Nginx 部署文档

===== 安装

apt update
apt install -y libpcre3-dev libssl-dev zlib1g-dev

take /work/soft
wget http://common-software.oss-cn-hangzhou.aliyuncs.com/nginx/nginx-1.16.0.tar.gz
tar zxvf nginx-1.16.0.tar.gz
ln -s nginx-1.16.0 nginx
cd /work/soft/nginx

./configure \
--with-stream \
--with-stream_realip_module \
--with-stream_ssl_module \
--with-stream_ssl_preread_module

make -j2
make install

===== 相关目录
nginx path prefix: "/usr/local/nginx"
nginx binary file: "/usr/local/nginx/sbin/nginx"
nginx modules path: "/usr/local/nginx/modules"
nginx configuration prefix: "/usr/local/nginx/conf"
nginx configuration file: "/usr/local/nginx/conf/nginx.conf"
nginx pid file: "/usr/local/nginx/logs/nginx.pid"
nginx error log file: "/usr/local/nginx/logs/error.log"
nginx http access log file: "/usr/local/nginx/logs/access.log"
nginx http client request body temporary files: "client_body_temp"
nginx http proxy temporary files: "proxy_temp"
nginx http fastcgi temporary files: "fastcgi_temp"
nginx http uwsgi temporary files: "uwsgi_temp"
nginx http scgi temporary files: "scgi_temp"

===== 确认软件安装成功
/usr/local/nginx/sbin/nginx -V

===== 更改配置文件
vi /usr/local/nginx/conf/nginx.conf

=======================================

daemon off;
user root;
worker_processes auto;
pid /run/nginx.pid;

worker_rlimit_nofile 655350;

events {
worker_connections 655350;
multi_accept on;
}
include /usr/local/nginx/conf/xcoin_pool.conf;
========================================

vi /usr/local/nginx/conf/xcoin_pool.conf

UDS方式：

stream {     server {         listen 1800;         proxy_pass sserver_uds;         proxy_protocol on;         tcp_nodelay on;     }     server {         listen 5222 ssl;         proxy_pass sserver_uds;         proxy_protocol on;         tcp_nodelay on;         ssl_certificate       /work/pool/zec/poolin.cert;         ssl_certificate_key   /work/pool/zec/poolin.pkey;         ssl_handshake_timeout 30s;         ssl_session_timeout 1d;         ssl_session_cache shared:SSL:50m;         ssl_session_tickets off;         ssl_protocols TLSv1.2 TLSv1.3;         ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256;         ssl_prefer_server_ciphers on;     }     upstream sserver_uds {         server unix:/work/pool/zec/uds.socket; #        server unix:/work/pool/zec_ss01/uds.socket; #        server unix:/work/pool/zec_ss02/uds.socket; #        server unix:/work/pool/zec_ss03/uds.socket; #        server unix:/work/pool/zec_ss04/uds.socket; #        server unix:/work/pool/zec_ss05/uds.socket; #        server unix:/work/pool/zec_ss06/uds.socket; #        server unix:/work/pool/zec_ss07/uds.socket; #        server unix:/work/pool/zec_ss08/uds.socket;     } }

TCP方式：

stream {     server {         listen 5222 ssl;         proxy_pass sserver_tcp;         proxy_protocol on;         tcp_nodelay on;         ssl_certificate       /work/pool/poolin.cert;         ssl_certificate_key   /work/pool/poolin.pkey;         ssl_handshake_timeout 30s;         ssl_session_timeout 1d;         ssl_session_cache shared:SSL:50m;         ssl_session_tickets off;         ssl_protocols TLSv1.2 TLSv1.3;         ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256;         ssl_prefer_server_ciphers on;     }     upstream sserver_tcp {         server 172.17.0.1:1800;          } }

添加证书：

cd /work/pool

vim poolin.cert

========================

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

========================

vim poolin.pkey

=========================

-----BEGIN RSA PRIVATE KEY-----

-----END RSA PRIVATE KEY-----

=========================

证书添加执行权限：

chmod +x poolin.cert poolin.pkey

创建errorlog文件

mkdir -p /work/soft/nginx/logs/ && touch /work/soft/nginx/logs/error.log

nginx 配置文件检测命令

/usr/local/nginx/sbin/nginx -p /work/soft/nginx -c /usr/local/nginx/conf/nginx.conf -t

===== 配置 supervisor
vim /etc/supervisor/conf.d/nginx.conf

[program:nginx]
directory=/work/soft/nginx
command=/usr/local/nginx/sbin/nginx
autostart=true
autorestart=true
startsecs=3
startretries=20

- 启动supervisor `supervisorctl`
- 重新读取配置文件`reread`
- 更新配置文件`update`
- 查看状态`status`

 -查看端口状态

  netstat -anput | grep 5222

检测

openssl s_client -tls1_2 -showcerts -connect IP:5222