Nginx 安装指南

# 检查是否已安装 Nginx
nginx -v
systemctl status nginx
rpm -qa | grep nginx
​
# 如已安装旧版，先停止并卸载
sudo systemctl stop nginx
sudo systemctl disable nginx
sudo dnf remove nginx
​
# 清理残留配置（可选，建议先备份）
sudo cp -r /etc/nginx /backup/nginx-old-$(date +%Y%m%d)
sudo rm -rf /etc/nginx
sudo rm -rf /var/log/nginx
sudo rm -rf /var/cache/nginx
​
# 清理可能的旧仓库
sudo rm -f /etc/yum.repos.d/nginx.repo
​
# 验证
which nginx 2>/dev/null && echo '未清理干净！' || echo '已清理干净'
ss -tlnp | grep -E ':80 |:443 '

sudo firewall-cmd --permanent --add-service=http    # 80
sudo firewall-cmd --permanent --add-service=https   # 443
sudo firewall-cmd --reload

# 查看当前状态
getenforce
​
# 如果是 Enforcing，需允许 Nginx 网络连接（反向代理必需）
sudo setsebool -P httpd_can_network_connect 1
​
# 如果 Nginx 需要访问非标准目录
sudo setsebool -P httpd_read_user_content 1

# 安装依赖
sudo dnf install -y dnf-utils
​
# 创建仓库文件
cat > /etc/yum.repos.d/nginx.repo <<'EOF'
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
​
[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
EOF
​
# 默认使用 stable 稳定版
# 如需切换到 mainline 主线版：
# sudo yum-config-manager --enable nginx-mainline

sudo dnf install -y nginx
​
# 验证版本
nginx -v
# 应显示: nginx version: nginx/1.28.x

sudo systemctl enable nginx
sudo systemctl start nginx
sudo systemctl status nginx
​
# 验证：浏览器访问 http://<服务器IP> 应看到 Nginx 欢迎页
curl -I http://localhost
# 应返回 HTTP/1.1 200 OK

sudo dnf install -y gcc make pcre2-devel openssl-devel zlib-devel wget

cd /opt
wget https://nginx.org/download/nginx-1.28.3.tar.gz
tar -xzf nginx-1.28.3.tar.gz
cd nginx-1.28.3
​
# 配置（常用选项）
./configure \
  --prefix=/etc/nginx \
  --sbin-path=/usr/sbin/nginx \
  --modules-path=/usr/lib64/nginx/modules \
  --conf-path=/etc/nginx/nginx.conf \
  --error-log-path=/var/log/nginx/error.log \
  --http-log-path=/var/log/nginx/access.log \
  --pid-path=/var/run/nginx.pid \
  --lock-path=/var/run/nginx.lock \
  --with-http_ssl_module \
  --with-http_v2_module \
  --with-http_v3_module \
  --with-http_realip_module \
  --with-http_gzip_static_module \
  --with-http_stub_status_module \
  --with-stream \
  --with-stream_ssl_module
​
make
sudo make install

[Unit]
Description=The NGINX HTTP and reverse proxy server
After=syslog.target network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/var/run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/sbin/nginx
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable nginx
sudo systemctl start nginx

docker run -d \
  --name nginx \
  -p 80:80 \
  -p 443:443 \
  nginx:stable
​
# 验证
curl -I http://localhost

# docker-compose-nginx.yml
version: '3.8'
services:
  nginx:
    image: nginx:stable
    container_name: nginx-server
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./conf.d:/etc/nginx/conf.d:ro
      - ./html:/usr/share/nginx/html:ro
      - ./certs:/etc/nginx/certs:ro
      - nginx-logs:/var/log/nginx
      - nginx-cache:/var/cache/nginx
    environment:
      - TZ=Asia/Shanghai
    deploy:
      resources:
        limits:
          memory: 512m
​
volumes:
  nginx-logs:
  nginx-cache:

# 创建目录结构
mkdir -p conf.d html certs
​
# 启动
docker compose -f docker-compose-nginx.yml up -d
​
# 重载配置（无需重启容器）
docker exec nginx-server nginx -s reload
​
# 查看日志
docker logs -f nginx-server

# ==========================================
#  Nginx 生产环境主配置 /etc/nginx/nginx.conf
# ==========================================

user  nginx;
worker_processes  auto;                    # 自动匹配 CPU 核心数
worker_rlimit_nofile 65535;                # 单进程最大文件描述符

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  65535;              # 单进程最大并发连接数
    multi_accept on;                       # 一次接受多个连接
    use epoll;                             # Linux 高性能事件模型
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    # ---------- 日志格式 ----------
    log_format main '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent" '
                    '$request_time $upstream_response_time';

    access_log  /var/log/nginx/access.log  main;

    # ---------- 性能优化 ----------
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;
    keepalive_requests 1000;
    types_hash_max_size 2048;

    # ---------- Gzip 压缩 ----------
    gzip  on;
    gzip_min_length 1k;
    gzip_comp_level 4;
    gzip_vary on;
    gzip_proxied any;
    gzip_types text/plain text/css application/json application/javascript
               text/xml application/xml application/xml+rss text/javascript
               image/svg+xml;

    # ---------- 安全头 ----------
    server_tokens off;                     # 隐藏版本号
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";

    # ---------- 客户端限制 ----------
    client_max_body_size 50m;              # 上传文件大小限制
    client_body_buffer_size 128k;
    client_header_buffer_size 4k;
    large_client_header_buffers 4 16k;

    # ---------- 代理缓冲 ----------
    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;
    proxy_temp_file_write_size 256k;

    # ---------- 虚拟主机 ----------
    include /etc/nginx/conf.d/*.conf;
}

# 验证配置语法（修改后必做！）
sudo nginx -t
# 应输出: syntax is ok / test is successful
​
# 平滑重载（不中断服务）
sudo nginx -s reload
​
# 或通过 systemctl
sudo systemctl reload nginx

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com/html;
    index index.html index.htm;

    # 静态资源缓存
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2|svg)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    # 防止访问隐藏文件
    location ~ /\. {
        deny all;
    }

    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;
}

upstream backend_api {
    server 127.0.0.1:8080;
    # 多节点负载均衡
    # server 192.168.1.11:8080;
    # server 192.168.1.12:8080;
    keepalive 32;                          # 长连接池
}

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://backend_api;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Connection "";

        # 超时设置
        proxy_connect_timeout 10s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
}

upstream app_cluster {
    # 默认轮询（Round Robin）
    server 192.168.1.11:8080 weight=3;     # 权重
    server 192.168.1.12:8080 weight=2;
    server 192.168.1.13:8080 backup;       # 备用节点

    # 其他策略：
    # least_conn;                          # 最少连接
    # ip_hash;                             # IP 哈希（会话保持）
    # hash $request_uri consistent;        # 一致性哈希
}

location /ws/ {
    proxy_pass http://backend_api;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_read_timeout 3600s;              # WebSocket 长连接超时
}

# 安装 Certbot
sudo dnf install -y certbot python3-certbot-nginx
​
# 自动申请并配置（Nginx 插件会自动修改配置）
sudo certbot --nginx -d example.com -d www.example.com
​
# 验证自动续期
sudo certbot renew --dry-run
​
# 自动续期由 systemd timer 管理
sudo systemctl list-timers | grep certbot

# HTTP -> HTTPS 强制跳转
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

# HTTPS 主配置
server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    # 证书文件
    ssl_certificate     /etc/nginx/certs/example.com.crt;
    ssl_certificate_key /etc/nginx/certs/example.com.key;

    # SSL 安全参数
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;

    # HSTS（严格传输安全，启用后浏览器强制 HTTPS）
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 223.5.5.5 valid=300s;

    root /var/www/example.com/html;
    index index.html;
}

cat >> /etc/sysctl.conf <<'EOF'
# Nginx 优化
net.core.somaxconn = 65535
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_max_syn_backlog = 65535
net.core.netdev_max_backlog = 65535
net.ipv4.ip_local_port_range = 1024 65535
EOF
sysctl -p

worker_processes auto;              # = CPU 核心数
worker_cpu_affinity auto;           # 自动绑定 CPU
worker_rlimit_nofile 65535;         # 文件描述符限制

events {
    worker_connections 65535;        # 理论最大并发 = workers × connections
    multi_accept on;
    use epoll;
}

keepalive_timeout 65;               # 客户端长连接超时
keepalive_requests 1000;            # 单连接最大请求数
reset_timedout_connection on;       # 释放超时连接资源
send_timeout 10;                    # 响应发送超时

# 在 http 块中定义
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

# 在 server/location 中使用
location /api/ {
    limit_req zone=api_limit burst=20 nodelay;
    limit_conn conn_limit 50;
    proxy_pass http://backend_api;
}

# 创建 /etc/logrotate.d/nginx
cat > /etc/logrotate.d/nginx <<'EOF'
/var/log/nginx/*.log {
    daily
    missingok
    rotate 30
    compress
    delaycompress
    notifempty
    create 0640 nginx adm
    sharedscripts
    postrotate
        [ -f /var/run/nginx.pid ] && kill -USR1 $(cat /var/run/nginx.pid)
    endscript
}
EOF

# /etc/nginx/conf.d/status.conf
server {
    listen 8080;
    server_name localhost;

    location /nginx_status {
        stub_status;
        allow 127.0.0.1;                   # 仅允许本地访问
        deny all;
    }
}

# 查看状态
curl http://127.0.0.1:8080/nginx_status
# Active connections: 10
# server accepts handled requests
#  1234 1234 5678
# Reading: 0 Writing: 1 Waiting: 9

./nginx-prometheus-exporter \
  -nginx.scrape-uri=http://127.0.0.1:8080/nginx_status

ss -tlnp | grep ':80'
# 找到占用进程后 kill 或修改 Nginx 监听端口

proxy_connect_timeout 30s;
proxy_send_timeout 120s;
proxy_read_timeout 120s;