Nginx常用命令
1
2
3
4
| nginx -t
systemctl restart nginx
nginx -s reload
systemctl enable nginx
|
安装nginx
Debian/Ubuntu:
Centos:
1
2
| yum -y install epel-release
yum install nginx
|
卸载nginx：
卸载nginx：(centos)
1
2
3
4
5
6
7
8
9
10
11
12
|
service nginx stop
chkconfig nginx off
rm -rf /usr/sbin/nginx
rm -rf /etc/nginx
rm -rf /etc/init.d/nginx
yum remove nginx
whereis nginx
|
1
2
3
4
5
6
7
8
9
10
11
12
13
| systemctl start nginx
systemctl status nginx
systemctl enable nginx
systemctl disable nginx
systemctl stop nginx
systemctl restart nginx
systemctl reload nginx
nginx -s stop
nginx -s quit
nginx -s reload
nginx -t
nginx -v
nginx -V
|
编译nginx moudles
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
wget http://nginx.org/download/nginx-1.22.0.tar.gz
tar zxvf nginx-1.22.0.tar.gz
cd nginx-1.22.0
./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_sub_module --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-openssl-opt='enable-weak-ssl-ciphers' --with-ld-opt='-ljemalloc' --with-http_realip_module
make
cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.bak
cp objs/nginx /usr/local/nginx/sbin/nginx
sudo cp -rfp objs/nginx /usr/local/nginx/sbin/nginx
nginx -V
|
编译安装nginx
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| ./configure --with-http_ssl_module --with-http_gzip_static_module --with-http_realip_module --with-http_sub_module --with-pcre --with-http_ssl_module --with-debug --conf-path=/etc/nginx/nginx.conf \
--conf-path=/etc/nginx/nginx.conf \
--sbin-path=/usr/sbin/nginx \
--pid-path=/var/log/nginx/nginx.pid \
--error-log-path=/var/log/nginx/error.log \
--http-log-path=/var/log/nginx/access.log \
--modules-path=/usr/lib/nginx/modules \
./configure --prefix=/usr/local/nginx
make && make install
ln -s /usr/sbin/nginx /usr/local/bin/nginx
PATH=$PATH:/usr/local/bin
|
可能会遇到的问题
1
2
|
/usr/sbin/nginx -c /etc/nginx/nginx.conf
|
配置文件
nginx目录
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
| |-- conf.d
| |-- demo.com.conf
|-- fastcgi.conf
|-- fastcgi_params
|-- koi-utf
|-- koi-win
|-- mime.types
|-- modules-available
|-- modules-enabled
|-- nginx.conf
|-- proxy_params
|-- scgi_params
|-- sites-available
| `-- default
|-- sites-enabled
| `-- default -> /etc/nginx/sites-available/default
|-- snippets
| |-- fastcgi-php.conf
| `-- snakeoil.conf
|-- uwsgi_params
`-- win-utf
|
一般的网站配置文件的命名都是网站名.conf然后放入到/etc/nginx/conf.d/下，其实不然，因为在cat /etc/nginx/nginx.conf 发现有这样一句话 include /etc/nginx/conf.d/*.conf;
其实完全可以创建新的文件夹，只需要在nginx.conf里将文件夹路径添加进去就可以正常使用。
nginx.conf只对括号敏感，不需要遵守yaml的缩进。
nginx.conf 主文件详解 点击
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
| user www www;
worker_processes 2;
error_log logs/error.log;
pid logs/nginx.pid;
events {
use epoll;
worker_connections 2048;
}
http {
gzip on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.0;
gzip_comp_level 6;
gzip_types text/html text/plain text/css text/javascript application/json application/javascript application/x-javascript application/xml;
gzip_vary on;
map $http_x_forwarded_for $clientRealIp
{
"" $remote_addr;
~^(?P<firstAddr>[0-z\.]+),?.*$ $firstAddr;
}
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_connect_timeout 75;
proxy_send_timeout 75;
proxy_read_timeout 75;
proxy_buffer_size 4k;
proxy_buffers 4 32k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
proxy_temp_path /usr/local/nginx/proxy_temp 1 2;
upstream backend {
server 192.168.10.100:8080 max_fails=2 fail_timeout=30s ;
server 192.168.10.101:8080 max_fails=2 fail_timeout=30s ;
}
server {
listen 80;
server_name itoatest.example.com;
root /apps/oaapp;
charset utf-8;
access_log logs/host.access.log main;
location / {
root /apps/oaapp;
index index.jsp index.html index.htm;
proxy_pass http://backend;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
}
location ~* /download/ {
root /apps/oa/fs;
}
location ~ .*/.(gif|jpg|jpeg|bmp|png|ico|txt|js|css)$ {
root /apps/oaapp;
expires 7d;
}
location /nginx_status {
stub_status on;
access_log off;
allow 192.168.10.0/24;
deny all;
}
location ~ ^/(WEB-INF)/ {
deny all;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
include /etc/nginx/conf.d/*.conf;
}
|
1
2
3
4
5
6
7
8
9
10
| location指令说明
该指令用于匹配URL。·语法如下:
location [ = | ~ | ~*| ^~] uri {
}
1、= :用于不含正则表达式的uri前，要求请求字符串与uri.严格匹配，如果匹配成功，就停止继续向下搜索并立即处理该请求。
2、~:用于表示uri包含正则表达式，并且区分大小写。
3、~*用于表示 uri包含正则表达式，并且不区分大小写。
4、^~:用于不含正则表达式的uri前，要求 Nginx服务器找到标识uri和请求字
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
| location = /
{
[ configuration A ]
}
location /
{
[ configuration B ]
}
location /documents/
{
[ configuration C ]
}
location ~ /documents/Abc
{
[ configuration CC ]
}
location ^~ /images/
{
[ configuration D ]
}
location ~* \.(gif|jpg|jpeg)$
{
[ configuration E ]
}
location /images/
{
[ configuration F ]
}
location /images/abc
{
[ configuration G ]
}
location ~ /images/abc/
{
[ configuration H ]
}
( location = ) > ( location 完整路径 ) > ( location ^~ 路径 ) > ( location ,* 正则顺序 ) > ( location 部分起始路径 ) > ( / )
|
反代
反代http
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| server
{
listen 80;
server_name demo.com;
location /
{
proxy_pass http://127.0.0.1:9091;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header REMOTE-HOST $remote_addr;
add_header X-Cache $upstream_cache_status;
add_header Cache-Control no-cache;
}
}
|
反代https，这里以byr为例
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
| server
{
listen 80;
server_name demo.com xx2.com;
location /
{
proxy_pass https://byr.pt;
proxy_set_header Host byr.pt;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header REMOTE-HOST $remote_addr;
proxy_set_header Accept-Encoding "";
sub_filter "byr.pt" "demo.com";
sub_filter_once off;
proxy_ssl_server_name on;
add_header X-Cache $upstream_cache_status;
}
}
|
server配置拓展
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
| server
{
listen 80;
listen [::]:80;
server_name demo.com demo2.com;
include agent_deny.conf;
vim /etc/nginx/nginx.conf
server_tokens off;
1.http:
server
{
listen 80 default_server;
server_name _;
return 500;
}
2.https:
server
{
listen 443 default_server ssl;
server_name _;
ssl_certificate 随便设置一个ssl证书;
ssl_certificate_key 随便设置一个ssl证书的key;
return 500;
}
3.http&https:
server
{
listen 80 default_server;
listen 443 default_server ssl;
server_name _;
ssl_certificate 随便设置一个ssl证书;
ssl_certificate_key 随便设置一个ssl证书的key;
return 500;
}
if ($server_port !~ 443){
rewrite ^(/.*)$ https://$host$1 permanent;
}
if ($scheme = http) {
return 301 https://$server_name$request_uri;
}
location /
{
root /www/wwwroot/blog/;
index index.html;
}
location /dl
{
alias /home/user/dl/;
charset utf-8,gbk;
autoindex on;
autoindex_exact_size on;
autoindex_localtime on;
}
location /nginx-test
{
echo $clientRealIp;
}
rewrite ^/baidu(.*) https://www.baidu.com$1 permanent;
rewrite ^/baidu(.*) https://www.baidu.com$1 redirect;
rewrite ^/(.*)$ https://www.shyi.org/$1 permanent;
rewrite ^/(.*)$ https://www.shyi.org/$1 redirect;
if ($host ~ '^demo.com'){
return 301 https://www.baidu.com$request_uri;
}
}
|
root和alias的区别：
root的处理结果是：root路径＋location路径
alias的处理结果是：使用alias路径替换location路径
alias是一个目录别名的定义，root则是最上层目录的定义。还有一个重要的区别是alias后面必须要用”/“结束，否则会找不到文件的，而root则可有可无。
1
2
3
4
5
6
7
8
| location /dl
{
alias /home/user/downloads/;
}
|
重定向
1
2
3
4
5
6
7
8
9
| server
{
listen 80;
listen 443 ssl;
ssl_certificate pem;
ssl_certificate_key key;
server_name shyi.io www.shyi.io;
rewrite ^/(.*)$ https://www.shyi.org/$1 permanent;
}
|
agent_deny
需要“include agent_deny.conf;”，放在server或者location范围内。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
if ($http_user_agent ~* (Scrapy|Curl|HttpClient)) {
return 403;
}
if ($http_user_agent ~* "WinHttp|WebZIP|FetchURL|node-superagent|java/|FeedDemon|Jullo|JikeSpider|Indy Library|Alexa Toolbar|AskTbFXTV|AhrefsBot|CrawlDaddy|Java|Feedly|Apache-HttpAsyncClient|UniversalFeedParser|ApacheBench|Microsoft URL Control|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|lightDeckReports Bot|YYSpider|DigExt|HttpClient|MJ12bot|heritrix|EasouSpider|Ezooms|BOT/0.1|YandexBot|FlightDeckReports|Linguee Bot|^$") {
return 403;
}
#禁止非GET|HEAD|POST方式的抓取
if ($request_method !~ ^(GET|HEAD|POST)$){
return 403;
}
#禁止爬虫,if语句必须放在server或者location范围内，不能放在http范围内。
if ($http_user_agent ~* "qihoobot|Baiduspider|Googlebot|Googlebot-Mobile|Googlebot-Image|Mediapartners-Google|Adsbot-Google|Feedfetcher-Google|Yahoo! Slurp|Yahoo! Slurp China|YoudaoBot|Sosospider|Sogou spider|Sogou web spider|MSNBot|ia_archiver|Tomato Bot" ) {
return 403;
}
|
获取访客真实IP
- Remote Address：他是TCP中的概念，是无法伪造的，在应用程序中获取到的Remote Address值，是直接和应用服务器建立TCP连接的IP，可能是用户真实ip（用户直接访问应用服务器时），也可能是代理服务器（通过nginx负载均衡代理时）。
- 在有CDN的情况下，remote_addr获取的是最后一个与你握手的ip(CDN的ip)。
一、1.在nginx.conf或者site.conf里的非server{}添加如下
1
2
3
4
5
| log_format main '$http_x_forwarded_for- $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent"';
例如
|
2.添加main
1
| access_log /www/wwwlogs/test.log main;
|
二、1.需要在 http{}段 里添加（非server{}）
1
2
3
4
5
|
map $http_x_forwarded_for $clientRealIP{
“” $remote_addr;
~^(?P<firstAddr>[0-z\.]+),?.*$ $firstAddr; }
|
2.在nginx.conf或者site.conf里的非server{}添加如下
1
2
3
4
| log_format main '$clientRealIP- $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent"';
例如
|
3.在access_log后面添加main
1
| access_log /www/wwwlogs/test.log main;
|
1
| 这样改变不了"$remote_addr"的值，只需要在用到 "$remote_addr"改成$clientRealIP即可
|
最后 nginx -s reload即可。详情查看后续文章。
有一些变量需要改一下，比如map中的 $real , $clientRealIP
log_format main 中的 $real , $clientRealIP , $http_x_forwarded_for
log_format 和 map 要放在server{}以外
Nginx获取用户真实ip
搭建图床
nginx生成访问密码：
安装htpasswd工具：
1
2
3
4
5
| (yum安装)：yum -y install httpd-tools -y
(debian)：apt-get install apache2-utils -y
(离线安装)：rpm -ivh httpd-tools-2.4.6-88.el7.centos.x86_64.rpm
|
生成用户名和密码
1
2
3
4
5
6
7
8
| htpasswd -bc /home/htpasswd.pass admin 123456
htpasswd -b /home/htpasswd.pass user 123456
htpasswd -b /home/htpasswd.pass user 1234567
htpasswd -D /home/htpasswd.pass user
cat /home/htpasswd.pass
|
自签证书
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| openssl req \
-newkey rsa:2048 \
-x509 \
-nodes \
-keyout file.key \
-new \
-out file.crt \
-subj /CN=xxx.ccss.vip \
-reqexts SAN \
-extensions SAN \
-config <(cat /usr/local/openssl/openssl.cnf \
<(printf '[SAN]\nsubjectAltName=DNS:xxx.com,IP:11.11.11.11')) \
-sha256 \
-days 3650
|
引用：
部分参数参考自宝塔面板
Nginx 服务器安装及配置文件详解 | 菜鸟教程 (runoob.com)
Nginx 相关 | QuickBox Lite 知识库 (ptbox.dev)
搭建北邮人BT反代域名过程小记 - R酱小窝 ~ 个人博客 (rhilip.info)
使用nginx反代北邮人实现无IPV6环境访问北邮人 - carlo’ blogs (carloo.cc)
Nginx 反向代理 htpps 站点 502 排查思路 | 一小步 (smalloutcome.com)
nginx配置访问密码
centos nginx 卸载 - nickchou - 博客园 (cnblogs.com)
Nginx之location详解
文件路径 alias与root区别
Nginx重新编译添加模块_服务器应用_Linux公社-Linux系统门户网站 (linuxidc.com)
Nginx 限制单个IP的并发连接数/速度防止恶意攻击/蜘蛛爬虫采集
Nginx通过UserAgent屏蔽蜘蛛和采集
Nginx 挂CDN 如何获取真实访客IP地址
$_SERVER[“REMOTE_ADDR”] gives server IP rather than visitor IP