nginx 配置文件

遇到问题我会更新这个配置文件

nginx.conf

worker_processes  1;
error_log  logs/error.log;
events {
    worker_connections  1024;
}
http {
	include       mime.types;
    default_type  application/octet-stream;
    
    # 开启gzip压缩
    gzip on;
    gzip_static on;
    gzip_min_length 1024;
    gzip_buffers 4 16k;
    gzip_comp_level 2;
    gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript application/x-httpd-php application/vnd.ms-fontobject font/ttf font/opentype font/x-woff image/svg+xml;
    gzip_vary off;
    gzip_disable "MSIE [1-6]\.";
    
    # 当指令值为 on 时，rewrite 的执行结果会以 notice 级别记录到 Nginx 的 error 日志文件中
	rewrite_log on;
	
	# 真实的客户端ip
	map $http_x_forwarded_for $clientRealIp {
	    "" $remote_addr;
	    ~^(?P<firstAddr>[0-9\.]+),?.*$ $firstAddr;
	}
	
	map $http_user_agent $spider {
        ~(.*)(WinHttp|WebZIP|FetchURL|node-superagent|java/|FeedDemon|Jullo|JikeSpider|AskTbFXTV|AhrefsBot|CrawlDaddy|Java|Feedly|Apache-HttpAsyncClient|UniversalFeedParser|ApacheBench|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|YYSpider|DigExt|HttpClient|MJ12bot|heritrix|EasouSpider|Ezooms|BOT/0.1|YandexBot|FlightDeckReports)(.*) 1;
        default 0;
    }
	
	#根据真实的客户端ip hash 负载均衡
	upstream tomcat {
	    #ip_hash;
	    hash $clientRealIp;
	    server 192.168.1.110:8080 weight=1 max_fails=3 fail_timeout=30s;
	    server 192.168.1.110:8081 weight=1 max_fails=3 fail_timeout=30s;
	}
	# 日志格式
	log_format main '{"@timestamp":"$time_iso8601",'
        '"host":"$server_addr",'
        '"clientip":"$remote_addr",'
        '"clientRealIp":"$clientRealIp"'
        '"request":"$request",'
        '"size":$body_bytes_sent,'
        '"referer":"$http_referer",'
        '"agent":"$http_user_agent",'
        '"status":"$status"}';

	

    access_log  logs/access.log  main;
	
	#把爬虫请求单独输出到一个日志文件
	access_log  logs/access_spider.log  main if=$spider;

	server {
        listen       80;
        server_name  localhost;
		
		#禁止Scrapy等工具的抓取
		if ($http_user_agent ~* (Scrapy|Curl|HttpClient)) {
			return 403;
		}
		 
		#禁止指定UA及UA为空的访问
		if ($http_user_agent ~ "WinHttp|WebZIP|FetchURL|node-superagent|java/|
			FeedDemon|Jullo|JikeSpider|Indy Library|Alexa Toolbar|AskTbFXTV|AhrefsBot|
			CrawlDaddy|Java|Feedly|Apache-HttpAsyncClient|UniversalFeedParser|ApacheBench|
			Microsoft URL Control|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|
			lightDeckReports Bot|YYSpider|DigExt|HttpClient|MJ12bot|heritrix|EasouSpider|Ezooms|BOT/0.1|
			YandexBot|FlightDeckReports|Linguee Bot|^$" ) {
			return 403;
		}
		
        location / {
			try_files $uri $uri/ /index.html;
            root   dist;
            index  index.html index.htm;
        }
		
		
		location ~ ^/(api/|admin/|assets/|font/|r/|res/|thirdparty/|u/) {
			# 设置文件上传大小
			client_max_body_size 10m;
			# 设置长连接的时长
			keepalive_timeout 65;
			proxy_set_header HOST $host;
			proxy_set_header X-Real-IP $remote_addr;
			proxy_set_header x-forwarded-proto $scheme;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			client_body_buffer_size 20m;
			proxy_connect_timeout 90;
			proxy_send_timeout 3600s;
			proxy_read_timeout 3600s;
			proxy_buffer_size 4k; #4k
			proxy_buffers 4 32k;
			proxy_busy_buffers_size 64k;
			proxy_temp_file_write_size 64k;
			#限制同一 IP 某段时间的访问量
			#limit_conn one 2;
			#对每个连接限速100k(下载，也就是访问速度)。这如果一个IP允许两个并发连接，那么这个IP就是限速200K
			#limit_rate 100k;
			
			proxy_pass http://tomcat;
			proxy_redirect off;
		}
		
       
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
        
		# 拦截阅读的文件转发校验权限
		location ~ .*/bookdata/.*\.(html|xhtml|xml|png|page|opf)$ {
			internal;
			root /home/reader/view;
			error_page 404 =200 @backend;
		}
		
		# 转发校验权限
		location @backend {
			rewrite /bookdata/(.*)$ /validateRole?path=$1 last;                 
		}
		
		# Nginx rewrite unencodes url（重写时默认会对url编码，这样配置可以避免对url编码）
		# 真实接口：http://192.168.171.185:7070/proxy/%7B1:'qwe',2:''%7D
		# 代理接口：http://localhost/tdmap/proxy/3069/%7B1:'qwe',2:''%7D
		# 因为接口中包含特殊字符，需要保证重写的url为真实接口，也就是不能对url进行编码
		location /tdmap/ {
		 	rewrite ^ $request_uri;
		    rewrite /tdmap/(.*)$ $1 break;
			return 400;
			proxy_pass http://192.168.171.185:7070/$uri;
		}
       
    }
	
    
        
}

nginx 配置参考网站

Nginx配置https

千万别忘了开443端口

我这里使用的是阿里云的免费ssl

server {
   listen 443 ssl;
   server_name www.xxx.com;
   #ssl on;
   ssl_certificate /usr/local/nginx/cert/alivecaren.pem;
   ssl_certificate_key /usr/local/nginx/cert/alivecaren.key;
   ssl_session_timeout 5m;
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
   ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
   ssl_prefer_server_ciphers on;
   
   location / {
            try_files $uri $uri/ /index.html;
            root   /usr/local/nginx/vue;
            index  index.html index.htm;
    }
    location /api/{
            proxy_pass http://localhost:8080/;
    }
}

server {
        listen 80;
        server_name www.xxx.com;
        rewrite ^(.*)$ https://$host$1 permanent;
        location / {
        index index.html index.htm;
        }
}

nginx 代理 tomcat，下面的 tomcat.css 404

location / {
                proxy_pass http://127.0.0.1:8080/;
                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
        }

如果url后面的参数做了转义

location /tdmap/ {
 	rewrite ^ $request_uri;
    rewrite /tdmap/(.*)$ $1 break;
	return 400;
	proxy_pass http://192.168.171.185:7070/$uri;
}