NGINX常用配置

#user  nobody;
# CPU核心数-1
worker_processes  3;
# nginx错误日志的目录
#error_log  logs/error.log;
error_log  logs/error.log  notice;
#error_log  logs/error.log  info;
# nginx进程id记录文件路径
pid        logs/nginx.pid;
# 单个进程可打开的最大文件数量
worker_rlimit_nofile 1024;
events {
	# epoll 模型对事件处理进行优化
	use epoll;
	# 客户端最大连接数，建议与单个进程可打开的最大文件数量保持一致
    worker_connections  1024;
}
http {
	#  隐藏nginx版本信息
	server_tokens off;
    include       mime.types;
    default_type  application/octet-stream;
	# 日志格式
	log_format  main  '[time:$request_time s] $remote_addr - $remote_user [$time_local] "$request" '  
			  '$status $body_bytes_sent "$http_referer" '
			  '"$http_user_agent" "$http_x_forwarded_for"'
			  '$upstream_addr $upstream_response_time $request_time $upstream_status '
					  '"$http_range" "$sent_http_content_range"'
					  '"$gzip_ratio"'
					  '"$query_string"' 
	'"-http_refer:$http_referer"';	
	# nginx日志缓存，降低日志IO。
	open_log_file_cache max=10240 inactive=60s valid=1m min_uses=2;
	# 文件上传大小
	client_max_body_size 100m;
	client_header_buffer_size 64k;
	large_client_header_buffers 4 4k;
	# 压缩配置
	gzip on;
	gzip_min_length 2k;
	gzip_buffers 4 16k;
	gzip_comp_level 3;
	gzip_vary on;
	gzip_types text/plain application/x-javascript application/javascript application/css text/css application/xml application/json;
	#	缓存配置
	proxy_connect_timeout 3600s;# Nginx与代理的服务连接超时时间(Nginx请求代理服务)
	proxy_read_timeout 3600s;   # Nginx从代理服务读取文件超时时间
	proxy_send_timeout 3600s;	# Nginx向代理服务写入文件超时时间
	proxy_buffer_size 512k;		# 客户端请求头header大小
	proxy_buffers 64 512k;		# 缓冲区的大小和数量
	proxy_busy_buffers_size 512k;	#
	proxy_temp_file_write_size 512k;	#
	## 当上游服务器的响应过大不能存储到配置的缓冲区域时，Nginx存储临时文件硬盘路径 ，设置为服务器上存在的目录
	proxy_temp_path /usr/local/nginx1.20/cache_temp_path;
	# 注意【cache_one】，后续的location会用到
	proxy_cache_path /usr/local/nginx1.20/cache_path levels=1:2 keys_zone=cache_one:500m inactive=1d max_size=10g use_temp_path=off;
	# proxy_cache_key $host$request_uri;
	client_body_buffer_size 10240k;
	output_buffers 8 64k;
	postpone_output 1460;
	client_header_timeout 120s;
	client_body_timeout 120s;
    sendfile        on;
    keepalive_timeout  65;
	upstream myweb {
		# 会话保持,必须安装sticky模块
		sticky name="hellosticky";
		server 192.168.1.2:8080 max_fails=5  fail_timeout=600s weight=10;
		server 192.168.1.2:8081 max_fails=5  fail_timeout=600s weight=10;
		server 192.168.1.2:8083 max_fails=5  fail_timeout=600s weight=10;
		server 192.168.1.2:8084 max_fails=5  fail_timeout=600s weight=10;
		check interval=3000 rise=2 fall=5 timeout=1000 type=http;
	}
    server {
        listen       80;
        server_name  localhost;
		
		location ~* ^.+\.(jpg|jpeg|gif|png|js|ttf|css|json|)$ {
			proxy_pass http://cwbb;
			proxy_ignore_headers X-Accel-Expires Expires Cache-Control Set-Cookie;
			proxy_cache off;
			proxy_redirect off;
			proxy_set_header X-Real-IP $remote_addr;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_connect_timeout 180;
			proxy_send_timeout 180;
			proxy_read_timeout 180;
			proxy_buffer_size 128k;
			proxy_buffers 4 128k;
			proxy_busy_buffers_size 128k;
			proxy_temp_file_write_size 128k;
			proxy_cache_valid 200 304 302 24h;
			proxy_cache_key   $server_addr$uri$is_args$args;
			add_header Cache-Control no-cache;
		}
		# check模块配置
        location /check_status {
               check_status;
               access_log off;
        }
        # stub模块配置
        location /stub_status {
               stub_status;
               access_log off;
        }
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
		## 根目录访问 ，如果有其他需要代理的路径，则依次增加location即可
		location / {
			## 如果信息中心强制禁止不安全的请求类型，增加如下配置,GET|POST|HEAD是允许的请求类型
			if ($request_method !~ ^(GET|POST|HEAD)$) {
			      return 403 '{"timestamp":"2019-05-30T12:39:03.593","success":false,"errorCode":"403","errorMessage":"不安全的请求类型:$request_method","errorDetail":"不安全的URL：$request_uri","data":null}';
			}
			proxy_pass http://myweb;
			limit_rate 400k;
			limit_rate_after 5m;
			proxy_connect_timeout 1200;
			proxy_send_timeout 1200s;
			proxy_read_timeout 1200s;
			proxy_redirect off;
			proxy_set_header Host $host;
			proxy_set_header X-Real-IP $remote_addr;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			add_header Cache-Control no-cache;
		}
    }
	
	# 本地配置443
	server {
         listen                 443 ssl;
         server_name            myweb.com www.myweb.com;
         ssl_certificate        /etc/letsencrypt/live/muchenx.com-0001/fullchain.pem; # managed by Certbot
         ssl_certificate_key    /etc/letsencrypt/live/muchenx.com-0001/privkey.pem; # managed by Certbot
         include                /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
         ssl_dhparam            /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
         location / {
             root               html;
             index              index.html index.htm;
         }
         error_page             500 502 503 504  /50x.html;
         location = /50x.html {
             root               html;
         }
    }

    #反向代理443
    server {
         listen                  443 ssl;
         server_name             blog.myweb.com;
         ssl_certificate         /etc/letsencrypt/live/myweb.com/fullchain.pem;
         ssl_certificate_key     /etc/letsencrypt/live/myweb.com/privkey.pem;
         ssl_session_cache shared:le_nginx_SSL:10m;
		 ssl_session_timeout 1440m;
		 ssl_session_tickets off;
		 ssl_protocols TLSv1.2 TLSv1.3;
		 ssl_prefer_server_ciphers off;
		 ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
         location / {
             proxy_pass       http://localhost:8848/nacos/;
             proxy_set_header Host $proxy_host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }
    }
}