Nginx 配置整理

linux ： nginx -s reload

windows ：去任务管理器搜nginx 进行杀掉后重启

IP传递(代理java接口)

  1. location /test/ {
  2.     proxy_pass http://localhost:9002/;
  3.     proxy_set_header Host $host;
  4.     proxy_http_version 1.1;
  5.     // proxy_set_header Connection "";
  6.     proxy_set_header X-Forwarded-Host $server_name;
  7.     proxy_set_header X-Forwarded-Proto https;
  8.     proxy_set_header X-Real-IP $remote_addr;z
  9.     proxy_set_header REMOTE_ADDR $remote_addr;
  10.     proxy_set_header Upgrade $http_upgrade;
  11.     proxy_set_header Connection "upgrade";
  12.     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  13. }
  1.   /**
  2.      * 获取有网关是 的真正客户端IP 测试过nginx可以获取
  3.      * 
  4. <pre>
  5.      *
  6.      * location /test/ {
  7.      *     proxy_pass http://localhost:9002/;
  8.      *     proxy_set_header Host $host;
  9.      *     proxy_set_header X-Forwarded-Host $server_name;
  10.      *     proxy_set_header X-Real-IP $remote_addr;
  11.      *     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  12.      * }
  13.      * </pre>
  14.      * @param request request
  15.      * @return ip
  16.      */
  17.     public static String getPoxyIp(HttpServletRequest request) {
  18.         String ip = request.getHeader("X-Forwarded-For");
  19.         if ( null != ip && !UNKNOWN.equalsIgnoreCase(ip) ) {
  20.             // 多次反向代理后会有多个ip值，第一个ip才是真实ip
  21.             int index = ip.indexOf(",");
  22.             if ( index != -1 ) {
  23.                 return ip.substring(0, index);
  24.             } else {
  25.                 return ip;
  26.             }
  27.         }
  28.         ip = request.getHeader("X-Real-IP");
  29.         if ( null != ip && !UNKNOWN.equalsIgnoreCase(ip) ) {
  30.             return ip;
  31.         }
  32.         return request.getRemoteAddr();
  33.     }

流穿透

我使用的是 openresty 自带 stream模块

原生请参考：我也没试过，百度来的

mysql redis

mysql

  1. stream {
  3.     upstream mysql{
  4.        hash $remote_addr consistent;
  5.       # $binary_remote_addr;
  6.        server 127.0.0.1:3306 weight=5 max_fails=3 fail_timeout=30s;
  7.     }
  9.     server {
  10.        listen 3317;#数据库服务器监听端口
  11.        proxy_connect_timeout 10s;
  12.        proxy_timeout 300s;#设置客户端和代理服务之间的超时时间，如果5分钟内没操作将自动断开。
  13.        proxy_pass mysql;
  14.     }
  15. }

redis

  1. stream {
  3.     upstream redis {
  4.         server 127.0.0.1:6379 max_fails=3 fail_timeout=30s; 
  5.     }
  7.     server {
  8.         listen 6616;
  9.         proxy_connect_timeout 1s;
  10.         proxy_timeout 3s;
  11.         proxy_pass redis;
  12.     }
  13. }

http 自动导向https

rewrite ^(.*) https://$server_name$1 permanent;

  1. nginx  http 自动导向https
  4. server {
  5.     listen       80;
  6.     server_name  nexus.tannn.cn;
  7.     #charset koi8-r;
  8.     #access_log  logs/host.access.log  main;
  9.     rewrite ^(.*) https://$server_name$1 permanent;
  10. }    
  12.  server {
  13.  listen   443 ssl;
  14.     server_name  xx.cn;
  15.     ssl_certificate      /usr/local/openresty/nginx/xx.cn_nginx/xx.cn.pem;
  16.     ssl_certificate_key  /usr/local/openresty/nginx/xx.cn_nginx/xx.tannn.cn.key;
  17.     ssl_session_cache    shared:SSL:1m;
  18.     ssl_session_timeout  5m;
  19.     client_max_body_size 500M;
  20.     ssl_ciphers  HIGH:!aNULL:!MD5;
  21.     ssl_prefer_server_ciphers   on;
  22.     location / {
  23.         proxy_pass http://localhost:8081/;
  24.         proxy_set_header   X-Forwarded-Proto https;  # 转发时使用https协议
  25.         proxy_set_header REMOTE_ADDR $remote_addr;
  26.         proxy_set_header Host $http_host;
  27.         proxy_http_version 1.1;
  28.         proxy_set_header Connection "";
  29.         proxy_set_header Upgrade $http_upgrade;
  30.         proxy_set_header Connection "upgrade";
  31.     }
  33. }

https 配置 (SSL)

🧅 listen

🧅 ssl_certificate

🧅 ssl_certificate_key

🧅 proxy_set_header X-Forwarded-Proto https;

  1.  server {
  2.     listen   443 ssl;
  3.     server_name  xx.cn;
  4.     ssl_certificate      /usr/local/openresty/nginx/xx.cn_nginx/xx.cn.pem;
  5.     ssl_certificate_key  /usr/local/openresty/nginx/xx.cn_nginx/xx.tannn.cn.key;
  6.     ssl_session_cache    shared:SSL:1m;
  7.     ssl_session_timeout  5m;
  8.     client_max_body_size 500M;
  9.     ssl_ciphers  HIGH:!aNULL:!MD5;
  10.     ssl_prefer_server_ciphers   on;
  11.     location / {
  12.         proxy_pass http://localhost:8081/;
  13.         proxy_set_header   X-Forwarded-Proto https;  # 转发时使用https协议
  14.         proxy_set_header REMOTE_ADDR $remote_addr;
  15.         proxy_set_header Host $http_host;
  16.         proxy_http_version 1.1;
  17.         proxy_set_header Connection "";
  18.         proxy_set_header Upgrade $http_upgrade;
  19.         proxy_set_header Connection "upgrade";
  20.     }
  22. }

纯静态

  1. # 代理到 所有文件的公共根目录bistdashboard/html/index.html
  2. ## 目录结构
  3. #### bistdashboard/html/xx.html
  4. #### bistdashboard/js/xx.js
  5. #### bistdashboard/css/xx.css
  6. # 访问 http://127.0.0.1:80/bistdashboard/html/index.html
  8. location /bistdashboard/ {
  9.     alias /home/detabes/softwares/bist-dashboard/;
  11. }

VUE静态文件

  1. # nginx - vue （/tn/index.html 中的 tn必须要在 location 中体现）
  2. location /tn {
  3.     alias /tn/tn/admin/dist;
  4.     index index.html;
  5.     try_files $uri $uri/ /tn/index.html;
  6. }

h5

  1. location /mobile {
  2.     alias C:/detabes/web/h5/;
  3.     index index.html;
  4.     try_files $uri $uri/ /mobile/index.html;
  5. }

minio

  1. server {
  2.     listen 80;
  3.     server_name  xx.com;
  4.     # To allow special characters in headers
  5.     ignore_invalid_headers off;
  6.     # Allow any size file to be uploaded.
  7.     # Set to a value such as 1000m; to restrict file size to a specific value
  8.     client_max_body_size 0;
  9.     # To disable buffering
  10.     proxy_buffering off;
  12.     location / {
  13.         proxy_set_header Host $http_host;
  14.         proxy_set_header X-Real-IP $remote_addr;
  15.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  16.         proxy_set_header X-Forwarded-Proto $scheme;
  17.         proxy_set_header X-NginX-Proxy true;
  19.         # This is necessary to pass the correct IP to be hashed
  20.         real_ip_header X-Real-IP;
  22.         proxy_connect_timeout 300;
  24.         # To support websocket
  25.         proxy_http_version 1.1;
  26.         proxy_set_header Upgrade $http_upgrade;
  27.         proxy_set_header Connection "upgrade";
  29.         chunked_transfer_encoding off;
  31.         proxy_pass http://127.0.0.1:9100;
  32.     }
  34.     location ~^/files {
  35.         proxy_buffering off;
  36.         proxy_set_header Host $http_host;
  37.         rewrite ^/files/(.*)$ /$1 break;
  38.         proxy_pass http://127.0.0.1:9000;
  39.     }
  40. }

console地址

  1. location / {
  2.         proxy_set_header Host $http_host;
  3.         proxy_set_header X-Real-IP $remote_addr;
  4.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  5.         proxy_set_header X-Forwarded-Proto $scheme;
  6.         proxy_set_header X-NginX-Proxy true;
  8.         # This is necessary to pass the correct IP to be hashed
  9.         real_ip_header X-Real-IP;
  11.         proxy_connect_timeout 300;
  13.         # To support websocket
  14.         proxy_http_version 1.1;
  15.         proxy_set_header Upgrade $http_upgrade;
  16.         proxy_set_header Connection "upgrade";
  18.         chunked_transfer_encoding off;
  20.         proxy_pass http://console.com;
  21.     }

file地址

非Root配置

  1.  location ~^/files {
  2.    proxy_buffering off;
  3.    proxy_set_header Host $http_host;
  4.    proxy_pass http://localhost:9000;
  5.  }

标准的Root配置

  1. server {
  2.  listen 80;
  3.  server_name example.com;
  4.  location / {
  5.    proxy_set_header Host $http_host;
  6.    proxy_pass http://localhost:9000;
  7.  }
  8. }

使用Rewrite的非Root配置 - 一般用这个

  1. location ~^/files {
  2.    proxy_buffering off;
  3.    proxy_set_header Host $http_host;
  4.    rewrite ^/files/(.*)$ /$1 break;
  5.    proxy_pass http://localhost:9000;
  6.  }

限制文件大小

  1. 文件大小限制
  3. http {
  4.     include       mime.types;
  5.     default_type  application/octet-stream;
  7.     #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
  8.     #                  '$status $body_bytes_sent "$http_referer" '
  9.     #                  '"$http_user_agent" "$http_x_forwarded_for"';
  11.     #access_log  logs/access.log  main;
  13.     sendfile        on;
  14.     #tcp_nopush     on;
  15.      #keepalive_timeout  0;
  16.     # 大小
  17.     client_max_body_size 1024M;
  18.     # timeout时间
  19.     keepalive_timeout  1800;
  20.     #gzip  on;
  21. }

负载均衡

  • 权重
    • weight (数字越大访问比例越高) : weight和访问比率成正比
    • iphash(ip_hash可以和weight配合使用)：每个请求都根据访问ip的hash结果分配，经过这样的处理，每个访客固定访问一个后端服务。
    • least_conn(least_conn可以和weight配合使用)：将请求分配到连接数最少的服务上
    • fair(fair可以和weight配合使用)：按后端服务器的响应时间来分配请求，响应时间短的优先分配
  1. upstream www.api.com {
  2.     iphash;
  3.     server 172.31.253.1:1122 weight=1;
  4.     server 172.31.253.2:1122 weight=2;
  5. }
  6. server {
  7.     listen       8888;
  8.     # 多 server_name
  9.     server_name  172.31.253.1 xx.xx.com 123.123.1.14;
  10.     #client_max_body_size 200m;
  12.     #charset koi8-r;
  14.     #access_log  logs/host.access.log  main;
  16.     location /api {
  17.         proxy_pass http://www.api.com/api;    
  18.         proxy_redirect off;
  19.         proxy_set_header Host $host:8888;
  20.         proxy_set_header X-Real-IP $remote_addr;
  21.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  22.         proxy_read_timeout 300;             
  23.     }    
  24. }

重定向

rewrite

带参数

  1. server {
  2.     listen   8085 ssl;
  3.     server_name  web.xxx.com;
  4.     ssl_certificate      /home/detabes/https/6388682_web.xxx.com_nginx/6388682_web.xxx.com.pem;
  5.     ssl_certificate_key  /home/detabes/https/6388682_web.xxx.com_nginx/6388682_web.xxx.com.key;
  6.     ssl_session_cache    shared:SSL:1m;
  7.     ssl_session_timeout  5m;
  8.     client_max_body_size 500M;
  9.     ssl_ciphers  HIGH:!aNULL:!MD5;
  10.     ssl_prefer_server_ciphers   on;
  13.     location / {
  14.         // rewrite ^(.*) https://$server_name$1 permanent;  // $server_name = server_name  web.xxx.com;
  15.         rewrite ^(.*) https://web.xxx.com:8085/RMS/html/index02.html$1 permanent;
  16.     }
  18.     location /RMS {
  19.         proxy_pass http://127.0.0.1:8084/RMS;
  20.         proxy_redirect off;
  21.         proxy_set_header   X-Forwarded-Proto https;
  22.         proxy_set_header Host $host:8085;
  23.         proxy_set_header X-Real-IP $remote_addr;
  24.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  25.         proxy_read_timeout 300; 
  27.     }
  28. }

不带参数

  1. server {
  2.     listen   8085 ssl;
  3.     server_name  web.xxx.com;
  4.     ssl_certificate      /home/xxx/https/6388682_web.xxx.com_nginx/6388682_web.xxx.com.pem;
  5.     ssl_certificate_key  /home/xxx/https/6388682_web.xxx.com_nginx/6388682_web.xxx.com.key;
  6.     ssl_session_cache    shared:SSL:1m;
  7.     ssl_session_timeout  5m;
  8.     client_max_body_size 500M;
  9.     ssl_ciphers  HIGH:!aNULL:!MD5;
  10.     ssl_prefer_server_ciphers   on;
  13.     location / {
  14.         // rewrite ^(.*) https://$server_name;  // $server_name = server_name  web.xxx.com;
  15.         rewrite ^(.*) https://web.xxx.com:8085/RMS/html/index02.html;
  16.     }
  18.     location /RMS {
  19.         proxy_pass http://127.0.0.1:8084/RMS;
  20.         proxy_redirect off;
  21.         proxy_set_header   X-Forwarded-Proto https;
  22.         proxy_set_header Host $host:8085;
  23.         proxy_set_header X-Real-IP $remote_addr;
  24.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  25.         proxy_read_timeout 300; 
  27.     }
  28. }

跨域

  1. location / {  
  2.     add_header Access-Control-Allow-Origin *;
  3.     add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
  4.     add_header Access-Control-Allow-Headers 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
  6.     if ($request_method = 'OPTIONS') {
  7.         return 204;
  8.     }
  9. }

IPV6配置

同时监听IPV4和IPV6

  1. server {
  2.     listen [::]:80;
  3. }

只监听IPV6

  1. server {
  2.     listen [::]:80 default ipv6only=on;
  3. }

监听指定IPV6地址

  1. server {
  2.     listen [xx:xx:xx:xx:1]:80;
  3. }

配置错误页面

nginx配置，增加登录验证

https://zhuanlan.zhihu.com/p/351256125

https://blog.51cto.com/u_10950710/2334528

安装htpasswd工具

  1. # centos  
  2. yum -y install nginx    #安装nginx
  3. yum -y install httpd-tools    #安装httpd-tools    
  4. # ubuntu 
  5. sudo apt search htpasswd
  6. sudo apt install apache2-utils

生成密钥文件

  1. [root@test102 conf.d]# htpasswd -cm /etc/nginx/htpasswd crystal     #/etc/nginx/htpasswd就是配置文件里面配置的密码文件，crystal就是用户名
  2. New password:     #输入密码
  3. Re-type new password:     #再次输入密码，回车
  4. Adding password for user crystal

在原有密码文件中增加下一个用户

htpasswd -b /etc/nginx/htpasswd ren002 456 cat /etc/nginx/htpasswd ren001:$apr1$Ln1ZsyVn$2hn3VFqP0L5tNA1UCSU8F. ren002:$apr1$hCiMb9jc$Z.m7ZgOBCj0ISeIieTaVy/ #去掉c选项，即可在第一个用户之后添加第二个用户，依此类推

不更新密码文件，只显示加密后的用户名和密码

htpasswd -nb ren002 456 ren002:$apr1$DT53A20W$YRS7p4j.1Wum9q0kG3OQv. #不更新.passwd文件，只在屏幕上输出用户名和经过加密后的密码

用htpasswd命令删除用户名和密码

htpasswd -D /etc/nginx/htpasswd ren002 Deleting password for user ren002 cat /etc/nginx/htpasswd ren001:$apr1$Ln1ZsyVn$2hn3VFqP0L5tNA1UCSU8F.

用 htpasswd 命令修改密码

htpasswd -D /etc/nginx/htpasswd ren001 Deleting password for user ren001 htpasswd -b /etc/nginx/htpasswd ren001 123456 Adding password for user ren001

htpasswd命令选项参数说明

-c 创建一个加密文件

-n 不更新加密文件，只将htpasswd命令加密后的用户名，密码显示在屏幕上

-m 默认htpassswd命令采用MD5算法对密码进行加密

-d htpassswd命令采用CRYPT算法对密码进行加密

-p htpassswd命令不对密码进行进行加密，即明文密码

-s htpassswd命令采用SHA算法对密码进行加密

-b htpassswd命令行中一并输入用户名和密码而不是根据提示输入密码

-D 删除指定的用户

nginx配置登录验证

windows路径注意：

❌D:\tools\nginx\openresty-1.19.3.1-win64\htpasswd

✅D:/tools/nginx/openresty-1.19.3.1-win64/htpasswd

  1. location /password {
  2.     # proxy_pass http://10.0.0.102:5601$request_uri;        
  3.     #加上下面两行内容：
  4.     auth_basic "登陆验证";
  5.     auth_basic_user_file /etc/nginx/htpasswd;   #/etc/nginx/htpasswd是密码文件，路径自定义
  6. }
  7. # 例子
  8. location /api {
  9.     #加上下面两行内容：
  10.     auth_basic "登陆验证";
  11.     auth_basic_user_file D:/tools/nginx/openresty-1.19.3.1-win64/htpasswd;   #/etc/nginx/htpasswd是密码文件，路径自定义
  12.     proxy_pass http://192.168.0.65:9004/;
  13.     proxy_set_header Host $host;
  14.     proxy_set_header X-Forwarded-Host $server_name;
  15.     proxy_set_header X-Real-IP $remote_addr;
  16.     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  17. }

nginx 搭建文件服务器

location / { # 文件目录 alias D:/share; # 基本验证 可选 auth_basic "nginx basic auth"; auth_basic_user_file C:/nginx/conf/htpasswd; # 文件显示功能 autoindex on; #开启索引功能 autoindex_exact_size off; #关闭计算文件确切大小（单位bytes），只显示大概大小（单位kb、mb、gb） autoindex_localtime on; #显示本机时间而非 GMT 时间 }

Spring boot admin

  1. # 没测试过
  2. # nohup java -jar springbootadmin-1.0-SNAPSHOT.jar --server.servlet.context-path=/admin
  3. location /admin {
  4.         rewrite ^~/admin/(.*) /$1 break;
  5.         proxy_pass http://localhost:9002;
  6. }
  1. # https
  2. 配置文件中
  3. server:
  4.   forward-headers-strategy: native
  5. spring:
  6.   boot:
  7.     admin:
  8.       context-path: /
  9.       ui:
  10.         public-url: https://域名/
  11.         cache:
  12.           no-cache: true
  15. location / {
  16.     proxy_pass http://localhost:8001;
  17.     proxy_set_header Host $proxy_host;
  18.     proxy_set_header X-Real-IP $remote_addr;
  19.     proxy_set_header X-Forwarded-Host $host;
  20.     proxy_http_version 1.1;
  21.     proxy_set_header X-Forwarded-Proto https;
  22.     proxy_set_header Upgrade $http_upgrade;
  23.     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  24.     proxy_set_header X-Forwarded-Port $server_port;
  25. }

配置双方的 X-Forwarded-Proto 就是为了正确地识别实际用户发出的协议是 http 还是 https

  1. proxy_set_header X-Forwarded-Proto $scheme;
  2. proxy_set_header X-Forwarded-Port $server_port;