下载地址：http://nginx.org/download/
NGINX_FILE=nginx-1.14.0.tar.gz NGINX_FILE_DIR=nginx-1.14.0 if [ "$1" -eq "1" ];then yum install -y gcc-c++ pcre pcre-devel zlib zlib-devel openssl openssl-devel --setopt=protected_multilib=false; if [ $? -eq 0 ];then groupadd -g 888 www; useradd -g www www -s /sbin/nologin -u 888; tar zxvf $NGINX_FILE; cd $NGINX_FILE_DIR; if [ $? -eq 0 ];then ./configure --user=www --group=www --prefix=/usr/local/nginx --with-http_stub_status_module --with-stream_ssl_module --with-http_ssl_module --with-stream; if [ $? -eq 0 ];then make && make install; echo " 33[32m $NGINX_FILE_DIR install success 33[0m" if [ $? -eq 0 ];then cd ../ cp init.d.nginx /etc/init.d/nginx chmod 777 /etc/init.d/nginx sed -i '65,71s/#//' /usr/local/nginx/conf/nginx.conf sed -i '66s/html//var/www/html/' /usr/local/nginx/conf/nginx.conf sed -i 's/scripts$fastcgi_script_name/$document_root$fastcgi_script_name/g' /usr/local/nginx/conf/nginx.conf echo " 33[32m $NGINX_FILE_DIR install done 33[0m" else echo " 33[32m conf moddify failed 33[0m" fi else echo " 33[32m make install failed 33[0m" exit 0 fi else echo " 33[32m configure failed 33[0m" exit 0 fi fi fi
1.配置在http段针对全局 http{ limit_req_zone $binary_remote_addr zone=one:10m rate=2r/s; 单个IP每秒限制2个请求 limit_req zone=one burst=5 nodelay; 请求突刺5个，无延迟 limit_req_status 503; 限流返回状态码 }; 2. 配置在server段针对固定location http{ limit_req_zone $binary_remote_addr zone=one:10m rate=2r/s; 单个IP每秒限制2个请求 server { location /py { limit_req zone=one burst=5 nodelay; 请求突刺5个，无延迟 limit_req_log_level warn; 日志级别设置为warn limit_req_status 503; 限流返回状态码 } } };
http{ #限流并发 upstream node{ server 127.0.0.1:8080 max_conns=1; } } Server{ location /py { proxy_pass http://node/;注意：如果少了一个/ 会将请求转发到8080的/py路径下 } error_page 502 503 https://fund/b.html; 限流界面 }
需求后端无法上网，前端能上网，后端通过前端nginx反向代理访问
1、前端配置识别路径后转发（适合https转发） server{ listen 80; server_name localhost; location /centos { proxy_pass http://mirrors.163.com/centos/; } } 例子2： location ^~ /mp/ { #proxy_cache api_cache; proxy_set_header Host mp.weixin.qq.com; rewrite /mp/(.+)$ /$1 break; proxy_pass https://mp.weixin.qq.com; }
2、前端配置根据请求域名转发（适合http转发）
例子1： server{ listen 80; server_name mirrors.163.com; location /centos { proxy_pass http://mirrors.163.com; } }
无法访问数据库只能通过前端机器去访问，首先前端机器开启3306端口映射将请求直接转发到对应内网机器的3306端口。
#user nobody; worker_processes 1; stream{ proxy_timeout 30m; server{ listen 3306; proxy_pass 192.168.1.30:3306; } ｝
1、访问某个项目路径转发到后端对应端口 location ^~ /wxInterfaceFnt { proxy_pass http://192.168.3.196; proxy_redirect off; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } 2、访问php文件转发到对应的php解析 location ^~ /wxInterfaceFnt { root /var/www/html; fastcgi_pass 192.168.3.196:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /$document_root$fastcgi_script_name; include fastcgi_params; } 后端修改配置文件 php-fpm.conf 后端nginx listen = 127.0.0.1:9000 listen = 192.168.3.196:9000 location ~ .php$ { root /var/www/html; fastcgi_pass 192.168.3.196:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /$document_root$fastcgi_script_name; include fastcgi_params; }
1、项目限制IP，同时允许的IP需要能够访问php location ^~ /jiaoyin_diaries_fnt/app/manage/ { allow 119.; allow 221.; allow 180.; allow 119.; deny all; location ~ .php$ { root /var/www/html; fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } }
需求：负载机器转发到前端的是内网请求，需要修改配置 服务器 A 的转发配置（负载） location ^~ /namesg/ { proxy_pass http://172.16.16.11; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; } 服务器 B 的 nginx.conf log 配置（前端） log_format my_format '$http_x_real_ip -' '$remote_addr- [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log logs/access.log my_format;
访问报错：
1转发到php-fpm的请求提示file not found
Nginx配置 root /var/www/html;
ssl配置
ssl on;
ssl_certificate /usr/local/nginx/conf/sogood.crt;
ssl_certificate_key /usr/local/nginx/conf/sogood.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ALL:!DH:!EXPORT:!RC4:+HIGH:+MEDIUM:-LOW:!aNULL:!eNULL;
ssl_prefer_server_ciphers on;
上传文件限制（Request Entity Too Large）
http { include mime.types; default_type application/octet-stream; include blacklist.conf; #文件上传大小，默认1M client_max_body_size 20m;
2 ginx
upstream sent too big header while reading response header from upstream
server{
proxy_buffer_size 64k;
proxy_buffers 4 32k;
proxy_busy_buffers_size 64k;
}
3 ginx 出现504 Gateway Time-out的解决方法
转发到其他端口超时设置
proxy_connect_timeout 300;
proxy_send_timeout 300;
proxy_read_timeout 300;
php转发超时设置
keepalive_timeout 300;
fastcgi_connect_timeout 6000;
fastcgi_send_timeout 6000;
fastcgi_read_timeout 6000;
fastcgi_buffer_size 256k;
fastcgi_buffers 8 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
限流配置参考
https://www.jianshu.com/p/2cf3d9609af3
https://www.cnblogs.com/biglittleant/p/8979915.html
https://blog.csdn.net/qq_31226223/article/details/78766314