true;
    add_header Access-Control-Allow-Methods GET,POST,PUT;
    add_header Access-Control-Allow-Headers accept,content-type,x-iamservice-appid,x-iamservice-appkey;
    include       mime.types;
    default_type  application/octet-stream;
    
    client_max_body_size 20M;
    client_body_buffer_size 128k;
	
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent"  realIp  "$http_x_forwarded_for"';

    access_log  logs/access.log  main;

  

    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
	
	gzip on;
    gzip_types
            text/xml application/xml application/atom+xml application/rss+xml application/xhtml+xml image/svg+xml
            text/javascript application/javascript application/x-javascript
            text/x-json application/json application/x-web-app-manifest+json
            text/css text/plain text/x-component
            font/opentype application/x-font-ttf application/vnd.ms-fontobject;
    #keepalive_timeout  0;
    keepalive_timeout  65;

	
	map $http_x_forwarded_for  $clientRealIp {
			""      $remote_addr;
			~^(?P<firstAddr>[0-9\.]+),?.*$  $firstAddr;
	}
}