Nginx安装配置
参考：菜鸟Nginx 安装配置
一、安装编译工具及库文件
yum -y install make zlib zlib-devel gcc-c++ libtool openssl openssl-devel
二、安装PCRE
- PCRE 作用是让 Nginx 支持 Rewrite 功能。
- 下载并解压PCRE安装包,PCRE下载地址
cd /usr/local/src/
wget https://ftp.pcre.org/pub/pcre/pcre-8.45.tar.gz
tar zxvf pcre-8.45.tar.gz
- 编译安装
cd pcre-8.45
./configure # --help参数可以查看可选配置
make && make install
pcre-config --version
三、安装Nginx
- 下载并解压Nginx，Nginx官网下载地址,选择稳定版(Stable version)下载
cd /usr/local/src/
wget http://nginx.org/download/nginx-1.20.2.tar.gz
tar zxvf nginx-1.20.2.tar.gz
- 编译安装
- 关于configure命令参数说明：http://nginx.org/en/docs/configure.html
cd nginx-1.20.2
# --help参数可以查看可选配置
./configure \
--prefix=/usr/local/nginx \
--with-pcre=/usr/local/src/pcre-8.45 \
--with-http_gzip_static_module \
--with-http_stub_status_module \
--with-http_ssl_module \
--with-http_v2_module \
--with-file-aio \
--with-http_realip_module \
--http-client-body-temp-path=/var/tmp/nginx/client \
--http-proxy-temp-path=/var/tmp/nginx/proxy \
--http-fastcgi-temp-path=/var/tmp/nginx/fastcgi \
--http-uwsgi-temp-path=/var/tmp/nginx/uwsgi \
--http-scgi-temp-path=/var/tmp/nginx/scgi
# 执行上面命令需要在/var/tmp目录下建文件夹
make && make install
/usr/local/nginx/sbin/nginx -v
四、Nginx基本配置
- 创建 Nginx 运行使用的用户 www
groupadd www
useradd -g www www
- 配置nginx.conf，将/usr/local/nginx/conf/nginx.conf替换为以下内容
user www www;
worker_processes 1;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
error_log /usr/local/nginx/logs/nginx_error.log crit;
pid /usr/local/nginx/nginx.pid;
#Specifies the value for maximum file descriptors that can be opened by this process.
worker_rlimit_nofile 65535;
events {
use epoll;
worker_connections 65535;
}
http {
# 自定义固定密钥鉴权:首先使用map定义一个变量，该变量的值取决于token的值
map $http_token $is_valid_token {
default 0; # 默认值设置为0，表示无效或未匹配
123456 1; # 当token值为123456时，设置变量为1
}
include mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log logs/access.log main;
server_names_hash_bucket_size 128;
client_header_buffer_size 32k;
large_client_header_buffers 4 32k;
client_max_body_size 8m;
sendfile on;
tcp_nopush on;
server_tokens off; #隐藏Nginx版本号
#keepalive_timeout 0;
keepalive_timeout 65;
tcp_nodelay on;
fastcgi_connect_timeout 300;
fastcgi_send_timeout 300;
fastcgi_read_timeout 300;
fastcgi_buffer_size 64k;
fastcgi_buffers 4 64k;
fastcgi_busy_buffers_size 128k;
fastcgi_temp_file_write_size 128k;
gzip on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.0;
gzip_comp_level 2;
gzip_types text/plain application/x-javascript text/css application/xml;
gzip_vary on;
server {
listen 80;
server_name localhost;
#location / {
# root html;
# index index.html index.htm;
#}
return 500
}
# 定义一个upstream，地址是需要被代理的IP:port
upstream flink_local_server{
server 127.0.0.1:8081 max_fails=3 fail_timeout=10s weight=10;
}
# #HTTPS server
# 在 `/usr/local/nginx/conf` 目录下，创建`cert`目录，并将下载的证书文件(*.pem)和密钥文件(*.key)放到`cert`目录下
server {
listen 443 ssl; #SSL协议访问端口号为443。此处如未添加ssl，可能会造成Nginx无法启动。
server_name code.dayup.fun; #将localhost修改为您证书绑定的域名，例如：www.example.com。
index index.html index.htm index.php;
root /usr/local/nginx/html;#站点目录
ssl_certificate cert/code.dayup.fun.pem; #将domain name.pem替换成您证书的文件名。
ssl_certificate_key cert/code.dayup.fun.key; #将domain name.key替换成您证书的密钥文件名。
#ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; #使用此加密套件。
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #使用该协议进行配置。
ssl_prefer_server_ciphers on;
location /flink/ { #末尾加斜杠
# 使用if指令检查变量值
#if ($is_valid_token = 0) {
# return 404; # 如果token无效，返回403禁止访问
#}
proxy_pass http://flink_local_server/; #末尾斜杠是关键，用于路径替换：proxy_pass末尾的斜杠/会自动去除请求路径中的/flink前缀
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
#proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
}
}
}
- 检查配置文件nginx.conf的正确性命令：
/usr/local/nginx/sbin/nginx -t
- 启动Nginx
/usr/local/nginx/sbin/nginx
- 其他命令
/usr/local/nginx/sbin/nginx -s reload # 重新载入配置文件
/usr/local/nginx/sbin/nginx -s reopen # 重启 Nginx
/usr/local/nginx/sbin/nginx -s stop # 停止 Nginx
- Red Hat NGINX Init Script
- Save this file as
/etc/init.d/nginx
五、Nginx配置ssl证书
购买免费个人型SSL证书
在SSL证书服务页，下载Nginx证书压缩包文件，压缩包内容如下
- 证书文件：以.pem为后缀或文件类型。
- 密钥文件：以.key为后缀或文件类型。
在
/usr/local/nginx/conf目录下，创建cert目录，并将下载的证书文件和密钥文件放到cert目录下在
nginx.conf文件,http括号中添加这一段虚拟主机配置，并按注释提示修改
#HTTPS server
server {
listen 443 ssl; #SSL协议访问端口号为443。此处如未添加ssl，可能会造成Nginx无法启动。
server_name domain.name; #将localhost修改为您证书绑定的域名，例如：www.example.com。
index index.html index.htm index.php;
root /usr/local/nginx/html;#站点目录
ssl_certificate cert/domain.name.pem; #将domain name.pem替换成您证书的文件名。
ssl_certificate_key cert/domain.name.key; #将domain name.key替换成您证书的密钥文件名。
#ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; #使用此加密套件。
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #使用该协议进行配置。
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html index.htm;
}
}
- 保存nginx.conf文件，并重新载入配置文件
/usr/local/nginx/sbin/nginx -s reload
- 设置HTTP请求自动跳转HTTPS。
在需要跳转的HTTP站点下添加以下rewrite语句，实现HTTP访问自动跳转到HTTPS页面。
server {
listen 80;
server_name localhost; #将localhost修改为您证书绑定的域名，例如：www.example.com。
rewrite ^(.*)$ https://$host$1 permanent; #将所有http请求通过rewrite重定向到https。
location / {
index index.html index.htm;
}
}
- 阿里云官方教程
- 在Nginx/Tengine服务器上安装证书 https://help.aliyun.com/document_detail/98728.html
六、Nginx代理保留请求真实ip
- nginx.conf 修改location
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:8080;
}
- nginx修改默认页面
user www www;
worker_processes 1;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
error_log /usr/local/nginx/logs/nginx_error.log crit;
pid /usr/local/nginx/nginx.pid;
#Specifies the value for maximum file descriptors that can be opened by this process.
worker_rlimit_nofile 65535;
events {
use epoll;
worker_connections 65535;
}
http {
include mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log logs/access.log main;
server_names_hash_bucket_size 128;
client_header_buffer_size 32k;
large_client_header_buffers 4 32k;
client_max_body_size 8m;
sendfile on;
tcp_nopush on;
server_tokens off; #隐藏Nginx版本号
#keepalive_timeout 0;
keepalive_timeout 65;
tcp_nodelay on;
fastcgi_connect_timeout 300;
fastcgi_send_timeout 300;
fastcgi_read_timeout 300;
fastcgi_buffer_size 64k;
fastcgi_buffers 4 64k;
fastcgi_busy_buffers_size 128k;
fastcgi_temp_file_write_size 128k;
gzip on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.0;
gzip_comp_level 2;
gzip_types text/plain application/x-javascript text/css application/xml;
gzip_vary on;
server {
listen 80;
return 500
}
server {
listen 80;
server_name pan.dayup.fun;
location / {
proxy_pass http://127.0.0.1:9001;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}
- 给nginx添加模块 nginx-websocket-module
client_max_body_size 200m;
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
server_name oss.dayup.fun;
##
# Connection header for WebSocket reverse proxy
##
location / {
proxy_pass http://127.0.0.1:9001;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
; location /ws {
; proxy_pass http://127.0.0.1:9001/ws/;
; proxy_set_header Host $http_host;
; proxy_set_header X-Real-IP $remote_addr;
; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
; proxy_set_header X-Forwarded-Proto $scheme;
; proxy_set_header Upgrade $http_upgrade;
; proxy_set_header Connection $connection_upgrade;
; }
}
####https://min.io/docs/minio/linux/integrations/setup-nginx-proxy-with-minio.html
upstream minio {
least_conn;
server minio-01.internal-domain.com;
server minio-02.internal-domain.com;
server minio-03.internal-domain.com;
server minio-04.internal-domain.com;
}
server {
listen 80;
listen [::]:80;
server_name minio.example.net;
# Allow special characters in headers
ignore_invalid_headers off;
# Allow any size file to be uploaded.
# Set to a value such as 1000m; to restrict file size to a specific value
client_max_body_size 0;
# Disable buffering
proxy_buffering off;
proxy_request_buffering off;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_connect_timeout 300;
# Default is HTTP/1, keepalive is only enabled in HTTP/1.1
proxy_http_version 1.1;
proxy_set_header Connection "";
chunked_transfer_encoding off;
proxy_pass https://minio:9000/; # This uses the upstream directive definition to load balance
}
location /minio {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-NginX-Proxy true;
# This is necessary to pass the correct IP to be hashed
real_ip_header X-Real-IP;
proxy_connect_timeout 300;
# To support websockets in MinIO versions released after January 2023
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
chunked_transfer_encoding off;
proxy_pass https://minio:9001/; # This uses the upstream directive definition to load balance and assumes a static Console port of 9001
}
}