在配置之前需要改一下配置文件

    1. // 给vim /usr/local/nginx/conf/nginx.conf配置文件后面加上最后添加一行
    2. [root@lnmp nginx-1.17.8]# vim /usr/local/nginx/conf/nginx.conf
    3. // 把server那一段删了，加入这一句 include vhost/*.conf;
    4. user nobody nobody;
    5. worker_processes 2;
    6. error_log /usr/local/nginx/logs/nginx_error.log crit;
    7. pid /usr/local/nginx/logs/nginx.pid;
    8. worker_rlimit_nofile 51200;
    9. events
    10. {
    11. use epoll;
    12. worker_connections 6000;
    13. }
    14. http
    15. {
    16. include mime.types;
    17. default_type application/octet-stream;
    18. server_names_hash_bucket_size 3526;
    19. server_names_hash_max_size 4096;
    20. log_format combined_realip '$remote_addr $http_x_forwarded_for [$time_local]'
    21. ' $host "$request_uri" $status'
    22. ' "$http_referer" "$http_user_agent"';
    23. sendfile on;
    24. tcp_nopush on;
    25. keepalive_timeout 30;
    26. client_header_timeout 3m;
    27. client_body_timeout 3m;
    28. send_timeout 3m;
    29. connection_pool_size 256;
    30. client_header_buffer_size 1k;
    31. large_client_header_buffers 8 4k;
    32. request_pool_size 4k;
    33. output_buffers 4 32k;
    34. postpone_output 1460;
    35. client_max_body_size 10m;
    36. client_body_buffer_size 256k;
    37. client_body_temp_path /usr/local/nginx/client_body_temp;
    38. proxy_temp_path /usr/local/nginx/proxy_temp;
    39. fastcgi_temp_path /usr/local/nginx/fastcgi_temp;
    40. fastcgi_intercept_errors on;
    41. tcp_nodelay on;
    42. gzip on;
    43. gzip_min_length 1k;
    44. gzip_buffers 4 8k;
    45. gzip_comp_level 5;
    46. gzip_http_version 1.1;
    47. gzip_types text/plain application/x-javascript text/css text/htm
    48. application/xml;
    49. include vhost/*.conf;
    50. }
    51. //创建
    52. [root@lnmp nginx-1.17.8]# mkdir /usr/local/nginx/conf/vhost
    53. //移动
    54. [root@lnmp nginx-1.17.8]# cd /usr/local/nginx/conf/vhost/
    55. //检查
    56. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -t
    57. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    58. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    59. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -s reload

    一.默认虚拟主机

    1. //查看当前所在位置
    2. [root@lnmp vhost]# pwd
    3. /usr/local/nginx/conf/vhost
    4. //配置
    5. [root@lnmp vhost]# vim default.conf 
    6. server
    7. {
    8.     listen 80 default_server;
    9.     server_name aaa.com;
    10.     index index.html index.htmindex.php;
    11.     root /data/nginx/default;
    12. }
    14. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -t
    15. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    16. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    17. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -s reload

    2.测试

    1. [root@lnmp vhost]# mkdir -p /data/nginx/default
    2. [root@lnmp vhost]# echo " default server! " > /data/nginx/default/index.html
    4. # dingyi的为aaa.com
    5. [root@lnmp vhost]# curl -x127.0.0.1:80 bbb.com
    6.  default server! 
    7. [root@lnmp vhost]# curl -x127.0.0.1:80 aaa.com
    8.  default server!

    image.png

    二.用户认证
    1，配置

    1. //移动
    2. [root@lnmp ~]# cd /usr/local/nginx/conf/vhost/
    3. //查看
    4. [root@lnmp vhost]# ls
    5. default.conf
    6. //配置文件
    7. [root@lnmp vhost]# vim test.com.conf
    8. server
    9. {
    10.     listen 80;
    11.     server_name test.com;
    12.     index index.html index.htm index.php;
    13.     root /data/nginx/test.com;
    15.     location /
    16.     {
    17.     auth_basic "Auth";
    18.     auth_basic_user_file /usr/local/nginx/conf/htpasswd;
    19.     }
    20. }
    21. //安装http服务
    22. [root@lnmp vhost]# yum install -y httpd
    23. [root@lnmp vhost]# htpasswd -c /usr/local/nginx/conf/htpasswd bsq
    24. New password: 
    25. Re-type new password: 
    26. Adding password for user bsq
    27. //重启
    28. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -s reload
    29. //创建
    30. [root@lnmp vhost]# mkdir /data/nginx/test.com
    31. //写入
    32. [root@lnmp vhost]# echo "test.com" > /data/nginx/test.com/index.html

    测试

    1. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -t
    2. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    3. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    4. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -s reload

    image.png

    1. //测试
    2. [root@lnmp vhost]# curl -x127.0.0.1:80 test.com
    3. <html>
    4. <head><title>401 Authorization Required</title></head>
    5. <body>
    6. <center><h1>401 Authorization Required</h1></center>
    7. <hr><center>nginx/1.17.8</center>
    8. </body>
    9. </html>
    10. [root@lnmp vhost]# curl -usxs -x127.0.0.1:80 test.com
    11. Enter host password for user 'sxs':
    12. test.comadsadfa

    2，针对目录认证
    一般用来保护后台admin目录
    配置

    1. [root@lnmp vhost]# vim test.com.conf
    2. server
    3. {
    4.     listen 80;
    5.     server_name test.com;
    6.     index index.html index.htm index.php;
    7.     root /data/nginx/test.com;
    9. location  /admin/
    10.     {
    11.         auth_basic              "Auth";
    12.         auth_basic_user_file   /usr/local/nginx/conf/htpasswd;
    13. }
    14. }
    15. [root@lnmp vhost]# mkdir /data/nginx/test.com/admin
    16. [root@lnmp vhost]# echo "asdfadmin" > /data/nginx/test.com/admin/index.html
    17. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -t
    18. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    19. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    20. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -s reload

    测试
    image.png
    3.URL认证
    针对URL做认证，即连接中带了某个关键字
    配置

    1. [root@lnmp vhost]# vim test.com.conf 
    2. server
    3. {
    4.     listen 80;
    5.     server_name test.com;
    6.     index index.html index.htm index.php;
    7.     root /data/nginx/test.com;
    9. location  ~ admin.php
    10.     {
    11.         auth_basic              "Auth";
    12.         auth_basic_user_file   /usr/local/nginx/conf/htpasswd;
    13. }
    14. }

    测试

    1. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -t
    2. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    3. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    4. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -s reload
    5. [root@lnmp vhost]# curl -x127.0.0.1:80 test.com/admin.php
    6. <html>
    7. <head><title>401 Authorization Required</title></head>
    8. <body>
    9. <center><h1>401 Authorization Required</h1></center>
    10. <hr><center>nginx/1.17.8</center>
    11. </body>
    12. </html>

    三.域名重定向
    配置

    1. //编辑配置文件
    2. [root@lnmp vhost]# vim test.com.conf
    3. server
    4. {
    5.     listen 80;
    6.     server_name test.com test2.com test3.com;
    7.     index index.html index.htm index.php;
    8.     root /data/nginx/test.com;
    9.     if ($host != 'test.com' ){
    10.         rewrite ^(.*)$ http://test.com/$1 permanent;
    11. }
    12. }

    测试

    1. //重启
    2. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -t
    3. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    4. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    5. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -s reload
    6. #  状态码301就是域名重定向
    7. [root@lnmp vhost]# curl -x127.0.0.1:80 test2.com 
    8. <html>
    9. <head><title>301 Moved Permanently</title></head>
    10. <body>
    11. <center><h1>301 Moved Permanently</h1></center>
    12. <hr><center>nginx/1.17.8</center>
    13. </body>
    14. </html>
    15. [root@lnmp vhost]# curl -x127.0.0.1:80 test2.com -I
    16. HTTP/1.1 301 Moved Permanently
    17. Server: nginx/1.17.8
    18. Date: Wed, 11 Aug 2021 10:09:23 GMT
    19. Content-Type: text/html
    20. Content-Length: 169
    21. Connection: keep-alive
    22. Location: http://test.com//
    1.      测试在Windows上，需要将两个域名都写入hosts文件，并使用没有缓存的浏览器<br />    ![image.png](https://cdn.nlark.com/yuque/0/2021/png/25425154/1638839727741-da504a7b-4878-4476-a1cb-4904f03c204f.png#clientId=ua52a4247-2ab2-4&crop=0&crop=0&crop=1&crop=1&from=paste&height=284&id=u74dab092&margin=%5Bobject%20Object%5D&name=image.png&originHeight=446&originWidth=944&originalType=binary&ratio=1&rotation=0&showTitle=false&size=83114&status=done&style=none&taskId=u7b1723ac-1723-4752-814c-401c017f8ce&title=&width=601.6666870117188)<br />四.Nginx访问日志<br /> 1. 配置
    1. # nginx 默认格式
    2. [root@lnmp vhost]# grep -A2 log_format /usr/local/nginx/conf/nginx.conf
    3. log_format combined_realip '$remote_addr $http_x_forwarded_for [$time_local]'
    4. ' $host "$request_uri" $status'
    5. ' "$http_referer" "$http_user_agent"';
    6. # combined_realip为日志格式名字。
    7. #$remote_addr为网站的用户的出口IP。
    8. # $http_x_forwarded_for 为代理服务器的IP，如果使用了代理，则会记录IP
    9. # $time_local为当前时间；$host为主机名；
    10. #$request_uri为访问的URL地址
    11. # $status为状态码，$http_referer为referer地址，$http_user_agent为user_agent
    13. [root@lnmp vhost]# vim test.com.conf 
    14. server
    15. {
    16.     listen 80;
    17.     server_name test.com;
    18.     index index.html index.htm index.php;
    19.     root /data/nginx/test.com;
    20.     access_log /tmp/1.log combined_realip;
    21. }

    测试

    2. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -t
    3. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    4. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    5. [root@lnmp vhost]# /usr/local/nginx/sbin/nginx -s reload
    6. [root@lnmp vhost]# curl -x127.0.0.1:80 test.com
    7. test.comadsadfa  
    8. [root@lnmp vhost]# cat /tmp/1.log 
    9. 127.0.0.1 - [11/Aug/2021:20:59:49 +0800] test.com "/" 200 "-" "curl/7.29.0"

    五.日志切割

    1. // 需要自己写一个脚本，
    2. [root@lnmp ~]# vim /usr/local/sbin/nginx_log_rotate.sh 
    3. #!/bin/bash
    4. ##假设nignx的日志存放路径为/data/logs/
    5. d=`date -d "-1 day" +%Y%m%d`
    6. logdir="/tmp/"
    7. nginx_pid="/usr/local/nginx/logs/nginx.pid"
    8. cd $logdir
    9. for log in `ls *.log`
    10. do
    11. mv $log $log-$d
    12. done
    13. /bin/kill -HUP `cat $nginx_pid`
    14. // 权限
    15. [root@lnmp ~]# chmod 755 /usr/local/sbin/nginx_log_rotate.sh
    16. //设定执行时间
    17. [root@lnmp ~]# crontab -e
    18. 0 0 * * * /bin/bash /usr/local/sbin/nginx_log_rotate.sh
    20. [root@lnmp ~]# ls /tmp/
    21. 1.log  1.log-20210811
    23. [root@lnmp ~]# sh -x /usr/local/sbin/nginx_log_rotate.sh 
    24. ++ date -d '-1 day' +%Y%m%d
    25. + d=20210816
    26. + logdir=/tmp/
    27. + nginx_pid=/usr/local/nginx/logs/nginx.pid
    28. + cd /tmp/
    29. ++ ls 1.log
    30. + for log in '`ls *.log`'
    31. + mv 1.log 1.log-20210816
    32. ++ cat /usr/local/nginx/logs/nginx.pid
    33. + /bin/kill -HUP 1606
    34. [root@lnmp ~]# ls /tmp/
    35. 1.log           1.log-20210816  
    36. 1.log-20210811

    六.配置静态切割文件不记录日志并添加日期时间

    1. //修改配置文件
    2. [root@lnmp ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
    3. server
    4. {
    5.     listen 80;
    6.     server_name test.com test1.com test2.com;
    7.     index index.html index.htm index.php;
    8.     root /data/nginx/test.com;
    9.     if ($host != 'test.com' ) {
    10.         rewrite ^/(.*)$ http://test.com/$1 permanent;
    11.     }
    12.     location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
    13.     {
    14.         expires 7d;
    15.         access_log off;
    16.     }
    17.     location ~ .*\.(js|css)$
    18.     {
    19.          expires 12h;
    20.     }
    21.     access_log /tmp/1.log combined_realip;
    22. }
    24. //写入文件重定向
    25. [root@lnmp ~]# echo '111' > /data/nginx/test.com/1.js
    26. [root@lnmp ~]# echo '222' > /data/nginx/test.com/2.jpg
    27. [root@lnmp ~]# touch /data/nginx/test.com/1.jss
    29. [root@lnmp ~]# /usr/local/nginx/sbin/nginx -t
    30. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    31. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    32. [root@lnmp ~]# /usr/local/nginx/sbin/nginx -s reload
    35. [root@lnmp ~]# echo > /tmp/1.log
    36. [root@lnmp ~]# curl -I -x127.0.0.1:80 test.com/1.js
    37. HTTP/1.1 200 OK
    38. Server: nginx/1.17.8
    39. Date: Tue, 17 Aug 2021 10:37:13 GMT
    40. Content-Type: application/javascript
    41. Content-Length: 4
    42. Last-Modified: Tue, 17 Aug 2021 09:46:43 GMT
    43. Connection: keep-alive
    44. ETag: "611b8583-4"
    45. Expires: Tue, 17 Aug 2021 22:37:13 GMT
    46. Cache-Control: max-age=43200
    47. Accept-Ranges: bytes
    49. [root@lnmp ~]# curl -I -x127.0.0.1:80 test.com/2.jpg
    50. HTTP/1.1 200 OK
    51. Server: nginx/1.17.8
    52. Date: Tue, 17 Aug 2021 10:37:23 GMT
    53. Content-Type: image/jpeg
    54. Content-Length: 4
    55. Last-Modified: Tue, 17 Aug 2021 09:47:12 GMT
    56. Connection: keep-alive
    57. ETag: "611b85a0-4"
    58. Expires: Tue, 24 Aug 2021 10:37:23 GMT
    59. Cache-Control: max-age=604800
    60. Accept-Ranges: bytes
    62. [root@lnmp ~]# curl -I -x127.0.0.1:80 test.com/1.jss
    63. HTTP/1.1 200 OK
    64. Server: nginx/1.17.8
    65. Date: Tue, 17 Aug 2021 10:37:32 GMT
    66. Content-Type: application/octet-stream
    67. Content-Length: 0
    68. Last-Modified: Tue, 17 Aug 2021 10:02:04 GMT
    69. Connection: keep-alive
    70. ETag: "611b891c-0"
    71. Accept-Ranges: bytes
    73. [root@lnmp ~]# cat /tmp/1.log
    75. 127.0.0.1 - [17/Aug/2021:18:37:13 +0800] test.com "/1.js" 200 "-" "curl/7.29.0"
    76. 127.0.0.1 - [17/Aug/2021:18:37:32 +0800] test.com "/1.jss" 200 "-" "curl/7.29.0"

    七、Nginx防盗链

    2. //修改配置文件
    3. [root@lnmp ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
    4. server
    5. {
    6.     listen 80;
    7.     server_name test.com test1.com test2.com;
    8.     index index.html index.htm index.php;
    9.     root /data/nginx/test.com;
    10.     if ($host != 'test.com' ) {
    11.         rewrite ^/(.*)$ http://test.com/$1 permanent;
    12.     }
    13.         location ~* ^.+\.(gif|jpg|png|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|bmp|xls)$
    14.         {
    15.          expires 7d;
    16.         valid_referers none blocked server_names  *.test.com ;
    17.          if ($invalid_referer) {
    18.          return 403;
    19.          }
    20.          access_log off;
    21.         }
    22. }
    23. //重启
    24. [root@lnmp ~]# /usr/local/nginx/sbin/nginx -t
    25. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    26. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    27. [root@lnmp ~]# /usr/local/nginx/sbin/nginx -s reload
    29. //测试
    30. [root@lnmp ~]# curl -x127.0.0.1:80 -e "http://aaa.com/1.txt" test.com/2.jpg -I
    31. HTTP/1.1 403 Forbidden
    32. Server: nginx/1.17.8
    33. Date: Tue, 17 Aug 2021 14:08:41 GMT
    34. Content-Type: text/html
    35. Content-Length: 153
    36. Connection: keep-alive
    38. [root@lnmp ~]# curl -x127.0.0.1:80 -e "http://test.com/1.txt" test.com/2.jpg -I
    39. HTTP/1.1 200 OK
    40. Server: nginx/1.17.8
    41. Date: Tue, 17 Aug 2021 14:09:01 GMT
    42. Content-Type: image/jpeg
    43. Content-Length: 4
    44. Last-Modified: Tue, 17 Aug 2021 09:47:12 GMT
    45. Connection: keep-alive
    46. ETag: "611b85a0-4"
    47. Expires: Tue, 24 Aug 2021 14:09:01 GMT
    48. Cache-Control: max-age=604800
    49. Accept-Ranges: bytes

    八、访问控制
    针对目录进行控制访问
    配置

    1. //修改配置文件
    2. [root@lnmp ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
    3. server
    4. {
    5.     listen 80;
    6.     server_name test.com test1.com test2.com;
    7.     index index.html index.htm index.php;
    8.     root /data/nginx/test.com;
    9.     access_log /tmp/1.log combined_realip;
    11. location /admin/ {
    12.         allow 192.168.200.32;
    13.         allow 127.0.0.1;
    14.         deny all;
    15. }
    16. }
    17. //重启
    18. [root@lnmp ~]# /usr/local/nginx/sbin/nginx -t
    19. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    20. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    21. [root@lnmp ~]# /usr/local/nginx/sbin/nginx -s reload

    测试

    1. //echo写入
    2. [root@lnmp ~]# echo "1234" > /data/nginx/test.com/admin/1.html 
    3. // 测试 可以把配置文件改为192.168.200.1允许访问，使用浏览器测试
    4. [root@tomcat ~]# curl test.com/admin/1.html
    5. 1234
    6. [root@tomcat ~]# curl test.com/admin/1.html
    7. <html>
    8. <head><title>403 Forbidden</title></head>
    9. <body>
    10. <center><h1>403 Forbidden</h1></center>
    11. <hr><center>nginx/1.17.8</center>
    12. </body>
    13. </html>

    九、Nginx解析PHP
    配置

    1. //修改配置
    2. [root@lnmp ~]# vim /usr/local/nginx/conf/vhost/test.com.conf
    3. server
    4. {
    5.     listen 80;
    6.     server_name test.com test1.com test2.com;
    7.     index index.html index.htm index.php;
    8.     root /data/nginx/test.com;
    9.     access_log /tmp/1.log combined_realip;
    11. location ~ \.php$ {
    12.     include fastcgi_params;
    13.     fastcgi_pass unix:/tmp/php-fcgi.sock;
    14.     fastcgi_index index.php;
    15.     fastcgi_param SCRIPT_FILENAME /data/nginx/test.com$fastcgi_script_name;
    16.     }
    17. }
    19. [root@lnmp ~]# vim /data/nginx/test.com/3.php 
    20. <?php
    21. phpinfo();
    22. ?>
    24. // fastcgi_pass用来指定php-fpm的地址 路径如果错误，则报错502 
    25. // 路径在这个配置文件中
    26. [root@lnmp ~]# cat /usr/local/php-fpm/etc/php-fpm.conf
    27. [global]
    28. pid = /usr/local/php-fpm/var/run/php-fpm.pid
    29. error_log = /usr/local/php-fpm/var/log/php-fpm.log
    30. [www]
    31. listen = /tmp/php-fcgi.sock
    32. # listen = 127.0.0.1:9000  # 也可以这样配置，但是他们的配置文件要对应。
    33. listen.mode = 666
    34. user = php-fpm
    35. group = php-fpm
    36. pm = dynamic
    37. pm.max_children = 50
    38. pm.start_servers = 20
    39. pm.min_spare_servers = 5
    40. pm.max_spare_servers = 35
    41. pm.max_requests = 500
    42. rlimit_files = 1024
    44. // 注意一下这三行的配置文件与nginx配置文件的关系 
    45. listen = /tmp/php-fcgi.sock
    46. # listen = 127.0.0.1:9000  # 也可以这样配置，但是他们的配置文件要对应。
    47. listen.mode = 666

    测试

    1. [root@lnmp ~]# curl -x127.0.0.1:80 test.com/3.php
    2. <?php
    3. phpinfo();
    4. ?>
    5. [root@lnmp ~]# /usr/local/nginx/sbin/nginx -t
    6. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    7. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    8. [root@lnmp ~]# /usr/local/nginx/sbin/nginx -s reload
    1.         ![image.png](https://cdn.nlark.com/yuque/0/2021/png/25425154/1638866827476-c8bb482f-b029-40e9-856a-2cb4ffbdc4e5.png#clientId=u9624a520-8b89-4&crop=0&crop=0&crop=1&crop=1&from=paste&height=569&id=u44cafebd&margin=%5Bobject%20Object%5D&name=image.png&originHeight=1137&originWidth=1099&originalType=binary&ratio=1&rotation=0&showTitle=false&size=150884&status=done&style=none&taskId=u90117fe8-3758-421a-9483-f425126e0a1&title=&width=549.5)<br />十、Nginx代理<br />一个没有公网IP的服务器提供web服务，可以通过代理是实现。<br />配置
    1. //修改配置文件
    2. [root@lnmp ~]# vim /usr/local/nginx/conf/vhost/proxy.conf
    3. server
    4. {
    5.     listen 80;
    6.     server_name ask.apelearn.com;
    8.     location /
    9.     {
    10.         proxy_pass      http://47.104.7.242/;
    11.         proxy_set_header Host   $host;
    12.         proxy_set_header X-Real-IP      $remote_addr;
    13.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    14.     }
    15. }

    测试

    1. //检验
    2. [root@lnmp ~]# curl -x127.0.0.1:80 ask.apelearn.com/robots.txt
    3. <html>
    4. <head><title>404 Not Found</title></head>
    5. <body>
    6. <center><h1>404 Not Found</h1></center>
    7. <hr><center>nginx/1.17.8</center>
    8. </body>
    9. </html>
    11. [root@lnmp ~]# /usr/local/nginx/sbin/nginx -t
    12. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    13. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    14. [root@lnmp ~]# /usr/local/nginx/sbin/nginx -s reload
    17. [root@lnmp ~]# curl -x127.0.0.1:80 ask.apelearn.com/robots.txt
    18. #
    19. # robots.txt for MiWen
    20. #
    22. User-agent: *
    24. Disallow: /?/admin/
    25. Disallow: /?/people/
    26. Disallow: /?/question/
    27. Disallow: /account/
    28. Disallow: /app/
    29. Disallow: /cache/
    30. Disallow: /install/
    31. Disallow: /models/
    32. Disallow: /crond/run/
    33. Disallow: /search/
    34. Disallow: /static/
    35. Disallow: /setting/
    36. Disallow: /system/
    37. Disallow: /tmp/
    38. Disallow: /themes/
    39. Disallow: /uploads/
    40. Disallow: /url-*
    41. Disallow: /views/
    42. Disallow: /*/ajax/[root@lnmp ~]#

    十一、负载均衡
    一个IP叫做代理，两个IP以上叫负载均衡
    配置

    1. // 下载安装dig命令
    2. [root@lnmp ~]# yum install -y bind-utils
    3. // 通过dig命令获取相应域名的地址,这里是拿百度的做测试
    4. [root@lnmp ~]# dig www.baidu.com
    6. ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.5 <<>> www.baidu.com
    7. ;; global options: +cmd
    8. ;; Got answer:
    9. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23817
    10. ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
    12. ;; OPT PSEUDOSECTION:
    13. ; EDNS: version: 0, flags:; udp: 512
    14. ;; QUESTION SECTION:
    15. ;www.baidu.com.            IN    A
    17. ;; ANSWER SECTION:
    18. www.baidu.com.        33    IN    CNAME    www.a.shifen.com.
    19. www.a.shifen.com.    129    IN    A    220.181.38.149
    20. www.a.shifen.com.    129    IN    A    220.181.38.150
    22. ;; Query time: 31 msec
    23. ;; SERVER: 114.114.114.114#53(114.114.114.114)
    24. ;; WHEN: Wed Aug 18 19:12:15 CST 2021
    25. ;; MSG SIZE  rcvd: 101
    27. [root@lnmp ~]# vim /usr/local/nginx/conf/vhost/load.conf 
    28. upstream baidu
    29. {
    30.     ip_hash;
    31.     server 220.181.38.149:80;
    32.     server 220.181.38.150:80;
    33. }
    34. server
    35. {
    36.     listen 80;
    37.     server_name www.baidu.com;
    38.     location /
    39.     {
    40.         proxy_pass      http://baidu;
    41.         proxy_set_header Host   $host;
    42.         proxy_set_header X-Real-IP      $remote_addr;
    43.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    44.     }
    45. }
    47. #upstream来指定多个web server
    48. # upstream后面的名字要和proxy_pass后面的名字相同

    测试

    1. //测试
    2. [root@lnmp ~]# curl -x127.0.0.1:80 www.baidu.com
    3.  default server! 
    4. [root@lnmp ~]# /usr/local/nginx/sbin/nginx -t
    5. nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    6. nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    7. [root@lnmp ~]# /usr/local/nginx/sbin/nginx -s reload
    8. [root@lnmp ~]# curl -x127.0.0.1:80 www.baidu.com
    9. <!DOCTYPE html>
    10. <!--STATUS OK--><html> <head><meta http-equiv=content-type content=text/html;
    11. charset=utf-8><meta http-equiv=X-UA-Compatible 
    12. content=IE=Edge><meta content=always name=referrer><link rel=stylesheet 
    13. type=text/css href=http://s1.bdstatic.com/r/www/cache/bdorz/baidu.min.css><title>
    14. 百度一下，你就知道

    十二、SSL
    大家在访问网站的时候前面一般都是http和HTTPS，其中HTTP就是和SSL证书有关
    生成SSL密钥对

    1. [root@lnmp ~]# rpm -qa  openssl
    2. openssl-1.0.2k-21.el7_9.x86_64
    3. //切换目录
    4. [root@lnmp ~]# cd /usr/local/nginx/conf/
    5. [root@lnmp conf]# openssl genrsa -des3 -out tmp.key 2048
    6. Generating RSA private key, 2048 bit long modulus
    7. .....................................................................................+++
    8. ..............................+++
    9. e is 65537 (0x10001)
    10. Enter pass phrase for tmp.key:
    11. Verifying - Enter pass phrase for tmp.key:
    12. [root@lnmp conf]# openssl rsa -in tmp.key -out aminglinux.key 
    13. Enter pass phrase for tmp.key:
    14. writing RSA key
    15. [root@lnmp conf]# ls
    16. aminglinux.key          koi-win              tmp.key
    17. fastcgi.conf            mime.types           uwsgi_params
    18. fastcgi.conf.default    mime.types.default   uwsgi_params.default
    19. fastcgi_params          nginx.conf           vhost
    20. fastcgi_params.default  nginx.conf.default   win-utf
    21. htpasswd                scgi_params
    22. koi-utf                 scgi_params.default
    23. [root@lnmp conf]# rm -rf tmp.key 
    24. [root@lnmp conf]# openssl req -new -key aminglinux.key -out aminglinux.csr
    25. You are about to be asked to enter information that will be incorporated
    26. into your certificate request.
    27. What you are about to enter is what is called a Distinguished Name or a DN.
    28. There are quite a few fields but you can leave some blank
    29. For some fields there will be a default value,
    30. If you enter '.', the field will be left blank.
    31. -----
    32. Country Name (2 letter code) [XX]:66
    33. State or Province Name (full name) []:beijing
    34. Locality Name (eg, city) [Default City]:^C
    35. [root@lnmp conf]# openssl req -new -key aminglinux.key -out aminglinux.csr
    36. You are about to be asked to enter information that will be incorporated
    37. into your certificate request.
    38. What you are about to enter is what is called a Distinguished Name or a DN.
    39. There are quite a few fields but you can leave some blank
    40. For some fields there will be a default value,
    41. If you enter '.', the field will be left blank.
    42. -----
    43. Country Name (2 letter code) [XX]:66
    44. State or Province Name (full name) []:bj
    45. Locality Name (eg, city) [Default City]:bj
    46. Organization Name (eg, company) [Default Company Ltd]:cn
    47. Organizational Unit Name (eg, section) []:cn
    48. Common Name (eg, your name or your server's hostname) []:cn
    49. Email Address []:wsw@163.com
    51. Please enter the following 'extra' attributes
    52. to be sent with your certificate request
    53. A challenge password []:1234
    54. An optional company name []:1234
    55. [root@lnmp conf]# openssl x509 -req -days 365 -in aminglinux.csr -signkey aminglinux.key -out aminglinux.crt
    56. Signature ok
    57. subject=/C=66/ST=bj/L=bj/O=cn/OU=cn/CN=cn/emailAddress=wsw@163.com
    58. Getting Private key

    配置SSL

    1. //修改配置文件
    2. [root@lnmp conf]# vim /usr/local/nginx/conf/vhost/ssl.conf
    3. server
    4. {
    5.     listen 443;
    6.     server_name 1234.com;
    7.     index index.html index.php;
    8.     root /data/wwwroot/1234.com;
    9.     ssl on;
    10.     ssl_certificate aminglinux.crt;
    11.     ssl_certificate_key aminglinux.key;
    12.     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    13. }
    15. [root@lnmp conf]# /usr/local/nginx/sbin/nginx -t
    16. nginx: [emerg] unknown directive "ssl" in /usr/local/nginx/conf/vhost/ssl.conf:7
    17. nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed
    19. // 重新编译安装nginx
    20. [root@lnmp conf]# cd /usr/local/src/
    21. [root@lnmp src]# ls
    22. mysql-5.6.47-linux-glibc2.12-x86_64.tar.gz  php-5.6.30
    23. nginx-1.17.8                                php-5.6.30.tar.gz
    24. nginx-1.17.8.tar.gz
    25. [root@lnmp src]# cd nginx-1.17.8
    26. [root@lnmp nginx-1.17.8]# ls
    27. auto     CHANGES.ru  configure  html     Makefile  objs    src
    28. CHANGES  conf        contrib    LICENSE  man       README
    29. [root@lnmp nginx-1.17.8]# ./configure --help |grep ssl
    30.   --with-http_ssl_module             enable ngx_http_ssl_module
    31.   --with-mail_ssl_module             enable ngx_mail_ssl_module
    32.   --with-stream_ssl_module           enable ngx_stream_ssl_module
    33.   --with-stream_ssl_preread_module   enable ngx_stream_ssl_preread_module
    34.   --with-openssl=DIR                 set path to OpenSSL library sources
    35.   --with-openssl-opt=OPTIONS         set additional build options for OpenSSL
    36. [root@lnmp nginx-1.17.8]# ./configure --prefix=/usr/local/nginx --with-http_ssl_module
    37. //编译安装
    38. [root@lnmp nginx-1.17.8]# make && make install
    41. [root@lnmp nginx-1.17.8]# /etc/init.d/nginx restart 
    42. Restarting nginx (via systemctl):                          [  OK  ]
    43. [root@lnmp nginx-1.17.8]# netstat -ntlp
    44. Active Internet connections (only servers)
    45. Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
    46. tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      5609/nginx: master  
    47. tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1102/sshd           
    48. tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      2439/master         
    49. tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      5609/nginx: master  
    50. tcp6       0      0 :::3306                 :::*                    LISTEN      2437/mysqld         
    51. tcp6       0      0 :::22                   :::*                    LISTEN      1102/sshd           
    52. tcp6       0      0 ::1:25                  :::*                    LISTEN      2439/master         
    53. //创建
    54. [root@lnmp nginx-1.17.8]# mkdir -p /data/nginx/1234.com
    55. [root@lnmp nginx-1.17.8]# echo "ssl test" > /data/nginx/1234.com/index.html