------------------------------------------------
安装1.26.3
1.安装依赖
sudo yum install -y epel-release
sudo yum install -y gcc gcc-c++ make pcre pcre-devel zlib zlib-devel openssl openssl-devel
2.进入目录
cd /usr/local/src
tar -zxvf nginx-1.26.3.tar.gz
cd nginx-1.26.3
3.编译
./configure --prefix=/usr/local/nginx --with-http_ssl_module
4.安装
make -j$(nproc)
sudo make install
5.查看版本
/usr/local/nginx/sbin/nginx -v
6.创建vhost
mkdir -p /usr/local/nginx/conf/vhost
在http模块添加
include /usr/local/nginx/conf/vhost/*.conf;
7.域名配置
server {
listen 80;
server_name s.lbu.cn;
return 301 https://$host$request_uri;
}
# 监听 443 端口，反向代理到本地 8080
server {
listen 443 ssl;
server_name s.lbu.cn;
ssl_certificate /usr/local/nginx/conf/ssl/s.lbu.cn.pem;
ssl_certificate_key /usr/local/nginx/conf/ssl/s.lbu.cn.key;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
add_header Content-Security-Policy upgrade-insecure-requests; #无css时增加
}
}
------------------------------------------------
nginx日志参数
$remote_addr 记录客户端IP地址
$remote_user 记录客户端用户名称
$request 记录请求的URL和HTTP协议
$request_length 请求的长度（包括请求行，请求头和请求正文）。
$request_time 请求处理时间，单位为秒，精度毫秒； 从读入客户端的第一个字节开始，直到把最后一个字符发送给客户端后进行日志写入为止。
$body_bytes_sent 发送给客户端的字节数，不包括响应头的大小； 该变量与Apache模块mod_log_config里的“%B”参数兼容。
$bytes_sent 发送给客户端的总字节数。
$connection 连接的序列号。
$connection_requests 当前通过一个连接获得的请求数量。
$msec 日志写入时间。单位为秒，精度是毫秒。
$pipe 如果请求是通过HTTP流水线(pipelined)发送，pipe值为“p”，否则为“.”。
$http_referer 记录从哪个页面链接访问过来的。
$http_user_agent 记录客户端浏览器相关信息
$http_host 请求地址，即浏览器中你输入的地址（IP或域名）
$http_x_forwarded_for 和$remote_addr一样记录客户端IP地址
$http_x_real_ip 最后一跳是反向代理客户端IP地址
$time_iso8601 ISO8601标准格式下的本地时间。
$time_local 访问时间和时区
$gzip_ratio 可以获取到gzip的压缩比率
$upstream_response_time 请求过程中，upstream响应时间 0.002
$upstream_addr 后台upstream的地址，即真正提供服务的主机地址10.10.10.100:80
$upstream_cache_status: 这个变量来显示缓存的状态，命中为HIT,为了能够统计缓存的命中率，我们需要在日志中记录这一状态
$upstream_status upstream状态200
$status 记录请求状态;成功是200
$srcache_fetch_status
$srcache_store_status
$srcache_expire
$ssl_protocol SSL协议版本TLSv1
$ssl_cipher 交换数据中的算法RC4-SHA
------------------------------------------------
nginx相关安装路径
php默认目录
PHP主要可执行文件
/usr/bin/php
php配置文件
CLI配置文件
/etc/php/8.3/cli/php.ini
用于命令行接口的配置文件
FPM配置文件
/etc/php/8.3/fpm/php.ini
用于 PHP-FPM 的配置文件（如果安装了 PHP-FPM）
PHP扩展
/usr/lib/php/20210902/
PHP扩展库的位置，可能还会有其他与版本相关的子目录
PHP额外的配置文件
/etc/php/8.3/cli/conf.d/
用于命令行接口的额外扩展配置文件的目录
/etc/php/8.3/fpm/conf.d/
用于 PHP-FPM 的额外扩展配置文件的目录
PHP-FPM 服务配置文件
/etc/php/8.3/fpm/pool.d/
该目录包含关于 FPM 池的配置文件，通常是 www.conf
nginx
nginx配置文件目录
/etc/nginx/nginx.conf
Nginx 的主配置文件
站点配置文件
/etc/nginx/sites-available/
可用站点的配置文件目录
/etc/nginx/sites-enabled/
启用站点的配置文件目录，通常是 sites-available 中文件的符号链接
日志文件
/var/log/nginx/access.log
访问日志文件
/var/log/nginx/error.log
错误日志文件
Nginx的默认文档根目录通常是
/var/www/html
yum安装nginx
1. 主配置文件目录
/etc/nginx/nginx.conf
这是 Nginx 的主配置文件，所有全局和默认的 Nginx 设置都在此文件中配置。
2. 虚拟主机配置目录
/etc/nginx/conf.d/
该目录下的 .conf 文件是用来定义 Nginx 的虚拟主机配置文件。
例如，您可以在此目录下为每个站点创建单独的配置文件。
3. 可选的模块配置
/etc/nginx/modules/
如果您安装了额外的 Nginx 模块，模块配置文件会放在这个目录下。
4. 日志文件目录
/var/log/nginx/
Nginx 的访问日志和错误日志默认保存在这个目录下：
access.log: 记录所有的访问请求
error.log: 记录所有的错误和问题
5. 网站的默认根目录
/usr/share/nginx/html/
Nginx 的默认网站根目录，存放静态网站文件（如 HTML、CSS、JavaScript）。
如果您没有更改默认配置，Nginx 会从这个目录提供网站内容。
6. 运行时的 PID 文件
/var/run/nginx.pid
这个文件保存了 Nginx 主进程的 PID，用于进程管理。
7. SSL/TLS 证书目录
通常，SSL 证书和密钥会放在 /etc/nginx/ssl/ 或者 /etc/ssl/ 目录下，但这取决于您自己定义的路径。
8. 缓存和临时文件目录
/var/cache/nginx/
用于存储 Nginx 的缓存文件和代理临时文件。
postgresql
vim /etc/postgresql/15/main/postgresql.conf
vim /etc/postgresql/15/main/pg_hba.conf
redis
vim /etc/redis/redis.conf
supervisor
vim /etc/supervisor/supervisord.conf
php关联nginx
server {
listen 80;
server_name your_domain.com; # 替换为你的域名或IP地址
root /var/www/html; # 网站根目录
index index.php index.html index.htm;
location / {
try_files $uri $uri/ =404;
}
# 处理 PHP 文件
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php/php8.3-fpm.sock; # 确保使用正确的 PHP 版本
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
------------------------------------------------
verynginx_db配置
server {
listen 9989;
server_name db.qq.com;
access_log /data/wwwlogs/data65.log;
index index.html index.htm index.php;
root /data/wwwroot/database.qq.com;
#if ($http_x_forwarded_host != '') { return 403; }
#防止XSS，下面3行
add_header Strict-Transport-Security max-age=0;
add_header Content-Security-Policy "upgrade-insecure-requests";
add_header Access-Control-Allow-Origin *;
#expires $expires;
#error_page 404 /404.html;
#error_page 502 /502.html;
location ~ [^/]\.php(/|$) {
#fastcgi_pass remote_php_ip:9000;
fastcgi_pass unix:/dev/shm/php5.6-cgi.sock;
fastcgi_index index.php;
include fastcgi.conf;
fastcgi_param X_REAL_IP $http_x_real_ip;
fastcgi_param XREQUESTID $xrequestid;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
#fastcgi_param PHP_VALUE "auto_prepend_file=/data/tmp/WAF/test.php";
fastcgi_hide_header X-Powered-By;
}
location / {
if ($uri !~ "^/(index.php/|)(api|api/.*|other/vipinternal.html|other/vipexternal)$"){
set $rule_0 1$rule_0;
}
# if ($rule_0 = "1"){
# rewrite ^/(.*)?$ https://$server_name/$1 redirect;
# }
if (!-e $request_filename) {
rewrite ^(.*)$ /index.php?s=$1 last;
break;
}
}
location ~ /\.ht {
deny all;
}
location ~ /\.git {
deny all;
}
}
verynginx_vip配置
server {
listen 9990;
# listen 443 ssl http2;
# ssl_certificate /opt/verynginx/openresty/nginx/conf/ssl/qq.com.pem;
# ssl_certificate_key /opt/verynginx/openresty/nginx/conf/ssl/qq.com.key;
# ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
# ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
# ssl_prefer_server_ciphers on;
# ssl_session_timeout 10m;
# ssl_session_cache builtin:1000 shared:SSL:10m;
# ssl_buffer_size 1400;
# ssl_stapling on;
# ssl_stapling_verify on;
#防止XSS，下面3行
# add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
add_header Strict-Transport-Security max-age=15768000;
server_name _;
root /data/wwwroot/vip.qq.com/dist;
access_log /data/wwwlogs/vip65.log main;
index index.html index.htm index.php;
# if ($ssl_protocol = "") { return 301 https://$host$request_uri; }
# if ($http_x_forwarded_host != '') { return 403; }
set $xrequestid $http_xrequestid;
# expires $expires;
location / {
if (!-e $request_filename) {
#rewrite ^/api/(.*)$ /api/index.php?s=$1 last;
rewrite ^(.*)$ /index.html last;
break;
}
}
location /api {
proxy_pass https://apidb.qq.com/;
}
location = /index.html {
#禁止缓存，每次都从服务器请求
add_header Cache-Control "no-cache, no-store";
}
location /lineat {
proxy_pass https://patapi.qq.com/;
}
location /mlw/ {
proxy_pass http://felog.qq.com/;
}
location ~ [^/]\.php(/|$) {
#fastcgi_pass remote_php_ip:9000;
fastcgi_pass unix:/dev/shm/php-cgi.sock;
fastcgi_index index.php;
include fastcgi.conf;
}
location ~ /\.ht {
deny all;
}
location ~ /\.git {
deny all;
}
}
verynginx_vipapi配置
server {
listen 80;
listen 443 ssl http2;
ssl_certificate /opt/verynginx/openresty/nginx/conf/ssl/qq.com.pem;
ssl_certificate_key /opt/verynginx/openresty/nginx/conf/ssl/qq.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_timeout 10m;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_buffer_size 1400;
add_header Strict-Transport-Security max-age=15768000;
ssl_stapling on;
ssl_stapling_verify on;
server_name apidb.qq.com;
access_log /data/wwwlogs/vipapi65.log main;
index index.html index.htm index.php;
root /data/wwwroot/vipapi.qq.com/public;
if ($ssl_protocol = "") { return 301 https://$host$request_uri; }
if ($http_x_forwarded_host != '') { return 403; }
set $xrequestid $http_xrequestid;
include /opt/verynginx/openresty/nginx/conf/rewrite/thinkphp.conf;
expires $expires;
#error_page 404 /404.html;
#error_page 502 /502.html;
location ~ [^/]\.php(/|$) {
#fastcgi_pass remote_php_ip:9000;
fastcgi_pass unix:/dev/shm/php-cgi.sock;
fastcgi_index index.php;
include fastcgi.conf;
fastcgi_param X_REAL_IP $http_x_real_ip;
fastcgi_param XREQUESTID $xrequestid;
#fastcgi_split_path_info ^(.+\.php)(/.+)$;
#fastcgi_param PATH_INFO $fastcgi_path_info;
#fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_hide_header X-Powered-By;
}
location ~ /\.ht {
deny all;
}
location ~ /\.git {
deny all;
}
}
nginx.conf配置
user www www;
worker_processes auto;
error_log /data/wwwlogs/error_nginx.log crit;
pid /var/run/nginx.pid;
worker_rlimit_nofile 655350;
events {
use epoll;
worker_connections 655350;
multi_accept on;
}
#include /opt/verynginx/verynginx/nginx_conf/in_external.conf;
stream {
include /opt/verynginx/openresty/nginx/conf/ports/*.conf;
}
http {
include mime.types;
default_type application/octet-stream;
server_names_hash_bucket_size 128;
client_header_buffer_size 64k;
large_client_header_buffers 4 64k;
client_max_body_size 10240m;
client_body_buffer_size 20m;
sendfile on;
tcp_nopush on;
keepalive_timeout 120;
server_tokens off;
tcp_nodelay on;
#隐藏nginx后端服务X-Powered-By头
proxy_hide_header X-Powered-By;
proxy_hide_header Server;
fastcgi_connect_timeout 600;
fastcgi_send_timeout 600;
fastcgi_read_timeout 600;
fastcgi_buffer_size 128k;
fastcgi_buffers 4 128k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
fastcgi_intercept_errors on;
#Gzip Compression
gzip on;
gzip_buffers 16 8k;
gzip_comp_level 6;
gzip_http_version 1.1;
gzip_min_length 256;
gzip_proxied any;
gzip_vary on;
gzip_types
text/xml application/xml application/atom+xml application/rss+xml application/xhtml+xml image/svg+xml
text/javascript application/javascript application/x-javascript
text/x-json application/json application/x-web-app-manifest+json
text/css text/plain text/x-component
font/opentype application/x-font-ttf application/vnd.ms-fontobject
image/x-icon;
gzip_disable "MSIE [1-6]\.(?!.*SV1)";
log_format main '^$remote_addr ^$http_x_real_ip ^$http_x_forwarded_for ^$remote_user ^$time_local ^$http_host '
'^$status ^$body_bytes_sent ^$http_referer '
'^$request ^$http_user_agent ^$request_time ^$upstream_status ^$upstream_addr ^$upstream_response_time ^$args ^$query_string ^$arg_NAME '
'^$cookie_userid ^$cookie_username ^$xrequestid';
access_log /data/wwwlogs/access_tengine.log main;
#If you have a lot of static files to serve through Nginx then caching of the files' metadata (not the actual files' contents) can save some latency.
open_file_cache max=1000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors on;
#add_header X-Frame-Options SAMEORIGIN;
include expire.conf;
# include /opt/verynginx/verynginx/nginx_conf/in_http_block.conf;
######################## default ############################
server {
listen 80;
server_name _;
#access_log /data/wwwlogs/access_nginx.log combined;
#root /data/wwwroot/default;
#root /data/text_data;
index index.html index.htm index.php;
#error_page 404 /404.html;
#error_page 502 /502.html;
location /nginx_status {
stub_status on;
access_log off;
allow 127.0.0.1;
deny all;
}
location ~ [^/]\.php(/|$) {
#fastcgi_pass remote_php_ip:9000;
fastcgi_pass unix:/dev/shm/php-cgi.sock;
fastcgi_index index.php;
include fastcgi.conf;
}
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|mp4|ico)$ {
expires 30d;
access_log off;
}
location ~ .*\.(js|css)?$ {
expires 7d;
access_log off;
}
location ~ /\.ht {
deny all;
}
}
########################## verynginx #############################
# server {
# listen 9999;
# include /opt/verynginx/verynginx/nginx_conf/in_server_block.conf;
# server_name 101.37.36.159;
# #access_log /data/wwwlogs/access_tengine.log main;
# #root /data/wwwroot/default;
# #root /data/text_data;
# index index.html index.htm index.php;
# #error_page 404 /404.html;
# #error_page 502 /502.html;
# location ~ [^/]\.php(/|$) {
# #fastcgi_pass remote_php_ip:9000;
# fastcgi_pass unix:/dev/shm/php-cgi.sock;
# fastcgi_index index.php;
# include fastcgi.conf;
# }
# location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|mp4|ico)$ {
# expires 30d;
# access_log off;
# }
# location ~ .*\.(js|css)?$ {
# expires 7d;
# access_log off;
# }
# location ~ /\.ht {
# deny all;
# }
# }
########################## vhost #############################
include vhost/*.conf;
}
------------------------------------------------
限制ip访问
geo $allow {
default 0;
119.86.0.0/16 1;
222.176.0.0/16 1;
222.182.0.0/16 1;
106.83.0.0/16 1;
14.105.0.0/16 1;
}
server {
listen 80;
server_name lbu.cn;
# 通过 X-Real-IP 头部获取客户端的真实 IP 地址
set_real_ip_from 0.0.0.0/0; # 如果 Nginx 后面有负载均衡或代理设置，可以使用此配置来信任这些代理
# 获取客户端的真实 IP 地址，优先使用 X-Real-IP
real_ip_header X-Real-IP;
real_ip_recursive on;
# 如果 IP 不允许，返回 444 错误
if ($allow = 0) {
return 444;
}
location / {
proxy_pass http://192.168.1.212:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}
------------------------------------------------
playbook_verynginx配置
verynginx_deploy.yml
---
- name: Deploy VeryNginx to sl group
hosts: sl
become: true
roles:
- verynginx
tasks:
---
# 1. 创建目标目录
- name: Ensure target directory exists
ansible.builtin.file:
path: /opt/
state: directory
owner: root
group: root
mode: '0755'
# 2. 上传打包好的 VeryNginx 文件
- name: Upload VeryNginx tarball
ansible.builtin.copy:
src: verynginx_192.tar.gz
dest: /tmp/verynginx_192.tar.gz
mode: '0644'
# 3. 解压 VeryNginx
- name: Extract VeryNginx
ansible.builtin.unarchive:
src: /tmp/verynginx_192.tar.gz
dest: /opt/
remote_src: yes
# 4. 创建用户组
- name: Create www group
ansible.builtin.group:
name: www
state: present
- name: Create www user
ansible.builtin.user:
name: www
group: www
state: present
# 5. 发送库文件
- name: Copy libjemalloc.so.2 to /usr/lib64
ansible.builtin.copy:
src: files/libjemalloc.so.2 # 需要复制的文件
dest: /usr/lib64/libjemalloc.so.2 # 目标路径
owner: root # 设置文件所有者为 root
group: root # 设置文件所属组为 root
mode: '0644' # 设置文件权限
# 5. 创建目录
- name: Ensure /data/wwwlogs directory exists
ansible.builtin.file:
path: /data/wwwlogs
state: directory
owner: root
group: root
mode: '0755'
# 5. 创建日志文件
- name: Create /data/wwwlogs/error_nginx.log file
ansible.builtin.file:
path: /data/wwwlogs/error_nginx.log
state: touch # 确保文件存在，若文件不存在则创建它
owner: root
group: root
mode: '0644'
## 4. 部署 Nginx 配置文件（可选）
#- name: Deploy Nginx configuration
# ansible.builtin.template:
# src: nginx.conf.j2
# dest: /opt/verynginx/nginx/conf/nginx.conf
# owner: root
# group: root
# mode: '0644'
# notify: Restart VeryNginx
# 5. 启动 VeryNginx
- name: Start Nginx
ansible.builtin.shell: |
cd /opt/verynginx/openresty/nginx/sbin/
./nginx
async: 10
poll: 0
become: true # 如果需要管理员权限
- name: Ensure Nginx is running
ansible.builtin.shell: |
ps aux | grep nginx | grep -v grep
register: nginx_status
failed_when: nginx_status.stdout == ""
become: true
- name: Debug output
ansible.builtin.debug:
var: nginx_status
ansible-playbook -i inventory verynginx_deploy.yml
------------------------------------------------
version: '3.8'
services:
nginx:
image: registry.cn-hangzhou.aliyuncs.com/leiuvn/nginx:1.24
container_name: lbu.cn
restart: always
ports:
- "80:80" # 宿主机端口映射到容器
volumes:
- /data/wwwroot/lbu.cn/dist:/usr/share/nginx/html # 挂载 Vue `dist` 目录
- /data/wwwroot/lbu.cn/nginx.conf:/etc/nginx/nginx.conf # 挂载 Nginx 配置
- /data/wwwroot/lbu.cn/vhost:/etc/nginx/vhost # 挂载 Nginx 配置
- /data/wwwroot/lbu.cn/logs:/var/log/nginx # 挂载日志目录（可选）
vim nginx.conf
#user nobody;
worker_processes 1;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
#pid logs/nginx.pid;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
#access_log logs/access.log main;
sendfile on;
#tcp_nopush on;
#keepalive_timeout 0;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/vhost/*.conf;
# server {
# listen 80;
# server_name localhost;
#
# #charset koi8-r;
#
# #access_log logs/host.access.log main;
#
# location / {
# root html;
# index index.html index.htm;
# }
#
# #error_page 404 /404.html;
#
# # redirect server error pages to the static page /50x.html
# #
# error_page 500 502 503 504 /50x.html;
# location = /50x.html {
# root html;
# }
#
# # proxy the PHP scripts to Apache listening on 127.0.0.1:80
# #
# #location ~ \.php$ {
# # proxy_pass http://127.0.0.1;
# #}
#
# # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
# #
# #location ~ \.php$ {
# # root html;
# # fastcgi_pass 127.0.0.1:9000;
# # fastcgi_index index.php;
# # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
# # include fastcgi_params;
# #}
#
# # deny access to .htaccess files, if Apache's document root
# # concurs with nginx's one
# #
# #location ~ /\.ht {
# # deny all;
# #}
# }
# another virtual host using mix of IP-, name-, and port-based configuration
#
#server {
# listen 8000;
# listen somename:8080;
# server_name somename alias another.alias;
# location / {
# root html;
# index index.html index.htm;
# }
#}
# HTTPS server
#
#server {
# listen 443 ssl;
# server_name localhost;
# ssl_certificate cert.pem;
# ssl_certificate_key cert.key;
# ssl_session_cache shared:SSL:1m;
# ssl_session_timeout 5m;
# ssl_ciphers HIGH:!aNULL:!MD5;
# ssl_prefer_server_ciphers on;
# location / {
# root html;
# index index.html index.htm;
# }
#}
}
vim vhost/lbu.cn.conf
server {
listen 80;
server_name lbu.cn;
root /usr/share/nginx/html; # 或你的 dist 目录路径
index index.html;
location / {
index index.html;
try_files $uri $uri/ /index.html;
}
location /assets/ {
root /usr/share/nginx/html;
}
}
------------------------------------------------
vim nginx1.24
services:
nginx:
image: registry.cn-hangzhou.aliyuncs.com/leiuvn/nginx:1.24
container_name: nginx1.24
restart: always
ports:
- "80:80" # 宿主机端口映射到容器
- "443:443" # 宿主机端口映射到容器
volumes:
# - /data/www_nginx/dist:/usr/share/nginx/html
- /data/www_nginx/nginx.conf:/etc/nginx/nginx.conf
- /data/www_nginx/vhost:/etc/nginx/vhost
- /data/www_nginx/ssl:/etc/nginx/ssl
- /data/www_nginx/logs:/var/log/nginx
------------------------------------------------