Nginx常用基础配置

配置示例

upstream itriton {
    server 127.0.0.1:8001;
}
server {
    # 前端打包完放这边
    root /home/html;

    # 防止刷新404
    location / {
        try_files $uri $uri/ /index.html;
    }

    # 代理服务端地址，访问/api表示访问服务端接口而不是静态资源
    location /api/ {
        proxy_pass http://itriton/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header REMOTE-HOST $remote_addr;

        proxy_cache_bypass no_cache;

        # 缓存相关配置
        #proxy_cache cache_one;
        #proxy_cache_key $host$request_uri$is_args$args;
        #proxy_cache_valid 200 304 301 302 1h;

        # 持久化连接相关配置
        proxy_connect_timeout 3000s;
        proxy_read_timeout 86400s;
        proxy_send_timeout 3000s;
        #proxy_http_version 1.1;
        #proxy_set_header Upgrade $http_upgrade;
        #proxy_set_header Connection "upgrade";

        add_header X-Cache $upstream_cache_status;

        #expires 12h;
    }

    # socket需额外配置
    location /socket {
        proxy_pass http://itriton/socket;
        proxy_connect_timeout 3600s; # 配置点1
        proxy_read_timeout 3600s; # 配置点2，如果没效,可以考虑这个时间配置长一点
        proxy_send_timeout 3600s; # 配置点3
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header REMOTE-HOST $remote_addr;
        #proxy_bind $remote_addr transparent;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        rewrite /socket/(.*) /$1 break;
        proxy_redirect off;
    }
}

添加ssl证书

server {
    listen  443 ssl;
    server_name itriton.icjs.ink;
    
    # 添加ssl证书
    ssl_certificate certs/itriton.icjs.ink.crt;
    ssl_certificate_key certs/itriton.icjs.ink.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
    ssl_prefer_server_ciphers on;
    
    # 访问日志
    access_log /var/log/nginx/itriton.icjs.ink.https.log;
}

http重定向https

一般设置了https之后，需要将之前的http请求重定向到https

server {
    listen 80;
    server_name itriton.icjs.ink;
    rewrite ^(.*)$ https://$host$1 redirect;
}

后端服务接口

location /v1/ {
    proxy_pass http://127.0.0.1:8080/;
    proxy_read_timeout 30;
    proxy_redirect off;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header REMOTE-HOST $remote_addr;
}

最佳实践

/ 结束，请求转发到后端服务器后，不会携带 /v1/

访问日志

access_log /var/log/nginx/itriton.icjs.ink.https.log;

请求体大小

client_max_body_size 20m;

H5自动适配

通过修改变量$html_root来返回和调整不同的页面地址内容

# 前端页面
set $html_root /var/html/itriton.icjs.ink/;

# H5自动适配
if ($http_user_agent ~* (mobile|nokia|iphone|ipad|android|samsung|htc|blackberry)) {
    set $html_root /var/html/itriton.icjs.ink/h5/;
}

location / {
    root $html_root/www/;
    index index.html;
    try_files $uri $uri/ /index.html;
}

location /admin/ {
    root $html_root;
    index index.html;
    try_files $uri $uri/ /admin/index.html;
}

目录结构

/var/html/itriton.icjs.ink/
├── admin
│   └── index.html
├── www
│    └── index.html
└── h5
    ├── admin
    │   └── index.html
    └── www
        └── index.html

微信授权

location ~ .*.(txt) {
    root /etc/nginx/text;
}

WebSocket

location /v1/ {
    proxy_pass http://127.0.0.1:8080/;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
}

开启gzip

gzip on;
gzip_min_length 10k;
gzip_buffers 4 16k;
gzip_comp_level 5;
gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png;
gzip_vary off;
gzip_disable "MSIE [1-8]\.";

静态资源缓存

location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
    expires max;
    log_not_found off;
}