跳至主要內容

Nginx 配置优化

Blogger2024/7/1大约 4 分钟CI/CDNginx负载均衡反向代理

Nginx 配置优化

概述

Nginx 是一个高性能的 HTTP 和反向代理服务器，广泛用于负载均衡、静态资源服务和 SSL 终端。

1. 安装与基础配置

1.1 安装 Nginx（Ubuntu）

# 更新系统
sudo apt-get update

# 安装 Nginx
sudo apt-get install -y nginx

# 启动服务
sudo systemctl start nginx
sudo systemctl enable nginx

# 验证安装
nginx -v

1.2 基础配置文件

# /etc/nginx/nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

http {
    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # 日志配置
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    # 启用 gzip 压缩
    gzip on;
    gzip_types text/plain text/css application/json application/javascript;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

2. 反向代理配置

2.1 基本反向代理

# /etc/nginx/sites-available/my-app
server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://localhost:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

2.2 负载均衡

http {
    # 定义上游服务器组
    upstream backend {
        server backend1.example.com:8080 weight=3;
        server backend2.example.com:8080 weight=2;
        server backend3.example.com:8080 weight=1;
        
        # 健康检查
        keepalive 64;
    }

    server {
        listen 80;
        server_name example.com;

        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
    }
}

2.3 负载均衡算法

算法说明
round_robin轮询（默认）
least_conn最少连接数
ip_hash基于客户端IP哈希
fair响应时间优先
url_hash基于URL哈希
upstream backend {
    ip_hash;  # 使用 IP 哈希算法
    server backend1.example.com;
    server backend2.example.com;
}

3. SSL/TLS 配置

3.1 配置 HTTPS

server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    # SSL 证书
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;

    # SSL 优化
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    location / {
        proxy_pass http://localhost:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

3.2 使用 Let's Encrypt

# 安装 Certbot
sudo apt-get install -y certbot python3-certbot-nginx

# 获取证书
sudo certbot --nginx -d example.com -d www.example.com

# 自动更新证书
sudo certbot renew --dry-run

4. 静态资源优化

4.1 静态文件服务

server {
    listen 80;
    server_name static.example.com;
    root /var/www/static;

    # 图片缓存 30天
    location ~* \.(jpg|jpeg|png|gif|ico)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    # CSS/JS 缓存 7天
    location ~* \.(css|js)$ {
        expires 7d;
        add_header Cache-Control "public, immutable";
    }

    # 禁止访问隐藏文件
    location ~ /\. {
        deny all;
    }
}

4.2 Gzip 压缩

http {
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types 
        text/plain
        text/css
        text/xml
        text/javascript
        application/javascript
        application/xml+rss
        application/json;
    
    # Brotli 压缩（需要安装模块）
    brotli on;
    brotli_types text/plain text/css application/json application/javascript;
}

5. 安全配置

5.1 限制请求

server {
    # 限制请求速率
    limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;

    location / {
        limit_req zone=one burst=5;
        proxy_pass http://localhost:5000;
    }

    # 限制请求大小
    client_max_body_size 10M;

    # 禁止访问敏感目录
    location ~ /\.git {
        deny all;
    }

    # 安全响应头
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";
    add_header X-XSS-Protection "1; mode=block";
}

5.2 访问控制

# 允许特定 IP 访问
location /admin {
    allow 192.168.1.0/24;
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://localhost:5000;
}

# 基本认证
location /api {
    auth_basic "Restricted Area";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://localhost:5000;
}
# 创建密码文件
htpasswd -c /etc/nginx/.htpasswd username

6. 性能优化

6.1 Worker 进程配置

user www-data;
worker_processes auto;  # 自动设置为 CPU 核心数
worker_cpu_affinity auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 10240;
    use epoll;
    multi_accept on;
}

6.2 连接优化

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    
    keepalive_timeout 65;
    keepalive_requests 100;
    
    client_body_buffer_size 128k;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 4k;
}

6.3 缓存配置

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=10g 
                 inactive=60m use_temp_path=off;

server {
    location / {
        proxy_cache my_cache;
        proxy_cache_valid 200 302 10m;
        proxy_cache_valid 404 1m;
        proxy_pass http://localhost:5000;
    }
}

7. 日志配置

7.1 自定义日志格式

http {
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    
    access_log /var/log/nginx/access.log main;
    error_log /var/log/nginx/error.log;
}

7.2 按域名分离日志

server {
    listen 80;
    server_name example.com;
    
    access_log /var/log/nginx/example.com.access.log main;
    error_log /var/log/nginx/example.com.error.log;
    
    location / {
        proxy_pass http://localhost:5000;
    }
}

8. 状态监控

8.1 开启状态页面

server {
    listen 80;
    server_name status.example.com;

    location /nginx_status {
        stub_status on;
        access_log off;
        allow 192.168.1.0/24;
        deny all;
    }
}

8.2 状态页面输出

Active connections: 10 
server accepts handled requests
 1000 1000 5000 
Reading: 1 Writing: 2 Waiting: 7

9. 虚拟主机配置

9.1 多域名配置

server {
    listen 80;
    server_name example.com www.example.com;
    
    location / {
        proxy_pass http://localhost:5000;
    }
}

server {
    listen 80;
    server_name api.example.com;
    
    location / {
        proxy_pass http://localhost:5001;
    }
}

server {
    listen 80;
    server_name static.example.com;
    root /var/www/static;
}

10. 故障排除

10.1 检查配置

# 检查配置文件语法
nginx -t

# 重新加载配置
nginx -s reload

# 查看日志
tail -f /var/log/nginx/error.log

10.2 常见问题

问题解决方案
403 Forbidden检查文件权限和目录索引配置
502 Bad Gateway检查后端服务是否正常运行
SSL 证书问题检查证书路径和权限
连接超时调整 proxy_timeout 配置

总结

Nginx 是一个功能强大的 Web 服务器，通过合理配置可以实现高性能、高可用的服务架构。掌握 Nginx 配置是运维工程师的必备技能。

作者：Blogger
日期：2024年7月1日

最近更新:
贡献者: user
默认页脚
Copyright © 2026