Nginx
|字数总计:3.9k|阅读时长:17分钟|阅读量:
Docker安装 Nginx
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
| # 简单的 docker run --name nginx-test \ -p 8080:80 \ -d \ nginx
# 正式的 docker run -d \ -p 443:443 \ -p 80:80 \ --name nginx \ -v /home/nginx/www:/usr/share/nginx/html \ -v /home/nginx/conf/nginx.conf:/etc/nginx/nginx.conf \ -v /home/nginx/logs:/var/log/nginx \ nginx
|
Ubuntu安装Nginx
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29
| sudo apt-get install libpcre3 libpcre3-dev openssl libssl-dev zlib1g-dev
apt-get install build-essential
yum install -y gcc-c++ pcre pcre-devel zlib zlib-devel openssl openssl-devel
cd ./nginx-1.16 ./configure --prefix=/url/local/nginx
./configure
./configure --add-module=../nginx-rtmp-module
make && make install
cd ../nginx/sbin ./nginx
所有的配置文件都在/etc/nginx下,并且每个虚拟主机已经安排在了/etc/nginx/sites-available下 程序文件在/usr/sbin/nginx 日志放在了/var/log/nginx中 并已经在/etc/init.d/下创建了启动脚本nginx 默认的虚拟主机的目录设置在了/var/www/nginx-default (有的版本 默认的虚拟主机的目录设置在了/var/www, 请参考/etc/nginx/sites-available里的配置)
|
Nginx 常用命令
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
| start nginx
nginx
nginx -s reload
nginx -s reopen
nginx -t -c /path/to/nginx.conf
nginx -s stop
nginx -s quit
nginx -c /home/anthony/nginx.conf
|
Nginx 配置模板
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133
|
worker_processes 1;
error_log logs/warn.log warn;
pid logs/nginx.pid;
worker_processes 1;
events {
worker_connections 1024; }
http { include mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; client_header_buffer_size 1k; large_client_header_buffers 4 4k;
send_timeout 3m; sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 0; keepalive_timeout 5000;
gzip on; gzip_min_length 1100; gzip_buffers 4 8k; gzip_types text/plain application/x-javascript text/css application/xml text/javascript application/x-httpd-php application/javascript application/json; output_buffers 1 32k; postpone_output 1460; server_names_hash_bucket_size 128; client_header_timeout 3m; client_body_timeout 3m; client_max_body_size 200m; fastcgi_connect_timeout 300; fastcgi_send_timeout 300; fastcgi_read_timeout 300; fastcgi_buffer_size 64k; fastcgi_buffers 4 64k; fastcgi_busy_buffers_size 128k; fastcgi_temp_file_write_size 128k; gzip_http_version 1.1; gzip_comp_level 2; gzip_vary on;
server { listen 80; server_name ap.mmzcg.com;
charset UTF-8;
location / { proxy_pass http://127.0.0.1:30000/;
add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
proxy_set_header Host $host:$server_port; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
client_max_body_size 100m; client_body_buffer_size 1280k; proxy_connect_timeout 5; proxy_read_timeout 60; proxy_send_timeout 30; proxy_buffer_size 256k; proxy_buffers 4 256k; proxy_busy_buffers_size 256k; proxy_temp_file_write_size 256k; proxy_next_upstream error timeout invalid_header http_500 http_503 http_404; proxy_max_temp_file_size 128m; } }
}
|
Nginx日志管理
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
|
server { listen 80; location / { root my; index index.html }
access_log logs/access.log main; }
|
推荐的配置
1 2 3 4
| log_format main '$remote_addr - $remote_user [$time_local] "$request" $http_host ' '$status $request_length $body_bytes_sent "$http_referer" ' '"$http_user_agent" $request_time';
|
- remote_addr : 客户端地址
- remote_user : 客户端用户名
- time_local : 服务器时间
- request : 请求内容,包括方法名,地址,和http协议
- http_host : 用户请求是使用的http地址
- status : 返回的http 状态码
- request_length : 请求大小
- body_bytes_sent : 返回的大小
- http_referer : 来源页
- http_user_agent : 客户端名称
- request_time : 整体请求延时
日志书写规则
一行要用单引号包起来,一行一个,换行也不需要什么连接的符号
location匹配
= 精准匹配
不写 一般匹配
~ 正则匹配
location proxy_pass 后面的url 加与不加/的区别
server_name匹配
通配符匹配
1 2 3 4 5 6 7 8 9 10 11 12 13
| server { listen 80; server_name *.example.org; ... ` }
server { listen 80; server_name mail.*; ...
}
|
通配符格式中的*
号只能在域名的开头或结尾,并且*
号两侧只能是.
这些无效:
www.*.example.org
w*.example.org
*
号可以匹配多个域名部分,*.example.org
可以匹配到:
www.example.org
www.sub.example.org
.example.org
是比较特殊的通配符格式, 可以同时匹配
example.org
*.example.org
。
正则匹配
⁉️ 不适用我自己
精确匹配
1 2 3 4 5
| server { listen 80; server_name example.org www.example.org; ... }
|
特殊匹配格式
server_name ""
; 匹配Host请求头不存在的情况。
server_name "-"
; 无任何意义。
server_name "*";
它被错误地解释为万能的名称。 它从不用作通用或通配符服务器名称。相反,它提供了server_name_in_redirect指令现在提供的功能。 现在不建议使用特殊名称“ *”,而应使用server_name_in_redirect指令。
匹配顺序
- 精确的名字
- 以*号开头的最长通配符名称,例如 *.example.org
- 以号结尾的最长通配符名称,例如 mail.
- 第一个匹配的正则表达式(在配置文件中出现的顺序)
优化
- 尽量使用精确匹配;
- 当定义大量server_name时或特别长的server_name时,需要在http级别调整server_names_hash_max_size和server_names_hash_bucket_size,否则nginx将无法启动。
Nginx报错
1.服务器重启之后,执行 nginx -t 是OK的,然而在执行 nginx -s reload 的时候报错
nginx: [error] invalid PID number "" in "/run/nginx.pid"
1 2 3 4
| # 解决办法: nginx -c /etc/nginx/nginx.conf nginx.conf文件的路径可以从nginx -t的返回中找到。 nginx -s reload
|
2.a duplicate default server for 0.0.0.0:80
nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/sites-enabled/gitlab:10
1 2 3
| 删除/etc/nginx/sites-available/default文件,重新启动服务即可
nginx -t :检查配置文件是否出错
|
3.403
1 2 3
| 打开nginx.conf 例子:vim /etc/nginx/nginx.conf 把 user 用户名 改为 user root 或 其它有高权限的用户名称即可
|
Nginx应用
Acme.sh的使用
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
| # 下载软件 curl https://get.acme.sh | sh
# 设置别名 alias: alias acme.sh=~/.acme.sh/acme.sh
# 切换 Let's Encrypt,默认使用 ZeroSSL acme.sh --set-default-ca --server letsencrypt
# 执行,会打印配置域名的TXT acme.sh --issue -d baidu.me --dns --yes-I-know-dns-manual-mode-enough-go-ahead-please
# 配置好执行,再执行 acme.sh --issue -d baidu.me --dns --yes-I-know-dns-manual-mode-enough-go-ahead-please --renew
# --nginx 就是指定域名的配置文件 Your cert is in: /root/.acme.sh/baidu.me_ecc/baidu.me.cer Your cert key is in: /root/.acme.sh/baidu.me_ecc/baidu.me.key The intermediate CA cert is in: /root/.acme.sh/baidu.me_ecc/ca.cer And the full chain certs is there: /root/.acme.sh/baidu.me_ecc/fullchain.cer
# 查看申请的证书 root@jenkins-jumpserver-nginx:~/.acme.sh# acme.sh --list Main_Domain KeyLength SAN_Domains CA Created Renew baidu "ec-256" no LetsEncrypt.org 2023-09-17T11:52:22Z 2023-11-15T11:52:22Z
# 续期证书 # 证书默认是90天,如需强制更新证书,则执行以下命令 acme.sh --renew -d abc.xyz --force
# acme.sh会自动为你创建 cronjob, 每天 0:00 点自动检测所有的证书, # 如果快过期了, 需要更新, 则会自动更新证书,使用以下命令可查看定时任务 crontab -l
# 升级 acme.sh 到最新 acme.sh --upgrade
|
1 2 3 4 5
| # CF export CF_Key="xxxxxxx" export CF_Email="CF账号的邮箱"
acme.sh --issue -d "baidu.com" --dns dns_cf
|
建立软连接
1
| sudo ln -s /etc/nginx/sites-available/domain-one.com /etc/nginx/sites-enabled/
|
快速部署静态应用
1 2 3 4 5 6 7 8 9 10 11 12 13 14
| server { listen 8080; server_name localhost;
location / { root /usr/local/var/www/my-project; index index.html index.htm; try_files $uri $uri/ /index.html; } }
|
跨域
1 2 3 4 5 6 7 8 9 10 11 12 13 14
| server { listen 8080; server_name localhost;
location / { proxy_pass http://www.proxy.com; add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS'; add_header Access-Control-Allow-Headers 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization'; } }
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48
| server { listen 80 default_server; server_name _ www.*;
location / { index index.html; root /home/ubuntu/sabong-server-front; try_files $uri $uri/ /index.html; }
location /api/ {
if ($request_method = 'OPTIONS') { add_header 'Access-Control-Allow-Origin' *; add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS'; add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,language,If-Modified-Since,Cache-Control,Content-Type'; add_header 'Access-Control-Allow-Credentials' true; add_header 'Access-Control-Max-Age' 86400; return 200; } add_header 'Access-Control-Allow-Origin' *; add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS'; add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,language,If-Modified-Since,Cache-Control,Content-Type'; add_header 'Access-Control-Allow-Credentials' true; add_header 'Access-Control-Max-Age' 86400;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forward-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_set_header X-Nginx-Proxy true; proxy_pass http://172.31.41.206:9001/;
}
location /ws { proxy_pass http://172.31.41.206:9006/ws; proxy_http_version 1.1; proxy_read_timeout 360s; proxy_redirect off; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host:$server_port; proxy_set_header X-Real-IP $remote_addr; proxy_set_header REMOTE-HOST $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } }
|
Gzip压缩
1 2 3 4 5 6 7
| http { gzip on; gzip_min_length 1000; gzip_comp_level 3; gzip_types text/plain application/xml; }
|
转发Vue项目
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
| server { listen 80 default_server;
server_name _;
location / { index index.html; root /home/ubuntu/sabong-server-front; try_files $uri $uri/ /index.html; }
location /api/ { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_set_header X-Nginx-Proxy true; proxy_pass http://172.31.41.206:9001/; } }
|
转发Websocket
1 2 3 4 5 6 7 8 9 10 11 12
| location /ws { proxy_pass http://172.31.41.206:9006/ws; proxy_http_version 1.1; proxy_read_timeout 360s; proxy_redirect off; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host:$server_port; proxy_set_header X-Real-IP $remote_addr; proxy_set_header REMOTE-HOST $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
|
转发Redis
只知道这么配置,不知道怎么给redis配置上域名
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32
| user www-data; worker_processes auto; pid /run/nginx.pid; include /etc/nginx/modules-enabled/*.conf;
events { worker_connections 768; }
http{ }
stream {
upstream redis { server myredis.godjfp.com:6379 max_fails=3 fail_timeout=30s; }
server { listen 6379; proxy_connect_timeout 1s; proxy_timeout 3s; proxy_pass redis; } }
|
图片上传
post上传文件,出现413错误码 解决方案
1 2 3 4
| #允许客户端请求的最大单文件字节数 client_max_body_size 10m; #缓冲区代理缓冲用户端请求的最大字节数 client_body_buffer_size 128k;
|
HTTPS跳转
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47
| server { listen 80; listen 443 ssl;
server_name abc.xyz;
if ($scheme = http) { return 301 https://$host$request_uri; } location / { proxy_pass http://192.168.0.2:8084/; } }
server { listen 80; listen 443 ssl;
server_name abc.xyz;
location / { proxy_pass http://192.168.0.2:8084/; } }
server { listen 80; server_name your_domain.com www.your_domain.com; return 301 https://$host$request_uri; }
server { listen 443 ssl; server_name your_domain.com www.your_domain.com;
ssl_certificate /path/to/your/certificate.crt; ssl_certificate_key /path/to/your/private_key.key; }
|
代理JumpServer
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
| server { listen 80 default_server; listen [::]:80 default_server;
root /var/www/html; index index.html index.htm index.nginx-debian.html;
server_name _;
location / { proxy_pass http://127.0.0.1:8083/;
proxy_http_version 1.1; proxy_buffering off; proxy_request_buffering off; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; } }
|
官方文档:使用Nginx代理JumpServer
代理Jenkins
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38
| server { listen 80 default_server; listen [::]:80 default_server; server_name _;
location / { proxy_pass http://127.0.0.1:8083/; } }
server { listen 80 default_server; listen [::]:80 default_server; server_name _;
location / { proxy_pass http://127.0.0.1:8080/; proxy_http_version 1.1; http2_push_preload on; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Rea $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_set_header X-Nginx-Proxy true; } }
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
| server { listen 80; server_name _; location /api/ { client_max_body_size 100m; client_body_buffer_size 50m; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://172.31.2.105:8083/; }
location /v3/api-docs { client_max_body_size 100m; client_body_buffer_size 50m; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://172.31.2.105:8083/v3/api-docs; }
location / { try_files $uri $uri/ /index.html; root /usr/share/nginx/html/manager/dist/; index index.html index.htm; }
}
|
SRS
Docker方式运行
1 2 3 4
| docker run -p 1935:1935 -p 1985:1985 -p 8080:8080 ossrs/srs:latest
|
SRS安装参考
https://cloud.tencent.com/developer/article/1693951
Mac改成只播放系统声音
Mac obs推流直播无声音解决方法_OBS教程_OBS Open Broadcaster Software
OBS权限监听浏览器