nginx http和https配置

Linux
留言

nginx配置详解

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
##
# 全局配置
##

user www-data;             ## 配置 worker 进程的用户和组
worker_processes auto;     ## 配置 worker 进程启动的数量，建议配置为 CPU 核心数
error_log logs/error.log;  ## 全局错误日志
pid /run/nginx.pid;        ## 设置记录主进程 ID 的文件
worker_rlimit_nofile 8192; ## 配置一个工作进程能够接受并发连接的最大数

##
# 工作模式及连接数上限
##
events {
    # epoll 是多路复用 IO（I/O Multiplexing）中的一种方式，
    # 仅用于 Linux 2.6 以上内核，可以大大提高 Nginx 性能
    use epoll
        
    # 单个后台 worker process 进程的最大并发链接数
    # 并发总数 max_clients = worker_professes * worker_connections
    worker_connections 4096;  ## Defaule: 1024
    # multi_accept on;  ## 指明 worker 进程立刻接受新的连接
}

##
# http 模块
##
http {

    ##
    # Basic Settings
    ##
    
    #sendfile 指令指定 nginx 是否调用 sendfile 函数（zero copy 方式）来输出文件，
    #对于普通应用，必须设为 on,
    #如果用来进行下载等应用磁盘 IO 重负载应用，可设置为 off，
    #以平衡磁盘与网络 I/O 处理速度，降低系统的 uptime.
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;      ## 连接超时时间
    types_hash_max_size 2048;  ## 指定散列类型表的最大大小
    # server_tokens off;

    # server_names_hash_bucket_size 64;  # this seems to be required for some vhosts
    # server_name_in_redirect off;
    
    include /etc/nginx/mime.types;  ## 设定 mine 类型
    default_type application/octet-stream;
   
    # 设定请求缓冲
    client_header_buffer_size    128k; # 指定客户端请求头缓存大小，当请求头大于 1KB 时会用到该项
    large_client_header_buffers  4 128k; # 最大数量和最大客户端请求头的大小
    
    ##
    # SSL Settings
    ##
    
    # 启用所有协议，禁用已废弃的不安全的SSL 2 和SSL 3
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    # 让服务器选择要使用的算法套件
    ssl_prefer_server_ciphers on;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;  ## 访问日志
    error_log /var/log/nginx/error.log;    ## 错误日志

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";
    text/xml application/xml application/xml+rss text/javascript;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;   # 这个文件夹默认是空的
    include /etc/nginx/sites-enabled/*; # 开启的 Server 服务配置

}

##
# mail 模块
##
        
mail {
    # See sample authentication script at:
    # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript

    # auth_http localhost/auth.php;
    # pop3_capabilities "TOP" "USER";
    # imap_capabilities "IMAP4rev1" "UIDPLUS";

    server {
        listen     localhost:110;
        protocol   pop3;
        proxy      on;
    }

    server {
        listen     localhost:143;
        protocol   imap;
        proxy      on;
    }
}

总结来说

1
2
3
4
5
6
main：用于进行nginx全局信息的配置
events：用于nginx工作模式的配置
http：用于进行http协议信息的一些配置
server：用于进行服务器访问信息的配置
location：用于进行访问路由的配置
upstream：用于进行负载均衡的配置

目前使用的一些nginx配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

#user nginx;
worker_processes 2;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
#worker_rlimit_nofile 65535;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
#include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    # include /etc/nginx/conf.d/*.conf;

    # 这段是只http的时候设置的
    #***************************************************************************
    #server {
        #listen       80;
    #server_name localhost;

       # root         /usr/share/nginx/html;

        # Load configuration files for the default server block.
        #include /etc/nginx/default.d/*.conf;

        #location / {
        #proxy_pass http://localhost:8080;
        #proxy_set_header Host $host;
        #proxy_set_header X-Real-IP $remote_addr;
        #proxy_set_header X-Scheme $scheme;
        #proxy_pass_header Server;
        #proxy_redirect on;

        #}

    #}
    #***************************************************************************

    # 这段是只https的时候设置的
    #***************************************************************************
   server {
        listen 80;
        server_name   XXX.XXXX.com;
        return        301 https://$server_name$request_uri;
   }

   server {
        listen 443;
        server_name   XXX.XXXX.com;
        ssl on;
        ssl_certificate   cert/XXX.XXXX.pem;
    ssl_certificate_key  cert/XXX.XXXX.key;
    ssl_session_timeout 5m;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;

    location /{
        proxy_pass  http://localhost:8080;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_set_header X-NginX-Proxy true;
    }
   }
   #****************************************************************************

}