Nginx是目前最流行的Web服务器和反向代理服务器之一。本文通过实际配置案例，讲解Nginx最常用的三大功能：反向代理、HTTPS配置和负载均衡。
一、基础配置结构
# /etc/nginx/nginx.conf 主配置文件
user nginx;
worker_processes auto;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
# 日志格式
log_format main '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';
access_log /var/log/nginx/access.log main;
# 性能优化
sendfile on;
tcp_nopush on;
keepalive_timeout 65;
gzip on;
gzip_types text/plain text/css application/json application/javascript;
# 包含子配置
include /etc/nginx/conf.d/*.conf;
}二、反向代理配置
反向代理是Nginx最常用的场景，将请求转发到后端应用服务器。
# /etc/nginx/conf.d/proxy.confserver {
listen 80;
server_name example.com;
# 代理到Node.js应用
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# 代理到PHP-FPM
location ~ .php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
# 静态文件直接由Nginx处理
location ~* .(jpg|jpeg|png|gif|ico|css|js)$ {
expires 30d;
add_header Cache-Control "public, immutable";
}
}
三、HTTPS/SSL配置
使用Let's Encrypt免费证书配置HTTPS：
# 安装certbot
apt install certbot python3-certbot-nginx自动获取证书并配置
certbot --nginx -d example.com -d www.example.com
手动SSL配置：
server {
listen 443 ssl http2;
server_name example.com;
# SSL证书路径
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
# SSL安全配置
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
# HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https;
}
} HTTP强制跳转HTTPS
server {
listen 80;
server_name example.com;
return 301 https://$server_name$request_uri;
}
四、负载均衡配置
# 定义上游服务器组
upstream backend {
# 负载均衡策略
# 轮询（默认）
# least_conn; # 最少连接
# ip_hash; # IP哈希（会话保持）
server 192.168.1.10:8080 weight=3; # 权重
server 192.168.1.11:8080 weight=2;
server 192.168.1.12:8080 weight=1;
server 192.168.1.13:8080 backup; # 备用服务器
# 保持连接
keepalive 32;
}server {
listen 80;
server_name example.com;
location / {
proxy_pass http://backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
# 健康检查
proxy_connect_timeout 5s;
proxy_read_timeout 60s;
proxy_send_timeout 30s;
# 失败重试
proxy_next_upstream error timeout http_500 http_502 http_503;
}
}
五、常用运维命令
# 测试配置文件语法
nginx -t重新加载配置（不中断服务）
ginx -s reload
停止Nginx
nginx -s stop
优雅停止（处理完当前请求）
nginx -s quit
查看Nginx版本和编译参数
nginx -V
查看当前连接数
ss -s | grep estab | head -5
六、常见问题排查
# 502 Bad Gateway原因：后端服务未启动或端口不对
检查：curl http://127.0.0.1:3000
403 Forbidden
原因：文件权限不足
修复：chmod -R 755 /var/www/html
chown -R www-data:www-data /var/www/html
413 Request Entity Too Large
原因：上传文件超过限制
修复：在http或server块中添加
client_max_body_size 100m;
配置不生效
检查：nginx -t
重载：nginx -s reload
Nginx的配置非常灵活，以上是最常用的场景。建议先从反向代理开始，逐步添加HTTPS和负载均衡。
评论