Nginx Web 服务器

Nginx 是高性能的 HTTP 和反向代理服务器，在 RHEL 10 中作为默认 Web 服务器。本文涵盖从基础安装到生产部署的完整配置。

---

一、安装与启动

# 安装 Nginx
dnf install -y nginx

# 启动并开机自启
systemctl enable --now nginx

# 防火墙放行
firewall-cmd --add-service=http --permanent
firewall-cmd --add-service=https --permanent
firewall-cmd --reload

# SELinux 放行
setsebool -P httpd_can_network_connect on

核心目录

路径	说明
/etc/nginx/nginx.conf	主配置文件
/etc/nginx/conf.d/	额外配置目录
/usr/share/nginx/html/	默认网站根目录
/var/log/nginx/	日志目录

---

二、主配置文件结构

# /etc/nginx/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /run/nginx.pid;

events {
    worker_connections 1024;
    use epoll;                     # Linux 高性能事件模型
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # 日志格式
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent"';

    access_log /var/log/nginx/access.log main;

    sendfile on;
    tcp_nopush on;
    keepalive_timeout 65;
    gzip on;

    include /etc/nginx/conf.d/*.conf;
}

---

三、虚拟主机配置

基于域名的虚拟主机

server {
    listen 80;
    server_name www.example.com example.com;

    root /var/www/example;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }
}

多站点配置

# 每个站点一个独立配置文件
cat > /etc/nginx/conf.d/site1.conf << 'EOF'
server {
    listen 80;
    server_name site1.example.com;
    root /var/www/site1;
    index index.html;
}
EOF

cat > /etc/nginx/conf.d/site2.conf << 'EOF'
server {
    listen 80;
    server_name site2.example.com;
    root /var/www/site2;
    index index.html;
}
EOF

# 验证配置
nginx -t

# 重载
systemctl reload nginx

---

四、SSL/TLS 配置

生成自签名证书（测试用）

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/nginx/ssl/private.key \
  -out /etc/nginx/ssl/certificate.crt

HTTPS 站点配置

server {
    listen 443 ssl http2;
    server_name secure.example.com;

    ssl_certificate     /etc/nginx/ssl/certificate.crt;
    ssl_certificate_key /etc/nginx/ssl/private.key;

    # 现代 SSL 配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    root /var/www/secure;
    index index.html;
}

# HTTP 自动跳转 HTTPS
server {
    listen 80;
    server_name secure.example.com;
    return 301 https://$server_name$request_uri;
}

---

五、反向代理

基本反向代理

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

WebSocket 代理

location /ws/ {
    proxy_pass http://127.0.0.1:8080;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

---

六、负载均衡

# 上游服务器组
upstream backend {
    least_conn;                          # 最少连接算法
    server 192.168.1.10:8080 weight=3;   # 权重 3
    server 192.168.1.11:8080 weight=1;
    server 192.168.1.12:8080 backup;     # 备用服务器

    # 健康检查（商业版）
    # health_check interval=5s fails=3 passes=2;
}

server {
    listen 80;
    server_name lb.example.com;

    location / {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

负载均衡算法

算法	指令	说明
轮询	默认	依次分发
最少连接	least_conn	发给连接最少的服务器
IP 哈希	ip_hash	同一 IP 请求到同一服务器
加权	weight=N	按权重比例分发

---

七、访问控制

# IP 白名单/黑名单
location /admin/ {
    allow 192.168.1.0/24;
    allow 10.0.0.100;
    deny all;
}

# HTTP 基本认证
location /private/ {
    auth_basic "Restricted Area";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

# 创建用户密码文件
dnf install -y httpd-tools
htpasswd -c /etc/nginx/.htpasswd admin

---

八、日志与监控

# 实时查看访问日志
tail -f /var/log/nginx/access.log

# 查看错误日志
tail -f /var/log/nginx/error.log

# 统计状态码分布
awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn

# Top 10 IP
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

Stub Status 监控

location /nginx_status {
    stub_status;
    allow 127.0.0.1;
    deny all;
}

输出示例：

Active connections: 291
server accepts handled requests
 16630948 16630948 31070465
Reading: 6 Writing: 179 Waiting: 106

---

九、性能优化

# Worker 进程
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 4096;
    multi_accept on;
}

http {
    # 文件缓存
    open_file_cache max=10000 inactive=30s;
    open_file_cache_valid 60s;
    open_file_cache_min_uses 2;

    # Gzip 压缩
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml;
    gzip_min_length 1000;
    gzip_comp_level 6;

    # 缓冲区
    client_max_body_size 100m;
    client_body_buffer_size 128k;
}

---