Nginx安装配置

安装

通过yum安装

$ yum install nginx # 安装系统记录的版本

# 或使用repo文件，根据需要选择下面版本。保存内容需执行一次 yum update
$ vim /etc/yum.repos.d/nginx.repo

$ yum info nginx # 查看 可安装/已安装 nginx的版本信息
$ systemctl enable nginx.service # 配置开机启动
$ systemctl start nginx.service # 启动 nginx

[nginx]
name=nginx repo
baseurl=https://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=0
enabled=1

[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

源码安装

yum install gcc pcre-devel openssl-devel make geoip-devel

wget http://nginx.org/download/nginx-1.24.0.tar.gz

tar -xf nginx-1.24.0.tar.gz

./configure --prefix=/usr/local/nginx --user=nginx --group=nginx --with-http_ssl_module

make && make install

Mac

$ brew install nginx // 安装
$ brew services start nginx // 启动
$ brew services stop nginx // 停止
$ brew services restart nginx // 重启nginx

$ nginx -s reload // 重新加载配置文件
$ nginx -t // 验证nginx配置文件是否正确

$ /usr/local/etc/nginx/nginx.conf // 配置文件位置

配置

开机启动

[Unit]
Description=The NGINX HTTP and reverse proxy server
After=syslog.target network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPost=/bin/sleep 0.1
ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/sbin/nginx
ExecReload=/usr/sbin/nginx -s reload
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true

[Install]
WantedBy=multi-user.target

systemctl enable nginx.service
systemctl status nginx.service
systemctl restart nginx.service

配置SSL

server {
  #SSL 默认访问端口号为 443
  listen 443 ssl;
  #请填写绑定证书的域名
  server_name cloud.tencent.com; 
  #请填写证书文件的相对路径或绝对路径
  ssl_certificate  cloud.tencent.com_bundle.crt; 
  #请填写私钥文件的相对路径或绝对路径
  ssl_certificate_key cloud.tencent.com.key; 
  ssl_session_timeout 5m;
  #请按照以下套件配置，配置加密套件，写法遵循 openssl 标准。
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
  #请按照以下协议配置
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  location / {
    #网站主页路径。此路径仅供参考，具体请您按照实际目录操作。 
    #例如，您的网站主页在 Nginx 服务器的 /etc/www 目录下，则请修改 root 后面的 html 为 /etc/www。
    root html;
    index index.html index.htm;
  }
}
server {
  listen 80;
  #请填写绑定证书的域名
  server_name cloud.tencent.com; 
  #把http的域名请求转成https
  return 301 https://$host$request_uri; 
}

ssl_certificate ssl/wyolo.cn.cer;
ssl_certificate_key ssl/wyolo.cn.key;

ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;

include conf.d/ssl.snippet;

# 覆盖前面ssl.snippet中默认证书
ssl_certificate ssl/www.wyolo.cn.cer;
ssl_certificate_key ssl/www.wyolo.cn.key;

acme.sh --install-cert -d wyolo.cn \
> --key-file       /etc/nginx/ssl/www.wyolo.cn.key  \
> --fullchain-file /etc/nginx/ssl/www.wyolo.cn.cer \
> --reloadcmd     "service nginx force-reload"

acme.sh --install-cert -d *.wyolo.cn \
> --key-file       /usr/local/nginx/ssl/wyolo.cn.key  \
> --fullchain-file /usr/local/nginx/ssl/wyolo.cn.cer \
> --reloadcmd     "service nginx force-reload"

配置Gzip

配置Stream

以代理MySQL为例

# stream配置
stream {
	server {
		listen 53306; 
		proxy_connect_timeout 1s;
		proxy_timeout 3s;
		proxy_pass 127.0.0.1:3306;    
	}
}

http {
	...
}

http {
	include /etc/nginx/conf.d/*.conf;
}

stream {
	include /etc/nginx/conf.d/*.stream;
}

安全配置

# 安全优化- 隐藏版本号
Syntax:  server_tokens on | off | build | string;
Default:  server_tokens on;
Context:  http, server, location

Module推荐

headers-more-nginx-module

• CentOS7设置nginx开机自启动

• NGINX systemd service file

• Can’t open PID file /var/run/nginx.pid (yet?) after start: No such file or directory

• Nginx代理转发Mysql

• nginx开启gzip压缩和静态缓存