Nginx常用命令
1
2
3
4
| nginx -t
systemctl restart nginx
nginx -s reload
systemctl enable nginx
|
安装nginx
Debian/Ubuntu:
Centos:
1
2
| yum -y install epel-release
yum install nginx
|
卸载nginx：
卸载nginx：(centos)
1
2
3
4
5
6
7
8
9
10
11
12
|
service nginx stop
chkconfig nginx off
rm -rf /usr/sbin/nginx
rm -rf /etc/nginx
rm -rf /etc/init.d/nginx
yum remove nginx
whereis nginx
|
1
2
3
4
5
6
7
8
9
10
11
12
13
| systemctl start nginx
systemctl status nginx
systemctl enable nginx
systemctl disable nginx
systemctl stop nginx
systemctl restart nginx
systemctl reload nginx
nginx -s stop
nginx -s quit
nginx -s reload
nginx -t
nginx -v
nginx -V
|
编译nginx moudles
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
wget http://nginx.org/download/nginx-1.22.0.tar.gz
tar zxvf nginx-1.22.0.tar.gz
cd nginx-1.22.0
./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_sub_module --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-openssl-opt='enable-weak-ssl-ciphers' --with-ld-opt='-ljemalloc' --with-http_realip_module
make
cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.bak
cp objs/nginx /usr/local/nginx/sbin/nginx
sudo cp -rfp objs/nginx /usr/local/nginx/sbin/nginx
nginx -V
|
编译安装nginx
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| ./configure --with-http_ssl_module --with-http_gzip_static_module --with-http_realip_module --with-http_sub_module --with-pcre --with-http_ssl_module --with-debug --conf-path=/etc/nginx/nginx.conf \
--conf-path=/etc/nginx/nginx.conf \
--sbin-path=/usr/sbin/nginx \
--pid-path=/var/log/nginx/nginx.pid \
--error-log-path=/var/log/nginx/error.log \
--http-log-path=/var/log/nginx/access.log \
--modules-path=/usr/lib/nginx/modules \
./configure --prefix=/usr/local/nginx
make && make install
ln -s /usr/sbin/nginx /usr/local/bin/nginx
PATH=$PATH:/usr/local/bin
|
可能会遇到的问题
1
2
|
/usr/sbin/nginx -c /etc/nginx/nginx.conf
|
配置文件
nginx目录
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
| |-- conf.d
| |-- demo.com.conf
|-- fastcgi.conf
|-- fastcgi_params
|-- koi-utf
|-- koi-win
|-- mime.types
|-- modules-available
|-- modules-enabled
|-- nginx.conf
|-- proxy_params
|-- scgi_params
|-- sites-available
| `-- default
|-- sites-enabled
| `-- default -> /etc/nginx/sites-available/default
|-- snippets
| |-- fastcgi-php.conf
| `-- snakeoil.conf
|-- uwsgi_params
`-- win-utf
|
一般的网站配置文件的命名都是网站名.conf然后放入到/etc/nginx/conf.d/下，其实不然，因为在cat /etc/nginx/nginx.conf 发现有这样一句话 include /etc/nginx/conf.d/*.conf;
其实完全可以创建新的文件夹，只需要在nginx.conf里将文件夹路径添加进去就可以正常使用。
nginx.conf只对括号敏感，不需要遵守yaml的缩进。
nginx.conf 主文件详解 点击
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
| user www www;
worker_processes 2;
error_log logs/error.log;
pid logs/nginx.pid;
events {
use epoll;
worker_connections 2048;
}
http {
gzip on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.0;
gzip_comp_level 6;
gzip_types text/html text/plain text/css text/javascript application/json application/javascript application/x-javascript application/xml;
gzip_vary on;
map $http_x_forwarded_for $clientRealIp
{
"" $remote_addr;
~^(?P<firstAddr>[0-z\.]+),?.*$ $firstAddr;
}
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_connect_timeout 75;
proxy_send_timeout 75;
proxy_read_timeout 75;
proxy_buffer_size 4k;
proxy_buffers 4 32k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
proxy_temp_path /usr/local/nginx/proxy_temp 1 2;
upstream backend {
server 192.168.10.100:8080 max_fails=2 fail_timeout=30s ;
server 192.168.10.101:8080 max_fails=2 fail_timeout=30s ;
}
server {
listen 80;
server_name itoatest.example.com;
root /apps/oaapp;
charset utf-8;
access_log logs/host.access.log main;
location / {
root /apps/oaapp;
index index.jsp index.html index.htm;
proxy_pass http://backend;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
}
location ~* /download/ {
root /apps/oa/fs;
}
location ~ .*/.(gif|jpg|jpeg|bmp|png|ico|txt|js|css)$ {
root /apps/oaapp;
expires 7d;
}
location /nginx_status {
stub_status on;
access_log off;
allow 192.168.10.0/24;
deny all;
}
location ~ ^/(WEB-INF)/ {
deny all;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
include /etc/nginx/conf.d/*.conf;
}
|
1
2
3
4
5
6
7
8
9
10
| location指令说明
该指令用于匹配URL。·语法如下:
location [ = | ~ | ~*| ^~] uri {
}
1、= :用于不含正则表达式的uri前，要求请求字符串与uri.严格匹配，如果匹配成功，就停止继续向下搜索并立即处理该请求。
2、~:用于表示uri包含正则表达式，并且区分大小写。
3、~*用于表示 uri包含正则表达式，并且不区分大小写。
4、^~:用于不含正则表达式的uri前，要求 Nginx服务器找到标识uri和请求字
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
| location = /
{
[ configuration A ]
}
location /
{
[ configuration B ]
}
location /documents/
{
[ configuration C ]
}
location ~ /documents/Abc
{
[ configuration CC ]
}
location ^~ /images/
{
[ configuration D ]
}
location ~* \.(gif|jpg|jpeg)$
{
[ configuration E ]
}
location /images/
{
[ configuration F ]
}
location /images/abc
{
[ configuration G ]
}
location ~ /images/abc/
{
[ configuration H ]
}
( location = ) > ( location 完整路径 ) > ( location ^~ 路径 ) > ( location ,* 正则顺序 ) > ( location 部分起始路径 ) > ( / )
|
反代
反代http
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| server
{
listen 80;
server_name demo.com;
location /
{
proxy_pass http://127.0.0.1:9091;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header REMOTE-HOST $remote_addr;
add_header X-Cache $upstream_cache_status;
add_header Cache-Control no-cache;
}
}
|
反代https，这里以byr为例
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
| server
{
listen 80;
server_name demo.com xx2.com;
location ~ signup\.php { deny all; }
location /
{
proxy_pass https://byr.pt;
proxy_set_header Host byr.pt;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header REMOTE-HOST $remote_addr;
proxy_set_header Accept-Encoding "";
sub_filter "byr.pt" "demo.com";
sub_filter_once off;
proxy_ssl_server_name on;
add_header X-Cache $upstream_cache_status;
}
}
|
bloke_spyder.conf，位置为 /etc/nginx/bloke_spyder.conf
1
2
3
4
| if ($http_user_agent ~* "qihoobot|Baiduspider|Googlebot|Googlebot-Mobile|Googlebot-Image|Mediapartners-Google|Adsbot-Google|Feedfetcher-Google|Yahoo! Slurp|Yahoo! Slurp China|YoudaoBot|Sosospider|Sogou spider|Sogou web spider|MSNBot|ia_archiver|Tomato Bot" )
{
return 403;
}
|
server配置拓展
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
| server
{
listen 80;
listen [::]:80;
server_name demo.com demo2.com;
include agent_deny.conf;
http{
...
map $HTTP_CF_CONNECTING_IP $real {
"" $remote_addr;
default $HTTP_CF_CONNECTING_IP;
}
limit_conn_zone $real zone=perserver:10m;
limit_conn perserver 20;
limit_conn_log_level notice;
limit_req_zone $real zone=one:10m rate=15r/s;
limit_req_log_level notice;
limit_req_status 403;
limit_req zone=one burst=10 nodelay;
...
}
server{
...
...
}
vim /etc/nginx/nginx.conf
server_tokens off;
1.http:
server
{
listen 80 default_server;
server_name _;
return 500;
}
2.https:
server
{
listen 443 default_server ssl;
server_name _;
ssl_certificate 随便设置一个ssl证书;
ssl_certificate_key 随便设置一个ssl证书的key;
return 500;
}
3.http&https:
server
{
listen 80 default_server;
listen 443 default_server ssl;
server_name _;
ssl_certificate 随便设置一个ssl证书;
ssl_certificate_key 随便设置一个ssl证书的key;
return 500;
}
if ($server_port !~ 443){
rewrite ^(/.*)$ https://$host$1 permanent;
}
if ($scheme = http) {
return 301 https://$server_name$request_uri;
}
location /
{
root /www/wwwroot/blog/;
index index.html;
}
location /dl
{
alias /home/user/dl/;
charset utf-8,gbk;
autoindex on;
autoindex_exact_size on;
autoindex_localtime on;
}
location /nginx-test
{
echo $clientRealIp;
}
rewrite ^/baidu(.*) https://www.baidu.com$1 permanent;
rewrite ^/baidu(.*) https://www.baidu.com$1 redirect;
rewrite ^/(.*)$ https://shyi.org/$1 permanent;
rewrite ^/(.*)$ https://shyi.org/$1 redirect;
return 301 https://shyi.org$request_uri;
return 302 https://shyi.org$request_uri;
if ($host ~ '^demo.com') {
return 301 https://www.baidu.com$request_uri;
}
location /old {
return 301 http://example.com/new;
}
}
|
root和alias的区别：
root的处理结果是：root路径＋location路径
alias的处理结果是：使用alias路径替换location路径
alias是一个目录别名的定义，root则是最上层目录的定义。还有一个重要的区别是alias后面必须要用”/“结束，否则会找不到文件的，而root则可有可无。
1
2
3
4
5
6
7
8
| location /dl
{
alias /home/user/downloads/;
}
|
重定向
1
2
3
4
5
6
7
8
9
| server
{
listen 80;
listen 443 ssl;
ssl_certificate crt/pem;
ssl_certificate_key key;
server_name shyi.io www.shyi.io;
rewrite ^/(.*)$ https://shyi.org/$1 permanent;
}
|
agent_deny
需要“include agent_deny.conf;”，放在server或者location范围内。位置为/etc/nginx/agent_deny.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
if ($http_user_agent ~* (Scrapy|Curl|HttpClient))
{
return 403;
}
if ($http_user_agent ~* "WinHttp|WebZIP|FetchURL|node-superagent|java/|FeedDemon|Jullo|JikeSpider|Indy Library|Alexa Toolbar|AskTbFXTV|AhrefsBot|CrawlDaddy|Java|Feedly|Apache-HttpAsyncClient|UniversalFeedParser|ApacheBench|Microsoft URL Control|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|lightDeckReports Bot|YYSpider|DigExt|HttpClient|MJ12bot|heritrix|EasouSpider|Ezooms|BOT/0.1|YandexBot|FlightDeckReports|Linguee Bot|^$")
{
return 403;
}
# 禁止非GET|HEAD|POST方式的抓取
if ($request_method !~ ^(GET|HEAD|POST)$)
{
return 403;
}
# 禁止爬虫,if语句必须放在server或者location范围内，不能放在http范围内。
if ($http_user_agent ~* "qihoobot|Baiduspider|Googlebot|Googlebot-Mobile|Googlebot-Image|Mediapartners-Google|Adsbot-Google|Feedfetcher-Google|Yahoo! Slurp|Yahoo! Slurp China|YoudaoBot|Sosospider|Sogou spider|Sogou web spider|MSNBot|ia_archiver|Tomato Bot" )
{
return 403;
}
|
获取访客真实IP
- Remote Address：他是TCP中的概念，是无法伪造的，在应用程序中获取到的Remote Address值，是直接和应用服务器建立TCP连接的IP，可能是用户真实ip（用户直接访问应用服务器时），也可能是代理服务器（通过nginx负载均衡代理时）。
- 在有CDN的情况下，remote_addr获取的是最后一个与你握手的ip(CDN的ip)。
一、1.在nginx.conf或者site.conf里的非server{}添加如下
1
2
3
4
5
| log_format main '$http_x_forwarded_for- $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent"';
例如
|
2.添加main
1
| access_log /www/wwwlogs/test.log main;
|
二、1.需要在 http{}段 里添加（非server{}）
1
2
3
4
5
|
map $http_x_forwarded_for $clientRealIP{
"" $remote_addr;
~^(?P<firstAddr>[0-z\.]+),?.*$ $firstAddr; }
|
2.在nginx.conf或者site.conf里的非server{}添加如下
1
2
3
4
| log_format main '$clientRealIP- $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent"';
例如
|
3.在access_log后面添加main
1
| access_log /www/wwwlogs/test.log main;
|
1
| 这样改变不了"$remote_addr"的值，只需要在用到 "$remote_addr"改成$clientRealIP即可
|
最后 nginx -s reload即可。详情查看后续文章。
有一些变量需要改一下，比如map中的 $real , $clientRealIP
log_format main 中的 $real , $clientRealIP , $http_x_forwarded_for
log_format 和 map 要放在server{}以外
Nginx获取用户真实ip
搭建图床
nginx生成访问密码：
安装htpasswd工具：
1
2
3
4
5
| (yum安装)：yum -y install httpd-tools -y
(debian)：apt-get install apache2-utils -y
(离线安装)：rpm -ivh httpd-tools-2.4.6-88.el7.centos.x86_64.rpm
|
生成用户名和密码
1
2
3
4
5
6
7
8
| htpasswd -bc /home/htpasswd.pass admin 123456
htpasswd -b /home/htpasswd.pass user 123456
htpasswd -b /home/htpasswd.pass user 1234567
htpasswd -D /home/htpasswd.pass user
cat /home/htpasswd.pass
|
自签证书
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| openssl req \
-newkey rsa:2048 \
-x509 \
-nodes \
-keyout file.key \
-new \
-out file.crt \
-subj /CN=xxx.ccss.vip \
-reqexts SAN \
-extensions SAN \
-config <(cat /usr/local/openssl/openssl.cnf \
<(printf '[SAN]\nsubjectAltName=DNS:xxx.com,IP:11.11.11.11')) \
-sha256 \
-days 3650
|
引用：
部分参数参考自宝塔面板
Nginx 服务器安装及配置文件详解 | 菜鸟教程 (runoob.com)
Nginx 相关 | QuickBox Lite 知识库 (ptbox.dev)
搭建北邮人BT反代域名过程小记 - R酱小窝 ~ 个人博客 (rhilip.info)
使用nginx反代北邮人实现无IPV6环境访问北邮人 - carlo’ blogs (carloo.cc)
Nginx 反向代理 htpps 站点 502 排查思路 | 一小步 (smalloutcome.com)
nginx配置访问密码
centos nginx 卸载 - nickchou - 博客园 (cnblogs.com)
Nginx之location详解
文件路径 alias与root区别
Nginx重新编译添加模块_服务器应用_Linux公社-Linux系统门户网站 (linuxidc.com)
Nginx 限制单个IP的并发连接数/速度防止恶意攻击/蜘蛛爬虫采集
Nginx通过UserAgent屏蔽蜘蛛和采集
Nginx 挂CDN 如何获取真实访客IP地址
$_SERVER[“REMOTE_ADDR”] gives server IP rather than visitor IP
Google Public DNS IP addresses