152 lines
5.6 KiB
Nginx Configuration File
152 lines
5.6 KiB
Nginx Configuration File
|
|
|||
|
|
#user nobody;
|
|||
|
|
|
|||
|
|
# 工作进程数：自动匹配CPU核心数（比固定值更灵活）
|
|||
|
|
worker_processes 4;
|
|||
|
|
|
|||
|
|
# 错误日志：开启并按级别分离（方便问题定位）
|
|||
|
|
error_log /var/log/nginx/error.log notice;
|
|||
|
|
pid /run/nginx.pid;
|
|||
|
|
|
|||
|
|
# 全局资源限制（避免文件描述符不足）
|
|||
|
|
worker_rlimit_nofile 65535;
|
|||
|
|
|
|||
|
|
events {
|
|||
|
|
# 每个工作进程最大连接数（结合系统ulimit调整）
|
|||
|
|
worker_connections 8192;
|
|||
|
|
# 高效事件模型（Linux推荐epoll，FreeBSD用kqueue）
|
|||
|
|
use epoll;
|
|||
|
|
# 一次性接受所有新连接（提高连接处理效率）
|
|||
|
|
multi_accept on;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
http {
|
|||
|
|
include mime.types;
|
|||
|
|
default_type application/octet-stream;
|
|||
|
|
|
|||
|
|
# 日志格式优化：增加响应时间和 upstream 信息（便于性能分析）
|
|||
|
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|||
|
|
'$status $body_bytes_sent "$http_referer" '
|
|||
|
|
'"$http_user_agent" "$http_x_forwarded_for" '
|
|||
|
|
'$request_time $upstream_response_time';
|
|||
|
|
# 访问日志：开启（生产环境可按需关闭或调整路径）
|
|||
|
|
access_log /var/log/nginx/access.log main;
|
|||
|
|
|
|||
|
|
# 高效文件传输
|
|||
|
|
sendfile on;
|
|||
|
|
# 静态文件传输优化（配合sendfile使用，减少TCP包数量）
|
|||
|
|
tcp_nopush on;
|
|||
|
|
# 动态内容优化（减少网络延迟）
|
|||
|
|
tcp_nodelay on;
|
|||
|
|
|
|||
|
|
# 长连接设置
|
|||
|
|
keepalive_timeout 65; # 连接超时时间
|
|||
|
|
keepalive_requests 1000; # 每个连接最大请求数（防止长连接占用）
|
|||
|
|
keepalive_disable msie6; # 对老旧IE禁用长连接
|
|||
|
|
|
|||
|
|
# 客户端请求限制（防攻击）
|
|||
|
|
client_max_body_size 100m; # 缩小上传限制（1024m过大，按需调整）
|
|||
|
|
client_body_buffer_size 1m; # 客户端请求体缓冲区（原1024k保留，单位统一）
|
|||
|
|
client_body_timeout 120s; # 客户端发送请求体超时
|
|||
|
|
client_header_timeout 120s; # 客户端发送请求头超时
|
|||
|
|
|
|||
|
|
|
|||
|
|
# Gzip压缩优化
|
|||
|
|
gzip on;
|
|||
|
|
gzip_min_length 1k; # 最小压缩尺寸
|
|||
|
|
gzip_comp_level 5; # 压缩级别（平衡CPU和带宽）
|
|||
|
|
gzip_types
|
|||
|
|
text/plain text/css text/xml application/json application/javascript application/x-javascript text/javascript application/xml application/xml+rss text/rss; # 明确需要压缩的类型
|
|||
|
|
gzip_disable "MSIE [1-6]\."; # 禁用老旧IE压缩
|
|||
|
|
gzip_vary on; # 告诉代理服务器缓存压缩和非压缩版本
|
|||
|
|
gzip_buffers 16 8k; # 压缩缓冲区（默认值优化）
|
|||
|
|
gzip_http_version 1.1; # 仅对HTTP/1.1及以上启用（避免兼容问题）
|
|||
|
|
gzip_proxied any; # 对代理请求也启用压缩
|
|||
|
|
|
|||
|
|
# 隐藏nginx版本号（安全加固）
|
|||
|
|
server_tokens off;
|
|||
|
|
|
|||
|
|
# 通用安全响应头（全局生效）
|
|||
|
|
add_header X-Frame-Options "SAMEORIGIN"; # 防止点击劫持
|
|||
|
|
add_header X-XSS-Protection "1; mode=block"; # 防XSS攻击
|
|||
|
|
add_header X-Content-Type-Options "nosniff"; # 防止MIME类型嗅探
|
|||
|
|
|
|||
|
|
# 反向代理配置 http://10.4.126.112:23000
|
|||
|
|
upstream upstream_name{
|
|||
|
|
server 172.20.0.2:8090;
|
|||
|
|
keepalive 32; # 长连接池大小，减少连接建立开销
|
|||
|
|
keepalive_timeout 60s;
|
|||
|
|
keepalive_requests 1000;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# 虚拟主机配置
|
|||
|
|
server {
|
|||
|
|
listen 8080;
|
|||
|
|
listen [::]:8080;
|
|||
|
|
# 建议替换为实际域名（如example.com），避免用localhost
|
|||
|
|
server_name 10.4.126.116;
|
|||
|
|
|
|||
|
|
# 网站根目录
|
|||
|
|
root /usr/share/nginx/html;
|
|||
|
|
# 默认索引文件
|
|||
|
|
index index.html;
|
|||
|
|
|
|||
|
|
# API接口代理配置（优化版）
|
|||
|
|
location ^~/api/ {
|
|||
|
|
# 代理目标地址
|
|||
|
|
proxy_pass http://upstream_name/;
|
|||
|
|
|
|||
|
|
# 增强头信息转发
|
|||
|
|
proxy_set_header Host $host;
|
|||
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|||
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|||
|
|
|
|||
|
|
gzip off; # 禁用该接口的 gzip 压缩
|
|||
|
|
proxy_set_header Accept-Encoding ""; # 清除传给后端的 Accept-Encoding 头
|
|||
|
|
|
|||
|
|
# 超时设置（API专用，可根据业务调整）
|
|||
|
|
proxy_connect_timeout 300s;
|
|||
|
|
proxy_send_timeout 300s;
|
|||
|
|
proxy_read_timeout 300s;
|
|||
|
|
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# 主路径匹配
|
|||
|
|
location / {
|
|||
|
|
try_files $uri $uri/ /index.html; # 适合SPA应用（如Vue/React）
|
|||
|
|
# 缓存控制：动态内容不缓存
|
|||
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|||
|
|
add_header Pragma "no-cache";
|
|||
|
|
add_header Expires "0";
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# 静态资源缓存优化（比原配置更精细）
|
|||
|
|
location ~* \.(gif|jpg|jpeg|png|ico|svg|js|css|json|txt)$ {
|
|||
|
|
# 缓存1天（可根据资源更新频率调整，如图片可设30d）
|
|||
|
|
expires 1d;
|
|||
|
|
add_header Cache-Control "public, max-age=86400";
|
|||
|
|
# 防盗链：只允许指定域名引用资源（替换为实际域名）
|
|||
|
|
# valid_referers none blocked localhost example.com *.example.com;
|
|||
|
|
# if ($invalid_referer) {
|
|||
|
|
# return 403;
|
|||
|
|
# }
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# 错误页面配置
|
|||
|
|
error_page 500 502 503 504 /50x.html;
|
|||
|
|
location = /50x.html {
|
|||
|
|
# 显式指定root（避免继承外层可能的变更）
|
|||
|
|
root /usr/share/nginx/html;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# 禁止访问隐藏文件（如.git .env等）
|
|||
|
|
location ~ /\. {
|
|||
|
|
deny all;
|
|||
|
|
access_log off;
|
|||
|
|
log_not_found off;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|