Nginx基本用法篇二

一、nginx安装

1. yum 安装

yum install nginx

 2.编译安装

    useradd nginx -r -s /sbin/nologin 
　　wget http://nginx.org/download/nginx-1.12.2.tar.gz 
　　tar xf nginx-1.12.2.tar.gz 
　　cd nginx-1.12.2 
　　./configure –prefix=/usr/local/nginx –conf-path=/etc/nginx/nginx.conf –error-log-path=/var/log/nginx/error.log –http-log-path=/var/log/nginx/access.log  
–pid-path=/var/run/nginx.pid –lock-path=/var/run/nginx.lock –user=nginx –group=nginx –with-http_ssl_module –with-http_v2_module –with-http_dav_module  
–with-http_stub_status_module –with-threads –with-file-aio
    make && make install

二、nginx虚拟主机三种实现方式

虚拟主机的实现方式有三种。

    基于多ip
    基于多端口
    基于多虚拟主机名

1. 安装nginx 

[root@localhost ~]# yum install nginx

 方案1-基于多ip

# 查看ip信息
[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
    valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:b3:02:e2 brd ff:ff:ff:ff:ff:ff
    inet 192.168.46.151/24 brd 192.168.46.255 scope global ens33
    valid_lft forever preferred_lft forever
    inet6 fe80::df7e:1d50:d858:d479/64 scope link
    valid_lft forever preferred_lft forever
3: ens37: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:b3:02:ec brd ff:ff:ff:ff:ff:ff
    inet 172.18.46.151/16 brd 172.18.255.255 scope global ens37
    valid_lft forever preferred_lft forever
    inet6 fe80::f0f5:59a9:d186:e6a7/64 scope link
    valid_lft forever preferred_lft forever

# 构建主页
[root@localhost nginx]# pwd
/usr/share/nginx
[root@localhost nginx]# mkdir multi_ip_1
[root@localhost nginx]# mkdir multi_ip_2
[root@localhost nginx]# echo multi_ip_1 >> multi_ip_1/index.html
[root@localhost nginx]# echo multi_ip_2 >> multi_ip_2/index.html

# 编辑配置文件
[root@localhost ~]# cd /etc/nginx/conf.d/
[root@localhost conf.d]# ls
[root@localhost conf.d]# vim multi_ip.conf
[root@localhost conf.d]# cat multi_ip.conf
server    {
    listen 172.18.46.151:80;
    root   /usr/share/nginx/multi_ip_1;
}
server    {
    listen 192.168.46.151:80;
    root   /usr/share/nginx/multi_ip_2;
}

# 测试下
[root@localhost conf.d]# systemctl restart nginx
[root@localhost conf.d]# curl 172.18.46.151
multi_ip_1
[root@localhost conf.d]# curl 192.168.46.151
multi_ip_2

方案2-基于多port

# 编辑配置文件
[root@localhost conf.d]# cp multi_ip.conf multi_port.conf
[root@localhost conf.d]# vim multi_port.conf
[root@localhost conf.d]# cat multi_port.conf
server    {
    listen 172.18.46.151:81;
    root   /usr/share/nginx/multi_port_1;
}
server    {
    listen 172.18.46.151:82;
    root   /usr/share/nginx/multi_port_2;
}

# 构建主页

[root@localhost conf.d]# cd /usr/share/nginx/
[root@localhost nginx]# ls
html  modules  multi_ip_1  multi_ip_2
[root@localhost nginx]# mkdir multi_port_1
[root@localhost nginx]# mkdir multi_port_2
[root@localhost nginx]# echo "multi_port_1" > multi_port_1/index.html
[root@localhost nginx]# echo "multi_port_2" > multi_port_2/index.html

# 测试下
[root@localhost nginx]# systemctl restart nginx
[root@localhost nginx]# curl 172.18.46.151:81
multi_port_1
[root@localhost nginx]# curl 172.18.46.151:82
multi_port_2

方案3-基于多虚拟主机名

这种方式是用的比较多的。

# 其他影响的配置文件备份下
[root@localhost conf.d]# mv multi_host.conf{,.bak}
[root@localhost conf.d]# mv multi_ip.conf{,.bak}

# 编辑配置文件
[root@localhost conf.d]# cp multi_ip.conf multi_host.conf
[root@localhost conf.d]# vim multi_host.conf
[root@localhost conf.d]# cat multi_host.conf
server    {
    listen 80;
    server_name www.linuxpanda.tech;
    root   /usr/share/nginx/multi_host_1;
}
server    {
    listen 80;
    server_name blog.linuxpanda.tech;
    root   /usr/share/nginx/multi_host_2;
}

# 创建主页
[root@localhost conf.d]# cd /usr/share/nginx/
[root@localhost nginx]# ls
html  modules  multi_ip_1  multi_ip_2  multi_port_1  multi_port_2
[root@localhost nginx]# mkdir multi_host_1
[root@localhost nginx]# mkdir multi_host_2
[root@localhost nginx]# echo "multi_host_1" > multi_host_1/index.html
[root@localhost nginx]# echo "multi_host_2" > multi_host_2/index.html

# 测试
虚拟主机需要配合dns解析使用的， 我这里就简单点使用hosts文件解析了。
[root@localhost conf.d]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.46.151 www.linuxpanda.tech blog.linuxpanda.tech

[root@localhost conf.d]# systemctl restart nginx
[root@localhost conf.d]# curl www.linuxpanda.tech
multi_host_1
[root@localhost conf.d]# curl blog.linuxpanda.tech
multi_host_2

三、nginx支持https
1、安装nginx

[root@localhost ~]# yum install nginx

2、 配置

[root@localhost conf.d]# cd /etc/pki/tls/certs/
[root@localhost certs]# ls
ca-bundle.crt  ca-bundle.trust.crt  make-dummy-cert  Makefile  renew-dummy-cert
[root@localhost certs]# make www.crt
umask 77 ; 
/usr/bin/openssl genrsa -aes128 2048 > www.key
Generating RSA private key, 2048 bit long modulus
...................................+++
..........................+++
e is 65537 (0x10001)
Enter pass phrase:
Verifying - Enter pass phrase:
umask 77 ; 
/usr/bin/openssl req -utf8 -new -key www.key -x509 -days 365 -out www.crt
Enter pass phrase for www.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:henan
Locality Name (eg, city) [Default City]:zhenzhou
Organization Name (eg, company) [Default Company Ltd]:linuxpanda.tech
Organizational Unit Name (eg, section) []:opt
Common Name (eg, your name or your server's hostname) []:www.linuxpanda.tech
Email Address []:
[root@localhost certs]# ll
total 20
lrwxrwxrwx. 1 root root   49 Jan 11 01:00 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
lrwxrwxrwx. 1 root root   55 Jan 11 01:00 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
-rwxr-xr-x. 1 root root  610 Aug  4  2017 make-dummy-cert
-rw-r--r--. 1 root root 2516 Aug  4  2017 Makefile
-rwxr-xr-x. 1 root root  829 Aug  4  2017 renew-dummy-cert
-rw-------  1 root root 1359 Mar 15 18:00 www.crt
-rw-------  1 root root 1766 Mar 15 17:59 www.key
[root@localhost certs]# openssl rsa -in www.key -out www2.key
Enter pass phrase for www.key:
writing RSA key
[root@localhost certs]# ll
total 24
lrwxrwxrwx. 1 root root   49 Jan 11 01:00 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
lrwxrwxrwx. 1 root root   55 Jan 11 01:00 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
-rwxr-xr-x. 1 root root  610 Aug  4  2017 make-dummy-cert
-rw-r--r--. 1 root root 2516 Aug  4  2017 Makefile
-rwxr-xr-x. 1 root root  829 Aug  4  2017 renew-dummy-cert
-rw-r--r--  1 root root 1675 Mar 15 18:00 www2.key
-rw-------  1 root root 1359 Mar 15 18:00 www.crt
-rw-------  1 root root 1766 Mar 15 17:59 www.key
[root@localhost certs]# mkdir /etc/nginx/conf.d/ssl
[root@localhost certs]# cp www2.key /etc/nginx/conf.d/ssl/www.key
[root@localhost certs]# cp www.crt /etc/nginx/conf.d/ssl/
[root@localhost certs]# cd /etc/nginx/conf.d/
[root@localhost conf.d]# ls
bak  ssl  vhosts.conf
[root@localhost conf.d]# vim vhosts.conf
[root@localhost conf.d]# cat vhosts.conf
server {
    listen 443 ssl;
    server_name www.linuxpanda.tech;
    root /usr/share/nginx/multi_host_1;

    ssl on ;
    ssl_certificate /etc/nginx/conf.d/ssl/www.crt;
    ssl_certificate_key /etc/nginx/conf.d/ssl/www.key;
    ssl_session_cache  shared:sslcache:20m;
    ssl_session_timeout 10m;

}

3、 测试

[root@localhost conf.d]# curl https://www.linuxpanda.tech -k
multi_host_1

四、 nginx常用案例

 1、 反向代理http和负载均衡

代理就是中介，那有反向代理就有正向代理，两者的区别是什么嘞？

          正向代理隐藏真实客户端，服务端不知道实际发起请求的客户端.，proxy和client同属一个LAN，对server透明；

          反向代理隐藏真实服务端，客户端不知道实际提供服务的服务端，proxy和server同属一个LAN，对client透明。

基本配置项　

 　（1）proxy_pass

             将当前请求反向代理到URL参数指定的服务器上

      （2）proxy_method

            表示转发时的协议方法名

           proxy_method POST;       客户端转发来的GET请求在转发时方法名会改为POST请求

       （3）proxy_redirect

           当上游服务器返回的响应是重定向或者刷新请求（HTTP响应码是301或者302），可以重设HTTP头部的location或refresh

           proxy_redirect    http://location:8000/two/  http://location:8000/noe/

         （4）proxy_next_upstream

           当上游服务器请求出现错误，继续换一台服务器转发请求。     

　　　　error:在与服务器建立连接，向其传递请求或读取响应标头时发生错误;

　　　　timeout:在与服务器建立连接，向其传递请求或读取响应头时发生超时

　　　　invalid_header:服务器返回空响应或无效响应;

　　　　http_500:服务器返回了带有代码500的响应;

　　　　http_502:服务器返回具有代码502的响应;

　　　　HTTP_503:服务器返回具有代码503的响应;

　　　　http_504:服务器返回具有代码504的响应；

　　　　http_403:服务器返回带有代码403的响应;

　　　　http_404:服务器返回具有代码404的响应;

　　　　off:禁用将请求传递到下一个服务器。

         示例：

             #当其中一台返回错误码404,500...等错误时，可以分配到下一台服务器程序继续处理，提高平台访问成功率，多可运用于前台程序负载，设置proxy_next_upstream

      　　proxy_next_upstream http_500 | http_502 | http_503 | http_504 |http_404;

            #proxy_next_upstream off   关闭向下转发请求

[root@localhost conf.d]# vim vhosts.conf

    upstream backend {
        server 172.18.46.152    weight=5;
        server 172.18.46.153;

    }

    server {
        listen 172.18.46.151:80;
        location / {
            proxy_pass http://backend;
        }
    }

[root@localhost conf.d]# for i in {1..10} ; do curl 172.18.46.151; done;
153
152
152
152
152
152
153
152
152
152

2、 反向代理mysql

stream {
    upstream mysqlsrvs {
    server 192.168.22.2:3306;
    server 192.168.22.3:3306;
    least_conn;
}
    server {
        listen 10.1.0.6:3306;
        proxy_pass mysqlsrvs;
    }
}

3、 动静分离

server {
        listen 80;
        server_name www.linuxpanda.tech.com;
        root /data/web1/;
        location / {
                proxy_pass http://172.18.46.152;
        }
        location ~* .php$ {
                proxy_pass http://172.18.46.153;
        }
}

4、 防盗链

server {
        server_name www.b.com;
        root /data/web2;
        valid_referers none block server_names *.b.com  b.*  ~.baidu.;
        if ($invalid_referer) {
                return 403 http://www.magedu.com/;
        }
}

5、 代理服务器的缓存功能

server {
        listen 80;
        server_name www.linuxpanda.tech;
        root /data/web1/;

        proxy_cache proxycache;
        proxy_cache_key $request_uri;
        proxy_cache_valid 200 302 301 1h;
        proxy_cache_valid any 1m;

        add_header X-Via $server_addr;
        add_header X-Cache $upstream_cache_status;
        add_header X-Accel $server_name;

        location / {
                proxy_pass http://192.168.27.17;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        location ~* .php$ {
                proxy_pass http://192.168.27.6;
        }
}