Nginx 安装与配置指南

一、安装#

CentOS（yum）#

1
# 添加 Nginx 官方 YUM 源
2
rpm -ivh http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpm
3

4
# 安装 Nginx
5
yum install -y nginx
6

7
# 启动并设置开机自启
8
systemctl start nginx
9
systemctl enable nginx

Ubuntu / Debian（apt）#

1
apt install -y nginx
2
systemctl start nginx
3
systemctl enable nginx
4
nginx -t

二、主配置文件结构#

通常不会直接修改主配置文件，而是采用引入外部文件的方式管理多个站点。

1
http {
2
  # 注释掉默认的 include，防止 80 端口冲突
3
  # include /etc/nginx/conf.d/*.conf;
4

5
  # 引入自定义 HTTP 配置
6
  include /opt/nginx/http/*.conf;
7

8
  # 不限制文件上传大小
9
  client_max_body_size 0;
10
}
11

12
# TCP/UDP 代理（需要在 http 块外部）
13
stream {
14
  include /opt/nginx/server/*.conf;
15
}

三、静态站点 / Vue SPA#

1
server {
2
    listen 80;
3
    server_name example.com;
4
    root /opt/app/dist;
5
    index index.html;
6

7
    location / {
8
        try_files $uri $uri/ /index.html;
9
    }
10

11
    location /api/ {
12
        proxy_set_header Host $http_host;
13
        proxy_set_header X-Real-IP $remote_addr;
14
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
15
        proxy_set_header X-Forwarded-Proto $scheme;
16
        proxy_pass http://127.0.0.1:8080/;
17
    }
18
}

四、SSL / HTTPS#

1
server {
2
    listen 80;
3
    server_name example.com;
4
    return 301 https://$host$request_uri;
5
}
6

7
server {
8
    listen 443 ssl http2;
9
    server_name example.com;
10

11
    ssl_certificate        /opt/cert/example.com.pem;
12
    ssl_certificate_key    /opt/cert/example.com.key;
13
    ssl_protocols          TLSv1.1 TLSv1.2 TLSv1.3;
14
    ssl_ciphers            EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!MD5;
15
    ssl_prefer_server_ciphers on;
16
    ssl_session_cache      shared:SSL:10m;
17
    ssl_session_timeout    10m;
18
    add_header Strict-Transport-Security "max-age=31536000" always;
19

20
    root /opt/app/dist;
21
    index index.html;
22

23
    location / {
24
        try_files $uri $uri/ /index.html;
25
    }
26

27
    location /api/ {
28
        proxy_set_header Host $http_host;
29
        proxy_set_header X-Real-IP $remote_addr;
30
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
31
        proxy_set_header X-Forwarded-Proto $scheme;
32
        proxy_pass http://127.0.0.1:8080/;
33
    }
34
}

五、反向代理#

1
server {
2
    listen 80;
3
    server_name app.example.com;
4

5
    location / {
6
        proxy_set_header Host $http_host;
7
        proxy_set_header X-Real-IP $remote_addr;
8
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
9
        proxy_set_header X-Forwarded-Proto $scheme;
10
        proxy_connect_timeout 60s;
11
        proxy_send_timeout    600s;
12
        proxy_read_timeout    600s;
13
        proxy_pass http://127.0.0.1:3000;
14
    }
15
}

六、WebSocket 代理#

代理 WebSocket 服务时需额外设置 Upgrade 和 Connection 请求头，否则 WS 握手会失败。

1
map $http_upgrade $connection_upgrade {
2
    default upgrade;
3
    ''      close;
4
}
5

6
server {
7
    listen 80;
8
    server_name ws.example.com;
9

10
    location / {
11
        proxy_set_header Host $http_host;
12
        proxy_set_header X-Real-IP $remote_addr;
13
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
14
        proxy_set_header X-Forwarded-Proto $scheme;
15
        proxy_http_version 1.1;
16
        proxy_set_header Upgrade $http_upgrade;
17
        proxy_set_header Connection $connection_upgrade;
18
        proxy_connect_timeout 60s;
19
        proxy_read_timeout    3600s;
20
        proxy_send_timeout    3600s;
21
        proxy_pass http://127.0.0.1:3001;
22
    }
23
}

Tip

map 指令需放在 http 块内（通常在主配置文件中定义一次即可），用于自动将 HTTP 升级为 WebSocket 连接。proxy_read_timeout 建议设置较大值，防止长连接被提前断开。

七、TCP 流量转发（stream 模块）#

适用于转发 MySQL、Redis 等 TCP 服务。stream 块与 http 块同级。以 MySQL 为例（安装参见 CentOS MySQL 5.7 安装）：

1
upstream mysql3306 {
2
    hash $remote_addr consistent;
3
    server 192.168.1.58:3306 weight=5 max_fails=3 fail_timeout=30s;
4
}
5

6
server {
7
    listen 33306;
8
    proxy_connect_timeout 100s;
9
    proxy_timeout 500s;
10
    proxy_pass mysql3306;
11
}

Note

使用 stream 模块前需确认编译时包含了该模块：

1
nginx -V 2>&1 | grep with-stream

八、MinIO 反向代理#