nginx详解

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

#!/bin/bash
logdir=/var/log/nginx
nginxdir=/usr/local/nginx
cores=$(grep 'core id' /proc/cpuinfo | sort -u | wc -l)
log=/root/nginxinstall.log
#安装依赖包
yum -y install pcre-devel openssl openssl-devel gd-devel zlib-devel gcc gcc-c++
#创建日志存放目录
id nginx 2>$log
if [ $? != 0 ];then
useradd -r -M -s /sbin/nologin nginx
fi
mkdir -p $logdir
chown -R nginx.nginx $logdir
[ ! -f Package/nginx-1.16.0.tar.gz ] && wget http://nginx.org/download/nginx-1.16.0.tar.gz
[ ! -d /nginx-1.16.0 ] && tar xf nginx-1.16.0.tar.gz -C /usr/src/
cd /usr/src/nginx-1.16.0
./configure --prefix=$nginxdir --user=nginx --group=nginx --with-debug --with-http_ssl_module --with-http_realip_module --with-http_image_filter_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_stub_status_module --http-log-path=$logdir/access.log --error-log-path=$logdir/error.log --with-pcre
make -j$cores 2>$log && make install
#添加服务控制脚本
cat >>/etc/init.d/nginx <<'EOF'
#!/bin/bash
nginx="/usr/local/nginx/sbin/nginx"
NGINX_CONF_FILE="/usr/local/nginx/conf/nginx.conf"
pid="/usr/local/nginx/logs/nginx.pid"
case $1 in
	start)
		$nginx -c $NGINX_CONF_FILE
		;;
	stop)
		$nginx -s stop
		;;
	restart)
		$nginx -s stop
		sleep 1
		$nginx -c $NGINX_CONF_FILE
		;;
	reload)
		$nginx -s reload
		;;
	status)
		if [ -f $pid ];then
		    echo "nginx is running"
        else
		    echo "nginx is stoped"
	    fi
		;;
	*)
		echo $"Usage: $0 {start|stop|status|restart|reload}"
		exit 2
		;;
esac
EOF
chmod +x /etc/init.d/nginx
##添加环境变量
echo "export PATH=$nginxdir/sbin:\$PATH" >/etc/profile.d/nginx.sh
echo "请执行 : source /etc/profile.d/nginx.sh 来添加环境变量"
echo  "安装完成"
echo "启动服务方法:service nginx start|stop|status|restart|reload "

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

//服务控制方式，使用nginx命令
    -t  //检查配置文件语法
    -v  //输出nginx的版本
    -c  //指定配置文件的路径
    -s  //发送服务控制信号，可选值有{stop|quit|reopen|reload}
  (这里reopen是重启,但是一般不用,效果不好,要么reload重读配置文件,要么stop后在nginx启动)
  
//启动nginx
[root@localhost ~]# nginx
[root@localhost ~]# ss -antl
State      Recv-Q Send-Q   Local Address:Port                  Peer Address:Port
LISTEN     0      128                  *:80                               *:*
LISTEN     0      128                  *:22                               *:*
LISTEN     0      100          127.0.0.1:25                               *:*
LISTEN     0      128                 :::22                              :::*
LISTEN     0      100                ::1:25                              :::* 

1

derective value1 [value2 ...]

1
2
3

daemon {on|off};    //是否以守护进程方式运行nginx，调试时应设置为off
master_process {on|off};    //是否以master/worker模型来运行nginx，调试时可以设置为off
error_log 位置 级别;    //配置错误日志

1
2
3
4

user USERNAME [GROUPNAME];    //指定运行worker进程的用户和组
pid /path/to/pid_file;    //指定nginx守护进程的pid文件
worker_rlimit_nofile number;    //设置所有worker进程最大可以打开的文件数，默认为1024(最大65535,这里设置了65535后,并不能就可以打开65535个了,还要设置/etc/security/limits.conf文件里面的参数nofile,让nginx可以打开65535个文件,也就是说,这里设置的数字会比系统限制小,要想大,就先加大系统限制)
worker_rlimit_core size;    //指明所有worker进程所能够使用的总体的最大核心文件大小，保持默认即可

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

worker_processes n;    //启动n个worker进程，这里的n为了避免上下文切换，通常设置为cpu总核心数减1或等于总核心数
worker_cpu_affinity cpumask ...;    //将进程绑定到某cpu中，避免频繁刷新缓存
//cpumask：使用8位二进制表示cpu核心，如：
    0000 0001   //第一颗cpu核心
    0000 0010   //第二颗cpu核心
    0000 0100   //第三颗cpu核心
    0000 1000   //第四颗cpu核心
    0001 0000   //第五颗cpu核心
    0010 0000   //第六颗cpu核心
    0100 0000   //第七颗cpu核心
    1000 0000   //第八颗cpu核心
timer_resolution interval;    //计时器解析度。降低此值，可减少gettimeofday()系统调用的次数
worker_priority number;    //指明worker进程的nice值(-20到19,一般是0)

1
2
3
4

accept_mutex {off|on};    //master调度用户请求至各worker进程时使用的负载均衡锁；on表示能让多个worker轮流地、序列化地去响应新请求,要启动on配置则要设置下面这个锁文件
lock_file file;    //accept_mutex用到的互斥锁锁文件路径(这个参数要放前面的全局配置段,否则语法错误)
use [epoll | rtsig | select | poll];    //指明使用的事件模型，建议让nginx自行选择
worker_connections #;    //每个进程能够接受的最大连接数(看worker数量,例如最大5万链接,有4个worker,则这里可以设置5120-10240,总量也就是2万到4万链接,不要满负载运行)

1
2
3
4
5
6
7

keepalive_timeout number;    //长连接的超时时长，默认为65s(问题:请求资源过大,还没传输完,时间超时,断开链接,如此重复.解决方法:提高带宽,压缩资源,加长超时时长)
keepalive_requests number;    //在一个长连接上所能够允许请求的最大资源数
keepalive_disable [msie6|safari|none];    //为指定类型的UserAgeng禁用长连接(列出来才会禁用)
tcp_nodelay on|off;    //是否对长连接使用TCP_NODELAY选项，为了提升用户体验，通常设为on(也就是不延迟)
client_header_timeout number;    //读取http请求报文首部的超时时长
client_body_timeout number;    //读取http请求报文body部分的超时时长
send_timeout number;    //发送响应报文的超时时长

1
2
3
4
5
6
7
8
9

location ~ \.php$ {
  root html;
  fastcgi_pass 127.0.0.1:9000;      //定义反向代理
  fastcgi_index index.php;
  fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
  include fastcgi_params;
}
这里的/scripts一般改成$document_root也就是网站默认家目录(变量名字做到见名知义)
开头是只匹配.php结尾的文件

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

http {//协议级别,这个配置文件只有一个http{},所以,想配置虚拟主机,可以'sed -ri /^http/a"\ \ \ \ include\ \ \ \ \ \ \ vhost.types;" /usr/local/nginx/conf/nginx.conf'在同级目录下加一个vhost.types写虚拟主机配置
  include mime.types;
  default_type application/octet-stream;
  keepalive_timeout 65;
  gzipon;
  upstream {//负载均衡配置
    ...
  }
  server {//服务器级别，每个server类似于httpd中的一个<VirtualHost>
    listen 80;
    server_name localhost;
    location / {//请求级别，类似于httpd中的<Location>，用于定义URL与本地文件系统的映射关系
      root html;(这里的html是'location /'的'/',要理清路径关系,比如要访问html/haha则可写成location /haha{root html;...})
      index index.html index.htm;
    }
  }
}

1
2
3
4
5

server {
  listen 80;(必须有的参数,也可以放在http{里面},这样的话,http里面的主机都监听Listen的端口) 
  server_name itw.design;
  root "/vhosts/web";(这里用的绝对路径)
}

1
2

listen address[:port];
listen port;

1
2
3

index index.php index.html;
error_page code [...] [=code] URI | @name` 根据http响应状态码来指明特用的错误页面，例如 `error_page 404 /404_customed.html
这个错误网页放在默认网页根下,也就是html下

1
2
3
4
5
6

log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
access_log  logs/access.log  main;

//注意：此处可用变量为nginx各模块内建变量,内建变量可自行百度

1
2
3

//功能：允许根据用户请求的URI来匹配定义的各location，匹配到时，此请求将被相应的location配置块中的配置所处理，例如做访问控制等功能

//语法：location [ 修饰符 ] pattern {......}

1
2
3
4
5
6

server {
  server_name itw.design;
  location /abc {
    ......
  }
}

1
2
3
4
5
6

server {
  server_name itw.design;
  location = /abc {
    ......
  }
}

1
2
3
4
5
6

server {
  server_name itw.design;
  location ~ ^/abc$ {
  ......
  }
}

1
2
3
4
5
6

server {
  server_name itw.design;
  location ~* ^/*.jpg$ {
    ......
  }
}

1

( location = 路径 ) --> ( location ^~ 路径 ) --> ( location ~ 正则 ) --> ( location ~* 正则 ) --> ( location 路径 )

1
2

allow 192.168.1.1/32 172.16.0.0/16;
deny all;

1
2

auth_basic "欢迎信息";
auth_basic_user_file "/path/to/user_auth_file"

1

username:password

1

htpasswd -c -m /path/to/.user_auth_file USERNAME

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

server {
  listen       443 ssl;
  server_name  itw.design;
  ssl_certificate      /etc/nginx/ssl/nginx.crt;(可用绝对路径,也可相对路径)
  ssl_certificate_key  /etc/nginx/ssl/nginx.key;
  ssl_session_cache    shared:SSL:1m;
  ssl_session_timeout  5m;
  ssl_ciphers  HIGH:!aNULL:!MD5;
  ssl_prefer_server_ciphers  on;
  location / {
    root   html;
    index  index.html index.htm;
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

location /status {
  stub_status {on | off};
  allow 192.168.0.0/16;最好是只允许自己主机访问:ip/32掩码
  deny all;
}

自定义监控取驻留连接值(越小越好):curl -s http://server_ip/status|awk 'NR==4 {print $NF}'
例如:
[root@localhost ~]# curl -s http://192.168.153.130/status
Active connections: 1 
server accepts handled requests
 32 32 62 
Reading: 0 Writing: 1 Waiting: 0 
[root@localhost ~]# curl -s http://192.168.153.130/status|awk 'NR==4 {print $NF}'
0

1
2
3
4

在nginx.conf添加下列定位
location /images {
                rewrite ^/images/(.*\.jpg)$ /img/$1 break;
        }

1
2
3
4
5
6
7
8

在nginx.conf添加下列定位(这个会重写客户端的url)
location /images {
                rewrite ^/images/(.*\.jpg)$ http://192.168.153.130/img/$1 break;
        }
location /img {
                root html;
        }
一开始访问http://192.168.153.130/images/1.jpg,自动跳转到http://192.168.153.130/img/1.jpg

1
2
3
4

在nginx.conf添加下列定位(这个会重写客户端的url)
location /blog {
                rewrite ^/blog/(.*)$ https://itwhs.github.io/index.html redirect;
        }

1
2
3
4

在nginx.conf添加下列定位(这个会重写客户端的url)
location /blog {
                rewrite ^/blog/(.*)$ https://itwhs.github.io/index.html redirect;
        }

1
2
3

^(hi|sir)$       //字符串为“hi sir”捕获的结果：$1=hi$2=sir

//这些被捕获的数据，在后面就可以当变量一样使用了

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

[root@localhost html]# mkdir MobileSafari MobileEdge SafariEdge Trident
[root@localhost html]# ll
总用量 8
-rw-r--r-- 1 root root 494 6月  11 17:12 50x.html
-rw-r--r-- 1 root root 612 6月  11 17:12 index.html
drwxr-xr-x 2 root root   6 6月  11 18:23 MobileEdge
drwxr-xr-x 2 root root   6 6月  11 18:23 MobileSafari
drwxr-xr-x 2 root root   6 6月  11 18:23 SafariEdge
drwxr-xr-x 2 root root   6 6月  11 18:23 Trident
[root@localhost html]# echo "MobileEdge" >MobileEdge/index.html
[root@localhost html]# echo "MobileSafari" >MobileSafari/index.html
[root@localhost html]# echo "SafariEdge" >SafariEdge/index.html
[root@localhost html]# echo "Trident" >Trident/index.html

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

        location / {
            root   html;
            index index.html;
                if ($http_user_agent ~ 'Mobile Safari/537.36 Edge/14.14263' ) {
                        rewrite ^(.*)$ /MobileEdge/$1 break;
                }

                if ($http_user_agent ~ "Mobile/15A5341f Safari/604.1" ) {
                        rewrite ^(.*)$ /MobileSafari/$1 break;
                }

                if ($http_user_agent ~ "Chrome/64.0.3282.140 Safari/537.36 Edge/18.17763" ) {
                        rewrite ^(.*)$ /SafariEdge/$1 break;
                }

                if ($http_user_agent ~ Trident) {
                        rewrite ^(.*)$ /Trident/$1 break;
                }
        }
        
        版本号可以直接写Chrome  Firefox  Safari  Trident等...

1
2
3
4
5
6

location ~* \.(jpg|gif|jpeg|png)$ {
  valid_referers none blocked itw.design;
  if ($invalid_referer) {
    rewrite ^/ http://itw.design/403.html;
  }
}

1

Http Proxy`模块，功能很多，最常用的是`proxy_pass`和`proxy_cache

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

准备工作:
[root@localhost html]# mkdir 8080 8090 800 8000
[root@localhost html]# echo 8080 >8080/index.html
[root@localhost html]# echo 800 >800/index.html
[root@localhost html]# echo 8090 >8090/index.html
[root@localhost html]# echo 8000 >8000/index.html
[root@localhost html]# vim /usr/local/nginx17/conf/nginx.conf
    server {
        listen 800;
        location / {
            root   html/800;
        }
    }
    server {
        listen 8000;
        location / {
            root   html/8000;
        }
    }
    server {
        listen 8080;
        location / {
            root   html/8080;
        }
    }
    server {
        listen 8090;
        location / {
            root   html/8090;
        }
    }
    upstream 192.168.153.130 {
        server 127.0.0.1:800 weight=4;
        server 127.0.0.1:8000 weight=3;
        server 127.0.0.1:8080 weight=2;
        server 127.0.0.1:8090;
    }
    server {
        location / {
    proxy_pass http://192.168.153.130;
        }
    }
这里的weight=n是权重,也就是800端口4个请求;8000端口3个请求;8080端口2个请求;8090端口1个请求,这里的'192.168.153.130'可换做公司域名,'127.0.0.1'可换做集群中其他主机ip地址,权重按需求和机器性能,合理配置
修改后:
upstream 192.168.153.130 {
        ip_hash;
        server 127.0.0.1:800 weight=4;
        server 127.0.0.1:8000 weight=3;
        server 127.0.0.1:8080 weight=2;
        server 127.0.0.1:8090;
    }
这种修改后,用本机验证一直是其中一个虚拟主机页面,没有再更改

1
2
3
4
5

server {
  location / {
    proxy_pass http://域名或IP;
  }
}

1
2
3
4
5
6

[root@localhost ~]# nginx -V
nginx version: nginx/1.16.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --user=nginx --group=nginx --with-debug --with-http_ssl_module --with-http_realip_module --with-http_image_filter_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_stub_status_module --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --with-pcre

1
2

[root@localhost ~]# wget http://nginx.org/download/nginx-1.17.0.tar.gz
[root@localhost ~]# wget https://github.com/openresty/echo-nginx-module/archive/v0.61.tar.gz

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

[root@localhost ~]# tar xf nginx-1.17.0.tar.gz 
[root@localhost ~]# tar xf v0.61.tar.gz 
[root@localhost ~]# ll
drwxrwxr-x  5 root root      174 8月   9 2017 echo-nginx-module-0.61
drwxr-xr-x  8 1001 1001      158 5月  21 22:24 nginx-1.17.0
-rw-r--r--  1 root root  1032978 5月  23 21:32 nginx-1.17.0.tar.gz
-rw-r--r--  1 root root    53155 6月  11 17:01 v0.61.tar.gz
[root@localhost ~]# cd nginx-1.17.0
[root@localhost ~]# cd nginx-1.17.0
[root@localhost nginx-1.17.0]# ./configure --prefix=/usr/local/nginx17 --user=nginx --group=nginx --with-debug --with-http_ssl_module --with-http_realip_module --with-http_image_filter_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_stub_status_module --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --with-pcre --add-module=../echo-nginx-module-0.61
.......
[root@localhost nginx-1.17.0]# make
此时2种方法升级,一是把objs里面的新编译的文件,替换到原有的文件,实现升级和加模块,这个方法不需要make install,二是直接把老版本的conf文件替换到新版本目录(下面演示的方法二)
[root@localhost nginx-1.17.0]# make install

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

[root@localhost nginx-1.17.0]# mv /usr/local/nginx17/conf/nginx.conf{,.origin}
[root@localhost nginx-1.17.0]# cp /usr/local/nginx/conf/nginx.conf /usr/local/nginx17/conf/
[root@localhost nginx-1.17.0]# pkill nginx
[root@localhost nginx-1.17.0]# /usr/local/nginx17/sbin/nginx 
[root@localhost nginx-1.17.0]# /usr/local/nginx17/sbin/nginx -V
nginx version: nginx/1.17.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx17 --user=nginx --group=nginx --with-debug --with-http_ssl_module --with-http_realip_module --with-http_image_filter_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_stub_status_module --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --with-pcre --add-module=../echo-nginx-module-0.61

1
2
3
4
5

[root@localhost ~]# vim /etc/profile.d/nginx.sh
export PATH=/usr/local/nginx17/sbin:$PATH
[root@localhost ~]# source /etc/profile.d/nginx.sh 
[root@localhost ~]# whereis nginx
nginx: /usr/local/nginx /usr/local/nginx17/sbin/nginx /usr/local/nginx/sbin/nginx