Nginx 是一款高性能的 Web 服务器和反向代理服务器,广泛应用于互联网领域。以下为nginx在linux平台的简要说明。
配置文件路径
通过 apt 安装的 Nginx,在 Debian 系统上的安装目录通常位于 /etc/nginx
,主要的配置文件为 /etc/nginx/nginx.conf
nginx.conf
配置内容
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
gzip on;
include /etc/nginx/conf.d/*.conf;
}
-
user
: 指定 Nginx 运行的用户,默认为nginx
。在某些情况下,如果网页文件存放在/root
目录下可能会出现无法读取的情况,此时可以将user
改为root
(不建议这么做,建议在其他位置存放网页文件)。 -
worker_processes
: 指定 Nginx 启动的 worker 进程数量,可以设置为auto
自动根据 CPU 核心数来决定。
-
gzip
: 启用 Gzip 压缩。 -
include /etc/nginx/conf.d/*.conf
: 引入网站配置文件。
网站配置示例
Nginx 的网站配置文件通常存放在 /etc/nginx/conf.d/
目录下,如果需要创建一个网站,只需要创建/etc/nginx/conf.d/test.conf即可
静态网页
HTTP
server {
listen 80;
server_name example.com;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
}
监听 80 端口,访问 example.com
时,显示 /usr/share/nginx/html
目录下的静态网页文件,默认访问首页为index.html或index.htm;
HTTPS
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /www/ssl/private.crt;
ssl_certificate_key /www/ssl/private.key;
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000";
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
error_page 497 https://$host$request_uri;
}
替换ssl_certificate和ssl_certificate_key为实际的 SSL 证书和私钥文件的路径
实现HTTP自动跳转HTTPS
server {
listen 80;
server_name example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /www/ssl/private.crt;
ssl_certificate_key /www/ssl/private.key;
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000";
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
error_page 497 https://$host$request_uri;
}
反向代理
当网站不是静态网页,而是由其他应用程序提供web服务时,则需要使用反向代理。如:使用java写了一个网站,运行在8080端口。
HTTP
server {
listen 80;
server_name example.com;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header HOST $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
监听 80 端口,访问 example.com
时,显示 /usr/share/nginx/html
目录下的静态网页文件,默认访问首页为index.html或index.htm;
HTTPS
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /www/ssl/private.crt;
ssl_certificate_key /www/ssl/private.key;
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000";
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header HOST $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
error_page 497 https://$host$request_uri;
}
替换ssl_certificate和ssl_certificate_key为实际的 SSL 证书和私钥文件的路径
实现HTTP自动跳转HTTPS
server {
listen 80;
server_name example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /www/ssl/private.crt;
ssl_certificate_key /www/ssl/private.key;
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000";
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header HOST $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
error_page 497 https://$host$request_uri;
}