Nginx 常用配置速查

工作中 nginx 用得多,每次都去翻文档有点烦,这里整理一份速查表。复制粘贴就能用,前提是已经装好了 nginx。

1. 静态站点

server {
    listen 80;
    server_name example.com;

    root /var/www/example.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

2. 反向代理 Node / Go 应用

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 60s;
    }
}

3. WebSocket 反代

location /ws {
    proxy_pass http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

4. HTTPS(Let's Encrypt)

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 1d;

    root /var/www/example.com;
}

server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

5. 静态资源缓存

location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?)$ {
    expires 30d;
    add_header Cache-Control "public, max-age=2592000";
    access_log off;
}

6. gzip 压缩

gzip on;
gzip_min_length 1k;
gzip_comp_level 6;
gzip_types text/plain text/css text/javascript application/javascript
           application/json application/xml image/svg+xml;
gzip_vary on;

7. 简单限流

limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;

server {
    location /login {
        limit_req zone=one burst=20 nodelay;
        # ...
    }
}

8. 屏蔽特定路径

location ~ /\.(git|env|svn) {
    deny all;
    return 403;
}

location ~* /(wp-admin|phpmyadmin) {
    return 444;
}

9. 日志格式

log_format main '$remote_addr - $remote_user [$time_local] '
                '"$request" $status $body_bytes_sent '
                '"$http_referer" "$http_user_agent" '
                'rt=$request_time uct="$upstream_connect_time" '
                'urt="$upstream_response_time"';

access_log /var/log/nginx/access.log main;

10. 常用命令

sudo nginx -t               # 测配置
sudo nginx -s reload        # 重载(不中断)
sudo nginx -s stop          # 停止
sudo systemctl restart nginx
sudo tail -f /var/log/nginx/access.log

---

差不多就这些,够应付 90% 的日常场景了。复杂的集群、动态 upstream、GeoIP 之类的进阶用法下次单独写。