Nginx — 高性能 Web 服务器与反向代理完全指南

proxy_connect_timeout 300s;
proxy_send_timeout    300s;
proxy_read_timeout    300s;

client_max_body_size 100m;

upload_max_filesize = 100M
post_max_size = 100M

if ($http_x_forwarded_proto = "http") {
    return 301 https://$host$request_uri;
}

client_header_buffer_size 4k;
large_client_header_buffers 4 32k;

client_body_timeout   60s;
client_header_timeout 60s;

geo $limit {
    default 1;
    10.0.0.0/8 0;    # 内网不限流
}
map $limit $limit_key {
    0 "";
    1 $binary_remote_addr;
}
limit_req_zone $limit_key zone=api:10m rate=10r/s;

# 正确结构
http {
    server { ... }
}

# 错误：server 在 http 外面
server { ... }
http { ... }

sudo setsebool -P httpd_can_network_connect 1

sudo semanage port -a -t http_port_t -p tcp 3000

events {
    worker_connections 4096;
}

# /etc/security/limits.conf
nginx soft nofile 65535
nginx hard nofile 65535

proxy_buffer_size          128k;
proxy_buffers              4 256k;
proxy_busy_buffers_size    256k;

fastcgi_buffer_size        128k;
fastcgi_buffers            4 256k;
fastcgi_busy_buffers_size  256k;

location /.well-known/acme-challenge/ {
    root /var/www/certbot;
}

add_header Content-Security-Policy "upgrade-insecure-requests" always;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;

ssl_stapling on;
ssl_stapling_verify on;

ssl_certificate     /path/to/fullchain.pem;
ssl_certificate_key /path/to/privkey.pem;

server {
    listen 443 ssl default_server;
    server_name _;
    ssl_certificate /path/to/default.pem;
    return 444;  # 拒绝未知域名
}

# Certbot DNS 验证（以 Cloudflare 为例）
sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials ~/.secrets/cloudflare.ini \
  -d example.com \
  -d "*.example.com"

ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

# 请求: /api/users
# 带斜杠 — 去掉匹配的前缀
location /api/ {
    proxy_pass http://backend/;  # → backend 收到 /users
}

# 不带斜杠 — 保留完整路径
location /api/ {
    proxy_pass http://backend;   # → backend 收到 /api/users
}

proxy_redirect http://127.0.0.1:3000/ /;
# 或自动改写
proxy_redirect default;

proxy_set_header Host $host;

# 改写 Cookie 路径
proxy_cookie_path /internal-app/ /;

# 改写 Cookie 域名
proxy_cookie_domain backend.internal example.com;

# 关闭代理缓冲
proxy_buffering off;

# 或者使用临时文件缓冲
proxy_max_temp_file_size 1024m;
proxy_temp_path /var/cache/nginx/temp;

upstream backend {
    least_conn;
    server 10.0.0.1:3000 weight=3;  # 高性能机器
    server 10.0.0.2:3000 weight=1;  # 低性能机器
}

server {
    listen 80;
    server_name app.example.com;
    root /var/www/app/dist;
    index index.html;

    location / {
        try_files $uri $uri/ /index.html;
    }

    # API 代理
    location /api/ {
        proxy_pass http://127.0.0.1:3000;
    }
}

location /api/ {
    # CORS 头部
    add_header Access-Control-Allow-Origin $http_origin always;
    add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
    add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;
    add_header Access-Control-Allow-Credentials true always;

    # 预检请求直接返回
    if ($request_method = OPTIONS) {
        return 204;
    }

    proxy_pass http://backend;
}

# /etc/logrotate.d/nginx
/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 nginx adm
    sharedscripts
    postrotate
        [ -f /var/run/nginx.pid ] && kill -USR1 `cat /var/run/nginx.pid`
    endscript
}

# 1. 备份旧二进制
sudo cp /usr/sbin/nginx /usr/sbin/nginx.old

# 2. 替换新二进制（编译安装后）
sudo cp objs/nginx /usr/sbin/nginx

# 3. 发送 USR2 信号启动新进程
sudo kill -USR2 `cat /var/run/nginx.pid`

# 4. 优雅关闭旧 worker
sudo kill -WINCH `cat /var/run/nginx.pid.oldbin`

# 5. 确认新版本正常后关闭旧主进程
sudo kill -QUIT `cat /var/run/nginx.pid.oldbin`

# 添加状态页面
server {
    listen 127.0.0.1:8080;
    location /nginx_status {
        stub_status;
        allow 127.0.0.1;
        deny all;
    }
}

Active connections: 291
server accepts handled requests
 16630948 16630948 31070465
Reading: 6 Writing: 179 Waiting: 106

worker_shutdown_timeout 10s;

# 1. 屏蔽常见扫描路径
location ~* /(wp-admin|wp-login|phpmyadmin|\.env|\.git) {
    return 444;
}

# 2. 屏蔽恶意 User-Agent
if ($http_user_agent ~* (scrapy|curl|wget|python-requests|Go-http-client)) {
    return 403;
}

# 3. 限制请求速率
limit_req_zone $binary_remote_addr zone=scan:10m rate=2r/s;
location / {
    limit_req zone=scan burst=5 nodelay;
}

# nginx.conf 全局块
worker_rlimit_nofile 65535;

# /etc/security/limits.conf
nginx soft nofile 65535
nginx hard nofile 65535

# /etc/sysctl.conf
fs.file-max = 2097152

# nginx.conf（与 http 块同级）
stream {
    upstream mysql_backend {
        server 10.0.0.1:3306;
        server 10.0.0.2:3306 backup;
    }

    server {
        listen 3306;
        proxy_pass mysql_backend;
        proxy_connect_timeout 10s;
        proxy_timeout 300s;
    }
}

# proxy_pass 使用服务名而非 localhost
proxy_pass http://app:3000;

resolver 127.0.0.11 valid=30s;  # Docker 内置 DNS