nginx复习
这里写目录标题
- 基础
-
- nginx的特性优点
- 编译安装
- apache select对比nginx epoll
- 三类虚拟主机
-
- ip
- 域名
-
- 域名别名
- 端口
- 访问认证
- 状态信息
- rewrite
- location
- 日志
-
- 错误、访问日志
- nginx自定义访问日志为json格式
- ngx_http_log_module定义日志的最大缓存条目、及活动时长等日志相关配置
- 日志轮询切割
-
- 脚本
- logrotate
- 日志收集
- 优化
-
- 隐藏版本号
- 隐藏软件名
- 更改默认用户
- 进程个数
- 处理事件模型
- 单个进程最大连接数
- 进程最大打开数量
- 防盗链
- fastcgi
- 配置文件详解
-
- nginx try_files指令使用及案例
- ssl
- nginx内置变量与自定义变量使用
- 负载均衡、反向代理
-
- 7层代理及缓存服务
- 7层调度：ngx_http_upstream_module模块
- 调度算法
- nginx模块应用之ngx_http_headers_module
- 负载均衡反向代理配置实战
- 根据URI中的目录实现代理转发
- 根据客户端转发
- 根据文件扩展名
- 负载均衡检测
基础
nginx的特性优点
- 高并发
- 资源消耗少
- 对http反向代理、加速缓存、负载均衡
- 支持专业的缓存
- 支持epoll
编译安装
yum install epel epel-devel
yum insstall openssl openssl-devel
tar -zxvf 包
./configure -h可查看
make -j n && make install && echo &?
apache select对比nginx epoll
三类虚拟主机
建议建立 extra/www_1.conf
ip
server {
listen 192.168.1.1:80;
server_name www.test.com;
location \ {
root html/www_1;
index index.html;
}
}
server {
listen 192.168.1.2:80;
server_name www.test.com;
location \ {
root html/www_2;
index index.html;
}
}
域名
server {
listen80;
server_name www.test.com;
location \ {
root html/www_1;
index index.html;
}
}
server {
listen 80;
server_name www.test2.com;
location \ {
root html/www_2;
index index.html;
}
}
域名别名
server_name www.test2.com test2.com;
端口
server {
listen 80;
server_name www.test.com;
location \ {
root html/www_1;
index index.html;
}
}
server {
listen 81;
server_name www.test.com;
location \ {
root html/www_2;
index index.html;
}
}
访问认证
server {
location \ {
auth_basic "hello";
auth_basic_user_file conf/htpasswd;
}
}
vim passwd
username:password:comment
htpasswd
htpasswd -bc conf/htpasswd test 123456
状态信息
ngx_http_stub_status_module模块
location {
stub_status on;
access_log off;
}
rewrite
ngx_http_rewrite_module模块
server {
listen 80;
server_name 127.0.0.1;
rewrite ^/(.*) http://www.test.com/$1 permanent;
}
location
日志
错误、访问日志
error logs/error.log;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log logs/access.log main;
nginx自定义访问日志为json格式
http {
include mime.types;
default_type application/octet-stream;
charset utf-8;
# 原有日志格式，不能注释或者去掉
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for" $request_time';
# json日志格式
log_format log_json '{"@timestamp": "$time_local", '
'"remote_addr": "$remote_addr", '
'"referer": "$http_referer", '
'"request": "$request", '
'"status": $status, '
'"bytes": $body_bytes_sent, '
'"agent": "$http_user_agent", '
'"x_forwarded": "$http_x_forwarded_for", '
'"up_addr": "$upstream_addr",'
'"up_host": "$upstream_http_host",'
'"up_resp_time": "$upstream_response_time",'
'"request_time": "$request_time"'
' }';
access_log logs/access.log log_json; # 引用日志格式名称
(省略内容)
}
ngx_http_log_module定义日志的最大缓存条目、及活动时长等日志相关配置
access_log log/access_www.log main gzip buffer=32k flush=5s;
日志轮询切割
脚本
在这里插入代码片
logrotate
/usr/local/nginx/logs/access.log {
daily
rotate 15
sharedscripts
postrotate
nginx -s reload &2> /dev/null
endscript
}
logrotate -f /etc/logrotrate.conf
日志收集
zabbix agent
优化
隐藏版本号
server_tokens off;
隐藏软件名
更改默认用户
user nginx
[emerg]：getpwnam（“nginx”）failed 没此用户
进程个数
worker_processes 4;
worker_cpu_affinity 0001 0010 0100 1000; # 指定CPU
处理事件模型
events{
use epoll; # select poll /dev/poll kqueue rtsig
}
单个进程最大连接数
events{
worker_connections 20480;
}
进程最大打开数量
防盗链
ngx_http_referer_module模块
server {
listen 80;
server_name www.test.com;
root html/www;
index index.html index.htm;
access_log logs/www_access.log main;
location ~* ^.+\.(gif|jpg|png|swg|flv|rar|zip)$ {
valid_referers none blocked servernames *.test.org test.org;
if($invalid_referer) {
rewrite ^/ http://www.test.com/img/none.jpg;
}
access_log off;
root html/www;
expires 1d;
break;
}
}
fastcgi
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ \.php$ {
# proxy_pass http://127.0.0.1;
#}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
#location ~ \.php$ {
# root html;
# fastcgi_pass 127.0.0.1:9000;
# fastcgi_index index.php;
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
# include fastcgi_params;
#}
location ~ \.php$ {
66 root html;
67 fastcgi_pass 127.0.0.1:9000;
68 fastcgi_index index.php;
69 fastcgi_param SCRIPT_FILENAME /usr/local/nginx/html$fastcgi_script_name;
70 include fastcgi_params;
71 }
配置文件详解
#user nobody;
worker_processes 1;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
#pid logs/nginx.pid;
events {
worker_connections 1024;
}
http {
include mime.types; # 支持的媒体类型文件
default_type application/octet-stream; # 默认媒体类型
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
#access_log logs/access.log main;
sendfile on; #高效传输
#tcp_nopush on;
#keepalive_timeout 0;
keepalive_timeout 65; # 连接超时
#gzip on; # ngx_http_gzip_module实现对指定类型的资源压缩以节约带宽;
server {
listen 80;
server_name localhost;
#charset koi8-r;
#access_log logs/host.access.log main;
location / {
root html;
index index.html index.htm;
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ \.php$ {
# proxy_pass http://127.0.0.1;
#}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
#location ~ \.php$ {
# root html;
# fastcgi_pass 127.0.0.1:9000;
# fastcgi_index index.php;
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
# include fastcgi_params;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
# another virtual host using mix of IP-, name-, and port-based configuration
#
#server {
# listen 8000;
# listen somename:8080;
# server_name somename alias another.alias;
# location / {
# root html;
# index index.html index.htm;
# }
#}
# HTTPS server
#
#server {
# listen 443 ssl;
# server_name localhost;
# ssl_certificate cert.pem;
# ssl_certificate_key cert.key;
# ssl_session_cache shared:SSL:1m;
# ssl_session_timeout 5m;
# ssl_ciphers HIGH:!aNULL:!MD5;
# ssl_prefer_server_ciphers on;
# location / {
# root html;
# index index.html index.htm;
# }
#}
nginx try_files指令使用及案例
try_files绝对是一个非常有用的指令：你可以使用try_files指令来检查文件是否按照指定的顺序存在。
应该使用try_files代替if指令，因为if指令的效率非常低，因为它对每个请求都进行判断
使用try_files的优点是：只需一个命令就可以立即切换行为，代码也更易读。
try_files指令允许你：
- 检查文件是否存在于预定义列表中
- 检查指定目录中是否存在该文件
- 如果没有找到任何文件，则使用内部重定向
不建议使用
server {
...
root /var/www/example.com;
location /images {
if (-f $request_filename) {
expires 30d;
break;
}
...
}
server {
...
root /var/www/example.com;
location /images {
try_files $uri =404;
...
}
ssl
ngx_http_ssl_module启用ssl功能
nginx -V
配置ssl证书
#user nobody;
worker_processes 1;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
#pid logs/nginx.pid;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
#access_log logs/access.log main;
sendfile on;
#tcp_nopush on;
#keepalive_timeout 0;
keepalive_timeout 65;
#gzip on;
server {
listen 443 default_server ssl ;
server_name www.tiantianboke.com;
ssl_certificate 1_www.tiantianboke.com_bundle.crt;
ssl_certificate_key 2_www.tiantianboke.com.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
#禁止在header中出现服务器版本，防止黑客利用版本漏洞攻击
server_tokens off;
#charset koi8-r;
#access_log logs/host.access.log main;
location / {
root html;
index index.html index.htm;
}
location /api {
proxy_pass http://127.0.0.1:5000;
}
}
#监听80端口,并重定向到443
server{
listen 80;
server_name test.com;
rewrite ^/(.*)$ https://test.com:443/$1 permanent;
}
}
nginx内置变量与自定义变量使用
添加链接描述
负载均衡、反向代理
7层代理及缓存服务
ngx_http_proxy_module模块
7层调度：ngx_http_upstream_module模块
调度算法
nginx模块应用之ngx_http_headers_module
负载均衡反向代理配置实战
upstream www_server_pools {
server 10.0.0.1:80 weight=1;
server 10.0.0.2:80 weight=1;
}
server {
listen 80;
server_name www.test.org;
location / {
proxy_pass http://www_server_pools;
include proxy.conf;
}
}
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_connect_timeout 60;
proxy_send_timeout 60;
proxy_read_timeout 60;
proxy_buffer_size 4k;
根据URI中的目录实现代理转发
1.
upstream static_pools {
server 10.0.0.1:80 weight=1;
}
upstream upload_pools {
server 10.0.0.2:80 weight=1;
}
upstream defalut_pools {
server 10.0.0.3:80 weight=1;
}
location /static/ {
proxy_pass http://static_pools;
include proxy.conf;
}
location /upload/ {
proxy_pass http://upload_pools;
include proxy.conf;
}
location / {
proxy_pass http://defalut_pools;
include proxy.conf;
}
if ($requent_uri ~* "*^/static/(.*)$"){
proxy_pass http://static_pools;
}
if ($requent_uri ~* "*^/upload/(.*)$"){
proxy_pass http://upload_pools;
}
location / {
proxy_pass http://default_pools;
include proxy.conf;
}
根据客户端转发
根据文件扩展名
负载均衡检测
