在此写入简单的nginx配置
#user nobody; windows下不指定
worker_processes 1;
error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
pid logs/nginx.pid;
events {
# use epoll; windows下不指定
worker_connections 2048;
}
http {
include mime.types;
default_type application/octet-stream;
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
#access_log logs/access.log main;
sendfile on;
# tcp_nopush on;
keepalive_timeout 65;
# 设定负载均衡后台服务器列表
upstream backend {
ip_hash;
server 127.0.0.1:8080 weight=1; #权重模式,数字越大越容易选中,类似于线程优先级
}
# 很重要的虚拟主机配置
server {
listen 80;
server_name localhost; #无法随意指定名字,指定ip或者域名,可以指定多个用空格隔开
#对 / 所有做负载均衡+反向代理
location / {
proxy_pass http://backend;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_connect_timeout 100;
proxy_send_timeout 100;
proxy_read_timeout 100;
proxy_buffer_size 4k;
proxy_buffers 4 32k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
#root html;
#index index.html index.htm;
}
#静态文件,nginx自己处理,不去backend请求tomcat
location ~* /download/ {
root /apps/oa/fs; #如需使用,按照路径创建文件
}
location ~ .*\.(gif|jpg|jpeg|bmp|png|ico|txt|js|css)$
{
root /apps/oaapp; #如需使用,按照路径创建文件,否则可能网页没有样式
expires 7d;
}
location /nginx_status {
stub_status on;
access_log off;
allow 192.168.0.0/24;
deny all;
}
location ~ ^/(WEB-INF)/ {
deny all;
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
## 其它虚拟主机,server 指令开始
#https
upstream backhttps{
#server 127.0.0.1:8443 weight=1;
server 127.0.0.1:8445 weight=1;
ip_hash;
}
server {
listen 443 ssl;
server_name localhost;
#
ssl_certificate D:/fbs/nginx/openSSL/ssl.crt; #证书
ssl_certificate_key D:/fbs/nginx/openSSL/ssl.key; #密钥
#ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
#ssl on;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto https;
proxy_redirect off;
proxy_connect_timeout 240;
proxy_send_timeout 240;
proxy_read_timeout 240;
# note, there is not SSL here! plain HTTP is used
proxy_pass https://backhttps;
}
}
}
在此只要着重两点,首先是https中的证书和秘钥生成,第二点就是http和https中的ip_hash,如果要做消息交换,那么这里就需要用来维护session的持久性。