nginx 入门、安装、命令、配置、优化

操作系统：CentOS Linux 7
Nginx版本：yum安装1.12.2 、编译安装1.14.2

一、安装

1. yum安装

安装源

[root@localhost ~]# yum list nginx[root@localhost ~]# rm -rf /etc/yum.repos.d/*[root@localhost ~]# curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.163.com/.help/CentOS7-Base-163.repo[root@localhost ~]# curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo[root@localhost ~]# yum clean all && yum makecache

启动一个Nginx

[root@localhost ~]# yum install -y nginx[root@localhost ~]# nginx[root@localhost ~]# curl localhost

yum安装Nginx的目录结构

[root@localhost ~]# find / -name nginx/etc/logrotate.d/nginx #滚动日志/etc/nginx #配置文件/usr/lib64/perl5/vendor_perl/auto/nginx #http-perl/usr/lib64/nginx #molules/usr/sbin/nginx #bin文件/usr/share/nginx #html/molules/var/lib/nginx #tmp/var/log/nginx #log[root@localhost ~]# yum remove -y nginx[root@localhost ~]# find / -name nginx

2. 编译安装

准备环境依赖

[root@localhost ~]# rm -rf /etc/yum.repos.d/*[root@localhost ~]# curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.163.com/.help/CentOS7-Base-163.repo[root@localhost ~]# curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo[root@localhost ~]# yum install -y gcc gcc-c++ make pcre-devel zlib-devel

编译安装Nginx

[root@localhost ~]# curl -o nginx-1.14.2.tar.gz http://nginx.org/download/nginx-1.14.2.tar.gz[root@localhost ~]# tar -xf nginx-1.14.2.tar.gz[root@localhost ~]# cd nginx-1.14.2[root@localhost nginx-1.14.2]# ./configure[root@localhost nginx-1.14.2]# make && make install[root@localhost nginx-1.14.2]# find / -name nginx/root/nginx-1.14.2/objs/nginx #编译文件/usr/local/nginx #安装目录/usr/local/nginx/sbin/nginx #bin文件

启动一个Nginx

[root@localhost sbin]# ./nginx[root@localhost sbin]# curl localhost

3. 编译安装进阶

3.1. 指定编译参数

[root@localhost nginx-1.14.2]# ./configure --prefix=$PWD/nginx

3.2. 安装官方板块

[root@localhost nginx-1.14.2]# ./configure --prefix=$PWD/nginx --with-stream

3.3. 安装自己设置板块
3.3.1 编写Nginx自己设置板块

[root@localhost nginx-1.14.2]# mkdir -p modules/ngx_http_hello_world_module[root@localhost nginx-1.14.2]# cd modules/ngx_http_hello_world_module[root@localhost ngx_http_hello_world_module]# touch ngx_http_hello_world_module.c config

ngx_http_hello_world_module.c

#include "ngx_core.h"#include "ngx_string.h"#include "ngx_buf.h"#include "ngx_module.h"#include "ngx_conf_file.h"#include "ngx_http.h"#include "ngx_http_request.h"#include "ngx_http_config.h"#include "ngx_http_core_module.h"static ngx_int_t ngx_http_hello_world_handler(ngx_http_request_t *r){    if (!(r->method & (NGX_HTTP_GET | NGX_HTTP_HEAD)))        return NGX_HTTP_NOT_ALLOWED;    ngx_int_t rc = ngx_http_discard_request_body(r);    if (rc != NGX_OK)        return rc;    ngx_str_t type = ngx_string("text/plain");    ngx_str_t response = ngx_string("Hello World!\n");    r->headers_out.status = NGX_HTTP_OK;    r->headers_out.content_length_n = response.len;    r->headers_out.content_type = type;    rc = ngx_http_send_header(r);    if (rc == NGX_ERROR || rc > NGX_OK || r->header_only)        return rc;    ngx_buf_t *b;    b = ngx_create_temp_buf(r->pool, response.len);    if (b == NULL)        return NGX_HTTP_INTERNAL_SERVER_ERROR;    ngx_memcpy(b->pos, response.data, response.len);    b->last = b->pos + response.len;    b->last_buf = 1;    ngx_chain_t out;    out.buf = b;    out.next = NULL;    return ngx_http_output_filter(r, &out);}static char *ngx_http_hello_world(ngx_conf_t *cf, ngx_command_t *cmd, void *conf){    ngx_http_core_loc_conf_t *clcf;    clcf = ngx_http_conf_get_module_loc_conf(cf, ngx_http_core_module);    clcf->handler = ngx_http_hello_world_handler;    return NGX_CONF_OK;}static ngx_command_t ngx_http_hello_world_commands[] = {    {ngx_string("hello_world"), NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF |        NGX_HTTP_LMT_CONF | NGX_CONF_NOARGS, ngx_http_hello_world, NGX_HTTP_LOC_CONF_OFFSET, 0, NULL},    ngx_null_command};static ngx_http_module_t ngx_http_hello_world_module_ctx = {    NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL};ngx_module_t ngx_http_hello_world_module = {    NGX_MODULE_V1,    &ngx_http_hello_world_module_ctx,    ngx_http_hello_world_commands,    NGX_HTTP_MODULE,    NULL, NULL, NULL, NULL, NULL, NULL, NULL,    NGX_MODULE_V1_PADDING};

config

ngx_addon_name=ngx_http_hello_world_moduleHTTP_MODULES="$HTTP_MODULES ngx_http_hello_world_module"NGX_ADDON_SRCS="$NGX_ADDON_SRCS $ngx_addon_dir/ngx_http_hello_world_module.c"

3.3.2 编译自己设置板块

[root@localhost nginx-1.14.2]# ./configure --prefix=$PWD/nginx --with-stream --add-module=modules/ngx_http_hello_world_module[root@localhost nginx-1.14.2]# make && make install[root@localhost nginx-1.14.2]# vim nginx/conf/nginx.conf

server {    listen       80;    server_name  localhost;    #charset koi8-r;    #access_log  logs/host.access.log  main;    location / {        # root   html;        # index  index.html index.htm;        hello_world;    }}

3.3.3 启动nginx，测试hello world

[root@localhost nginx-1.14.2]# nginx/sbin/nginx [root@localhost nginx-1.14.2]# curl localhostHello World!

3.3.4 Nginx开发
? Tengine http://tengine.taobao.org/
? Openresty http://openresty.org/cn/

二、Nginx命令

[root@localhost ~]# nginx -h nginx version: nginx/1.14.2Usage: nginx [-?hvVtTq] [-s signal] [-c filename] [-p prefix] [-g directives]Options:  -?,-h         : this help  -v            : show version and exit  -V            : show version and configure options then exit  -t            : test configuration and exit  -T            : test configuration, dump it and exit  -q            : suppress non-error messages during configuration testing  -s signal     : send signal to a master process: stop, quit, reopen, reload  -p prefix     : set prefix path (default: /root/nginx-1.14.2/nginx/)  -c filename   : set configuration file (default: conf/nginx.conf)  -g directives : set global directives out of configuration file

[root@localhost ~]# nginx -vnginx version: nginx/1.14.2[root@localhost ~]# nginx -Vnginx version: nginx/1.14.2built by gcc 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC) configure arguments: --prefix=/root/nginx-1.14.2/nginx --with-stream --add-module=modules/ngx_http_hello_world_module

[root@localhost ~]# nginx -tnginx: the configuration file /root/nginx-1.14.2/nginx/conf/nginx.conf syntax is oknginx: configuration file /root/nginx-1.14.2/nginx/conf/nginx.conf test is successful

[root@localhost ~]# nginx -s quit[root@localhost ~]# nginx -c /etc/nginx-2.conf[root@localhost ~]# nginx -g 'worker_processes 4;'

三、Nginx配置文件

#user  nobody; #worker客户worker_processes  1; #worker进程数，cat /proc/cpuinfo | grep "processor" | wc -l#error_log  logs/error.log; #错误日志路径#error_log  logs/error.log  notice; #错误日志路径notice级别#error_log  logs/error.log  info; #错误日志路径info级别#pid        logs/nginx.pid; #pid路径events { #events块    worker_connections  1024; #每个worker最大开启连接数，ulimit -n}http { #http块    include       mime.types; #引入媒体文件    default_type  application/octet-stream; #默认响应类型    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '    #                  '$status $body_bytes_sent "$http_referer" '    #                  '"$http_user_agent" "$http_x_forwarded_for"';    # main级别日志输出格式    #access_log  logs/access.log  main; #访问日志main级别    sendfile        on; #开启sendfile，作为静态服务器时性能明显提高    #tcp_nopush     on; #包攒到肯定大小再发送，开启sendfile时生效    #keepalive_timeout  0;    keepalive_timeout  65; #连接超时（秒）    #gzip  on; #开启压缩    server { #server段        listen       80; #监听80端口        server_name  localhost; #绑定localhost        #charset koi8-r;        #access_log  logs/host.access.log  main;        location / { #匹配uri            root   html; #设置root目录            index  index.html index.htm; #默认首页        }        #error_page  404              /404.html;        # redirect server error pages to the static page /50x.html        #        error_page   500 502 503 504  /50x.html; #错误码和错误页        location = /50x.html {            root   html;        }    }}

main/events块指令集 http://nginx.org/en/docs/ngx_core_module.html
http块指令集 http://nginx.org/en/docs/http/ngx_http_core_module.html

四、基本用例

1. 静态资源服务器

直接启动Nginx就是个静态资源服务器。
alias和root的区别

location /foo {    root /a/b;}# 当请求的uri为/foo/c.html时，实际请求的文件路径是/a/b/foo/c.htmllocation /bar {    alias /x/y;}# 当请求的uri为/bar/z.html时，实际请求的文件路径是/x/y/z.html# alias对末尾的/敏感，alias末尾与uri末尾保持一致

rewrite的用法

location /foo {    rewrite /foo/(.*) /bar/$1 break;    root /a/b;}# 当请求的uri为/foo/c.html时，将请求改写为/bar/c.html,实际请求的文件路径是/a/b/bar/c.htmllocation /foo {    rewrite /foo/(.*) /bar/$1 last;    root /a/b;}# 当请求的uri为/foo/c.html时，将请求改写为/bar/c.html,重新寻觅location块匹配，实际请求的文件路径是/x/y/c.htmllocation /foo {    rewrite /foo/(.*) /bar/$1 permanent;}# 当请求的uri为/foo/c.html时，将请求改写为/bar/c.html,直接返回301跳location /foo {    rewrite /foo/(.*) /bar/$1 redirect;}# 当请求的uri为/foo/c.html时，将请求改写为/bar/c.html,直接返回302跳

break/last是同一个连接的内部解决过程，permanent/redirect是两次连接；
break不再执行location匹配，last执行屡次location匹配，通常在server中使用last，在location中使用break；
301跳会缓存，302跳不会；

2. 简单文件服务器

server {    listen       80 default_server;    listen       [::]:80 default_server;    server_name  _;    root         /usr/share/nginx/html;    include /etc/nginx/default.d/*.conf;    location / {        autoindex on;    }    error_page 404 /404.html;        location = /40x.html {    }    error_page 500 502 503 504 /50x.html;        location = /50x.html {    }}

当路径下存在index.html index.htm 时autoindex不生效

3.代理商服务器

3.1正向代理商

正向代理商：代理商用户端称为正向代理商，如爬虫使用的代理商服务器。基本是固定写法。

server {      resolver 8.8.8.8;    listen 8888;    location / {        proxy_pass http://$http_host$request_uri;        proxy_set_header HOST $http_host;    }}

3.2 反向代理商

正向代理商：代理商服务端称为反向代理商，如通过代理商java隐藏端口。基本是固定写法。

server {    listen       80;    server_name  _;    location =/index.html {        return 200 "index\n";    }}server {    listen       81;    server_name  _;    location /proxy {        proxy_pass http://localhost/;    }}

假如不想改变原地址中的uri，proxy_pass中就不要写uri！

4.负载均衡

利用肯定的策略将网络负载分摊到网络集群的各个服务上，从而减轻服务器负载并提高客户体验。

server {    listen       80 default_server;    server_name  _;    location / {        proxy_pass http://balance;    }}upstream balance {    server localhost:81;    server localhost:82;}server {    listen       81;    server_name  _;    location / {        return 200 "1\n";    }}server {    listen       82;    server_name  _;    location / {        return 200 "2\n";    }}

Nginx负载均衡策略：round robin、weight、ip_hash、least_conn、fair（3）、url_hash（3）

5.TCP/UDP代理商

TCP/UDP协议的反向代理商。

stream{    upstream mysql{        server localhost:3306;    }    server{        listen 3307;        proxy_pass mysql;    }}

需要stream板块支持

五、深度优化

1、安全优化

1.1 隐藏Nginx软件名和版本号

[root@localhost /]# curl -I localhostHTTP/1.1 200 OKServer: nginx/1.12.2Date: Tue, 23 Apr 2019 06:23:27 GMTContent-Type: application/octet-streamContent-Length: 2Connection: keep-alive

方案1：修改nginx.conf增加

server_tokens off;

方案2：修改$NGINX_HOME/src/core/nginx.h（不推荐）

#define NGINX_VERSION      "1.14.2"#define NGINX_VER          "nginx/" NGINX_VERSION// 随便修改以上两个字段（注意这是C代码，#不是注释的意思）#define NGINX_VERSION      "7.5.1"#define NGINX_VER          "IIS/" NGINX_VERSION

方案3：修改$NGINX_HOME/src/core/nginx.h

static u_char ngx_http_server_string[] = "Server: nginx" CRLF;static u_char ngx_http_server_full_string[] = "Server: " NGINX_VER CRLF;// 随便修改以上两个字段static u_char ngx_http_server_string[] = "Server: IIS" CRLF;static u_char ngx_http_server_full_string[] = "Server: " "IIS/7.5.1" CRLF;

隐藏40x、50x页面的软件名版本号：修改nginx.conf增加

error_page 400 401 402 403 404 405 415 /40x.html;location = /40x.html {    return 200 "not found.";}error_page 500 502 503 504 /50x.html;location = /50x.html {    return 200 "error.";}

1.2 非法域名解析

server {    listen 80 default_server;    server_name _;    rewrite ^(.*) http//:www.example.com/$1 permanent;}

1.3 黑白名单

location / {   allow 127.0.0.1;   deny 192.168.1.1;}

1.4 DDOS攻击

# 访问频率限制limit_req_zone $binary_remote_addr zone=perip:100m rate=1r/s;server {      limit_req zone=perip burst=5 nodelay;}

2、性能优化

2.1 优化进程和连接数

worker_processes    4; #auto=逻辑核数，高io的可以再调大；假如服务器有其余负载按需设置；worker_cpu_affinity 0001 0010 0100 1000; #cpu亲和性，指定每个线程运行在哪个核上；events {    use epoll;  #显式指定采用epoll，假如不知道是什么请让Nginx自己决定最优方案；    worker_connections  1024;#每个进程最大可打开连接数受制于ulimit -n;}

2.2 高效文件传输

# 设置传输参数sendfile on;tcp_nopush on;tcp_nodelay on;server_tokens off;server_names_hash_bucket_size 128;server_names_hash_max_size 512;keepalive_timeout 65;client_header_timeout 15s;client_body_timeout 15s;send_timeout 60s;# 设置压缩参数gzip on;gzip_disable "msie6";gzip_min_length 1k;gzip_vary on;gzip_proxied any;gzip_comp_level 3;gzip_buffers 16 8k;gzip_http_version 1.1;gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript image/jpeg image/gif image/png;# 为静态资源设置正当的过期时间expires    -1;