ToB企服应用市场:ToB评测及商务社交产业平台

标题: Nginx 安装配置 [打印本页]
作者: 渣渣兔    时间: 2022-10-12 22:52
标题: Nginx 安装配置
Nginx安装配置详解、Nginx配置https反向代理示例
Nginx 安装

软硬件环境：CentOS 7.6_64位
安装依赖环境
  1. yum -y install make zlib zlib-devel gcc-c++ libtool openssl openssl-devel pcre pcre-devel
复制代码
查看pcre版本
  1. [root@yaenli pcre]# pcre-config --version
复制代码
安装Nginx

Nginx 配置

使用NGINXConfig完成配置工作。
NGINXConfig是一个在线的可视化的Nginx配置工具，地址：NGINXConfig | DigitalOcean
使用配置方法：
https的反向代理配置示例

单应用的https反向代理，采用模块化配置方法：Nginx配置示例
示例的具体配置文件内容如下：
  1. # Generated by nginxconfig.io
  2. # See nginxconfig.txt for the configuration share link
  4. user                 root;
  5. pid                  /run/nginx.pid;
  6. worker_processes     auto;
  7. worker_rlimit_nofile 65535;
  9. # Load modules
  10. include              /usr/local/nginx/conf/modules-enabled/*.conf;
  12. events {
  13.     multi_accept       on;
  14.     worker_connections 65535;
  15. }
  17. http {
  18.     charset                utf-8;
  19.     sendfile               on;
  20.     tcp_nopush             on;
  21.     tcp_nodelay            on;
  22.     server_tokens          off;
  23.     log_not_found          off;
  24.     types_hash_max_size    2048;
  25.     types_hash_bucket_size 64;
  26.     client_max_body_size   16M;
  28.     # MIME
  29.     include                mime.types;
  30.     default_type           application/octet-stream;
  32.     # Logging
  33.     access_log             logs/access.log;
  34.     error_log              logs/error.log warn;
  36.     # SSL
  37.     ssl_session_timeout    1d;
  38.     ssl_session_cache      shared:SSL:10m;
  39.     ssl_session_tickets    off;
  41.     # Diffie-Hellman parameter for DHE ciphersuites
  42.     ssl_dhparam            /usr/local/nginx/conf/dhparam.pem;
  44.     # Mozilla Intermediate configuration
  45.     ssl_protocols          TLSv1.2 TLSv1.3;
  46.     ssl_ciphers            ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  48.     # OCSP Stapling
  49.     ssl_stapling           on;
  50.     ssl_stapling_verify    on;
  51.     resolver               1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
  52.     resolver_timeout       2s;
  54.     # Connection header for WebSocket reverse proxy
  55.     map $http_upgrade $connection_upgrade {
  56.         default upgrade;
  57.         ""      close;
  58.     }
  60.     map $remote_addr $proxy_forwarded_elem {
  62.         # IPv4 addresses can be sent as-is
  63.         ~^[0-9.]+$        "for=$remote_addr";
  65.         # IPv6 addresses need to be bracketed and quoted
  66.         ~^[0-9A-Fa-f:.]+$ "for="[$remote_addr]"";
  68.         # Unix domain socket names cannot be represented in RFC 7239 syntax
  69.         default           "for=unknown";
  70.     }
  72.     map $http_forwarded $proxy_add_forwarded {
  74.         # If the incoming Forwarded header is syntactically valid, append to it
  75.         "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
  77.         # Otherwise, replace it
  78.         default "$proxy_forwarded_elem";
  79.     }
  81.     # Load configs
  82.     include /usr/local/nginx/conf/conf.d/*.conf;
  83.     include /usr/local/nginx/conf/sites-enabled/*;
  84. }
复制代码
  1. server {
  2.     listen              443 ssl;
  3.     listen              [::]:443 ssl;
  4.     server_name         example.com;
  6.     # SSL
  7.     ssl_certificate     /usr/local/nginx/conf/ssl/example.com.crt;
  8.     ssl_certificate_key /usr/local/nginx/conf/ssl/example.com.key;
  10.     # security
  11.     include             nginxconfig.io/security.conf;
  13.     # logging
  14.     access_log          logs/example.com.access.log;
  15.     error_log           logs/example.com.error.log warn;
  17.     # reverse proxy
  18.     location / {
  19.         proxy_pass            http://127.0.0.1:3000;
  20.         proxy_set_header Host $host;
  21.         include               nginxconfig.io/proxy.conf;
  22.     }
  24.     # additional config
  25.     include nginxconfig.io/general.conf;
  26. }
  28. # HTTP redirect
  29. server {
  30.     listen      80;
  31.     listen      [::]:80;
  32.     server_name example.com;
  33.     return      301 https://example.com$request_uri;
  34. }
复制代码
  1. # security headers
  2. add_header X-XSS-Protection        "1; mode=block" always;
  3. add_header X-Content-Type-Options  "nosniff" always;
  4. add_header Referrer-Policy         "no-referrer-when-downgrade" always;
  5. add_header Content-Security-Policy "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
  6. add_header Permissions-Policy      "interest-cohort=()" always;
  8. # . files
  9. location ~ /\.(?!well-known) {
  10.     deny all;
  11. }
复制代码
  1. # favicon.ico
  2. location = /favicon.ico {
  3.     log_not_found off;
  4.     access_log    off;
  5. }
  7. # robots.txt
  8. location = /robots.txt {
  9.     log_not_found off;
  10.     access_log    off;
  11. }
  13. # gzip
  14. gzip            on;
  15. gzip_vary       on;
  16. gzip_proxied    any;
  17. gzip_comp_level 6;
  18. gzip_types      text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
复制代码
  1. proxy_http_version                 1.1;
  2. proxy_cache_bypass                 $http_upgrade;
  4. # Proxy SSL
  5. proxy_ssl_server_name              on;
  7. # Proxy headers
  8. proxy_set_header Upgrade           $http_upgrade;
  9. proxy_set_header Connection        $connection_upgrade;
  10. proxy_set_header X-Real-IP         $remote_addr;
  11. proxy_set_header Forwarded         $proxy_add_forwarded;
  12. proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
  13. proxy_set_header X-Forwarded-Proto $scheme;
  14. proxy_set_header X-Forwarded-Host  $host;
  15. proxy_set_header X-Forwarded-Port  $server_port;
  17. # Proxy timeouts
  18. proxy_connect_timeout              60s;
  19. proxy_send_timeout                 60s;
  20. proxy_read_timeout                 60s;
复制代码
  1. https://www.digitalocean.com/community/tools/nginx?domains.0.server.documentRoot=%2Fnccloud&domains.0.server.redirectSubdomains=false&domains.0.https.http2=false&domains.0.https.hsts=false&domains.0.https.certType=custom&domains.0.php.php=false&domains.0.reverseProxy.reverseProxy=true&domains.0.routing.root=false&domains.0.routing.index=index.html&domains.0.routing.fallbackHtml=true&domains.0.logging.accessLog=true&domains.0.logging.errorLog=true&global.logging.accessLog=logs%2Faccess.log&global.logging.errorLog=logs%2Ferror.log%20warn&global.nginx.nginxConfigDirectory=%2Fusr%2Flocal%2Fnginx%2Fconf%2F&global.nginx.user=root&global.tools.symlinkVhost=false&global.app.lang=zhCN
复制代码
检查配置文件正确性
  1. [root@yaenli conf]# /usr/local/nginx/sbin/nginx -t
复制代码
Nginx 启停
  1. /usr/local/nginx/sbin/nginx                           # 启动 Nginx
  2. /usr/local/nginx/sbin/nginx -s reload            # 重新载入配置文件
  3. /usr/local/nginx/sbin/nginx -s reopen            # 重启 Nginx
  4. /usr/local/nginx/sbin/nginx -s stop              # 停止 Nginx
复制代码
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！



欢迎光临 ToB企服应用市场:ToB评测及商务社交产业平台 (https://dis.qidao123.com/) Powered by Discuz! X3.4