nginx配置文件主要分为四个部分:
main(全局设置)
http ( )
upstream(负载均衡服务器设置)
server(主机设置)
location(URL匹配特点位置的设置)
server部分的指令主要用于指定主机和端口,upstream指令主要用于负载均衡和设置一系列的后端服务器,location部分用于匹配网页位置位置。
关系如下:
server继承main,location继承server,upstream即不会继承其他设置也不会被继承。
nginx在运行时与具体业务功能(比如http服务或者email服务代理)无关的一些参数,比如工作进程数,运行的身份等。
- user www www;
- worker_processes 4;
- worker_cpu_affinity 0001 0010 0100 1000;
- error_log /data/logs/nginx_error.log crit;
- pid /usr/local/webserver/nginx/nginx.pid;
- worker_rlimit_nofile 65535;
-
- events{
- use epoll;
- worker_connections 65536;
- }
-
- http
- {
- include mime.types;
- default_type application/octet-stream;
- #charset gb2312;
- }
-
- server_names_hash_bucket_size 128;
- client_header_buffer_size 32k;
- large_client_header_buffers 4 128k;
- client_max_body_size 10m;
- client_body_buffer_size 128k;
- sendfile on ;
- tcp_nopush on;
- tcp_nodelay on;
- keepalive_timeout 65 :
- client_body_timeout 60s;
- send_timeout 60s;
-
FastCGI相关参数是为了改善网站的性能:减少资源占用,提高访问速度。下面参数看字面意思都能理解。
- fastcgi_connect_timeout 300;
- fastcgi_send_timeout 300;
- fastcgi_read_timeout 300;
- fastcgi_buffer_size 64k;
- fastcgi_buffers 4 64k;
- fastcgi_busy_buffers_size 128k;
- fastcgi_temp_file_write_size 128k;
- fastcgi_cache TEST;
- fastcgi_cache_path /usr/local/nginx/fastcgi_cache levels=1:2 keys_zone=TEST:10m inactive=5m;
- fastcgi_cache_valid 200 302 1h;
- fastcgi_cache_valid 301 1d;
- fastcgi_cache_valid any 1m;
-
- gzip on;
- gzip_min_length 1k;
- gzip_buffers 4 16k;
- gzip_http_version 1.1;
- gzip_comp_level 6;
- gzip_types text/html text/plain text/css text/javascript application/json application/javascript application/x-javascript application/xml;
- gzip_vary on;
-
http服务上支持若干虚拟主机。每个虚拟主机一个对应的server配置项,配置项里面包含该虚拟主机相关的配置。在提供mail服务的代理时,也可以建立若干server。每个server通过监听地址或端口来区分。
- server
- {
- listen 80 default;
- server_name _;
- index index.html index.htm index.php;
- root /data/htdocs/www;
- #server_name_in_redirect off;
- location ~ .*\.(php|php5)?$
- {
- #fastcgi_pass unix:/tmp/php-cgi.sock;
- fastcgi_pass 127.0.0.1:9000;
- fastcgi_index index.php;
- include fcgi.conf;
- }
- location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
- {
- expires 30d;
- }
- location ~ .*\.(js|css)?$
- {
- expires 1h;
- }
- }
-
关于location匹配规则的写法,参考使用nginx做负载均衡
proxy_pass http:/backend
请求转向backend定义的服务器列表,即反向代理,对应upstream负载均衡器。也可以proxy_pass http://ip:port。
- proxy_redirect off;
- proxy_set_header Host $host;
- proxy_set_header X-Real-IP $remote_addr;
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
这四个暂且这样设,如果深究的话,请参考使用nginx做负载均衡。
Nginx 的访问控制模块默认就会安装,而且写法也非常简单,可以分别有多个allow,deny,允许或禁止某个ip或ip段访问,依次满足任何一个规则就停止往下匹配。如:
- location /nginx-status {
- stub_status on;
- access_log off;
- # auth_basic "NginxStatus";
- # auth_basic_user_file /usr/local/nginx-1.6/htpasswd;
- allow 192.168.10.100;
- allow 172.29.73.0/24;
- deny all;
- }
-
我们也常用 httpd-devel 工具的 htpasswd 来为访问的路径设置登录密码:
- # htpasswd -c htpasswd admin
- New passwd:
- Re-type new password:
- Adding password for user admin
- # htpasswd htpasswd admin //修改admin密码
- # htpasswd htpasswd sean //多添加一个认证用户
-
这样就生成了默认使用CRYPT加密的密码文件。打开上面nginx-status的两行注释,重启nginx生效。
Nginx默认是不允许列出整个目录的。如需此功能,打开nginx.conf文件,在location,server 或 http段中加入如下参数:
- location /images {
- root /var/www/nginx-default/images;
- autoindex on;
- autoindex_exact_size off;
- autoindex_localtime on;
- }
-
- user www www;
- worker_processes 2;
- error_log logs/error.log;
- #error_log logs/error.log notice;
- #error_log logs/error.log info;
- pid logs/nginx.pid;
- events {
- use epoll;
- worker_connections 2048;
- }
- http {
- include mime.types;
- default_type application/octet-stream;
- #log_format main '$remote_addr - $remote_user [$time_local] "$request" '
- # '$status $body_bytes_sent "$http_referer" '
- # '"$http_user_agent" "$http_x_forwarded_for"';
- #access_log logs/access.log main;
- sendfile on;
- # tcp_nopush on;
- keepalive_timeout 65;
- # gzip压缩功能设置
- gzip on;
- gzip_min_length 1k;
- gzip_buffers 4 16k;
- gzip_http_version 1.1;
- gzip_comp_level 6;
- gzip_types text/html text/plain text/css text/javascript application/json application/javascript application/x-javascript application/xml;
- gzip_vary on;
-
- # http_proxy 设置
- client_max_body_size 10m;
- client_body_buffer_size 128k;
- proxy_connect_timeout 75;
- proxy_send_timeout 75;
- proxy_read_timeout 75;
- proxy_buffer_size 4k;
- proxy_buffers 4 32k;
- proxy_busy_buffers_size 64k;
- proxy_temp_file_write_size 64k;
- proxy_temp_path /usr/local/nginx/proxy_temp 1 2;
- # 设定负载均衡后台服务器列表
- upstream backend {
- #ip_hash;
- server 192.168.10.100:8080 max_fails=2 fail_timeout=30s ;
- server 192.168.10.101:8080 max_fails=2 fail_timeout=30s ;
- }
- # 很重要的虚拟主机配置
- server {
- listen 80;
- server_name itoatest.example.com;
- root /apps/oaapp;
- charset utf-8;
- access_log logs/host.access.log main;
- #对 / 所有做负载均衡+反向代理
- location / {
- root /apps/oaapp;
- index index.jsp index.html index.htm;
- proxy_pass http://backend;
- proxy_redirect off;
- # 后端的Web服务器可以通过X-Forwarded-For获取用户真实IP
- proxy_set_header Host $host;
- proxy_set_header X-Real-IP $remote_addr;
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
- proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-
- }
- #静态文件,nginx自己处理,不去backend请求后端的服务
- location ~* /download/ {
- root /data/app/nginx/downloads;
-
- }
- location ~ .*\.(gif|jpg|jpeg|bmp|png|ico|txt|js|css)$
- {
- root /data/app/nginx/images;
- expires 7d;
- }
- location /nginx_status {
- stub_status on;
- access_log off;
- allow 192.168.10.0/24;
- deny all;
- }
- location ~ ^/(WEB-INF)/ {
- deny all;
- }
- #error_page 404 /404.html;
- # redirect server error pages to the static page /50x.html
- #
- error_page 500 502 503 504 /50x.html;
- location = /50x.html {
- root html;
- }
- }
- ## 其它虚拟主机,server 指令开始
- }
-
如果response header中包含Content-Encoding:gzip则表示开启gzip压缩。
- Connection:keep-alive
- Content-Encoding:gzip
- Content-Type:text/html
- Date:Wed, 29 Mar 2017 10:55:54 GMT
- ETag:W/"58db92af-331a6"
- Last-Modified:Wed, 29 Mar 2017 10:55:43 GMT
- Server:nginx/1.10.3
- Transfer-Encoding:chunked
- Vary:Accept-Encoding