Nginx配置基础 #

main（全局配置）
├── events（事件配置）
├── http（HTTP配置）
│   ├── upstream（上游服务器）
│   ├── server（虚拟主机）
│   │   └── location（位置匹配）
│   └── ...
├── mail（邮件配置）
└── stream（TCP/UDP代理）

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    
    access_log  /var/log/nginx/access.log  main;
    
    sendfile        on;
    keepalive_timeout  65;
    
    server {
        listen       80;
        server_name  localhost;
        
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }
    }
}

user nginx;
worker_processes auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 65535;
pid /var/run/nginx.pid;

error_log /var/log/nginx/error.log warn;
error_log /var/log/nginx/error.log info;
error_log /dev/null;

include /etc/nginx/modules-enabled/*.conf;
include /etc/nginx/conf.d/*.conf;

events {
    worker_connections  10240;
    use epoll;
    multi_accept on;
    accept_mutex on;
    accept_mutex_delay 500ms;
}

最大并发 = worker_processes × worker_connections

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    
    charset utf-8;
    server_tokens off;
    
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;
    types_hash_max_size 2048;
}

log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_x_forwarded_for"';

log_format  json  escape=json '{'
    '"time":"$time_iso8601",'
    '"remote_addr":"$remote_addr",'
    '"request":"$request",'
    '"status":"$status",'
    '"body_bytes_sent":"$body_bytes_sent",'
    '"request_time":"$request_time",'
    '"http_referrer":"$http_referer",'
    '"http_user_agent":"$http_user_agent"'
'}';

access_log  /var/log/nginx/access.log  main;
access_log  /var/log/nginx/access.json  json;

gzip  on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_min_length 1000;
gzip_types text/plain text/css application/json application/javascript 
           text/xml application/xml application/xml+rss text/javascript;
gzip_disable "msie6";

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    root /var/www/example;
    index index.html index.htm;
    
    location / {
        try_files $uri $uri/ =404;
    }
}

listen 80;
listen 8080;
listen 192.168.1.100:80;
listen 80 default_server;
listen 443 ssl;
listen [::]:80 ipv6only=on;

server_name example.com;
server_name example.com www.example.com;
server_name *.example.com;
server_name example.*;
server_name ~^(?<user>.+)\.example\.com$;
server_name "";

location = / {
}

location / {
}

location /images/ {
}

location ^~ /images/ {
}

location ~ \.(gif|jpg|jpeg)$ {
}

location ~* \.(gif|jpg|jpeg)$ {
}

1. = 精确匹配（最高优先级）
2. ^~ 前缀匹配
3. ~ 和 ~* 正则匹配（按配置顺序）
4. 无修饰符前缀匹配（最长匹配）

server {
    listen 80;
    server_name example.com;
    
    location = / {
        return 200 "精确匹配根路径";
    }
    
    location / {
        return 200 "前缀匹配";
    }
    
    location /images/ {
        return 200 "匹配/images/路径";
    }
    
    location ^~ /static/ {
        return 200 "优先匹配/static/";
    }
    
    location ~ \.php$ {
        return 200 "正则匹配PHP文件";
    }
    
    location ~* \.(gif|jpg|png)$ {
        return 200 "正则匹配图片";
    }
}

$remote_addr
$remote_port
$remote_user
$request
$request_method
$request_uri
$scheme
$host
$server_name
$server_port
$uri
$args
$arg_name
$http_name
$cookie_name
$document_root
$status
$body_bytes_sent
$request_time
$time_iso8601

set $my_var "hello";
set $full_uri $scheme://$host$uri;

location /test {
    set $debug "on";
    return 200 "debug: $debug, uri: $uri";
}

location / {
    if ($request_method = POST) {
        return 405;
    }
    
    if ($http_user_agent ~* "bot") {
        return 403;
    }
    
    if ($args ~ "debug=1") {
        return 200 "Debug mode enabled";
    }
}

/etc/nginx/
├── nginx.conf
├── conf.d/
│   ├── default.conf
│   └── ssl.conf
├── sites-available/
│   ├── site1.conf
│   └── site2.conf
├── sites-enabled/
│   ├── site1.conf -> ../sites-available/site1.conf
│   └── site2.conf -> ../sites-available/site2.conf
├── snippets/
│   ├── ssl-params.conf
│   └── proxy-params.conf
└── modules-enabled/
    └── *.conf

http {
    include /etc/nginx/snippets/proxy-params.conf;
    
    server {
        listen 80;
        include /etc/nginx/snippets/ssl-params.conf;
        
        location / {
            include /etc/nginx/snippets/proxy-params.conf;
            proxy_pass http://backend;
        }
    }
}

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

nginx -t
nginx -t -c /etc/nginx/nginx.conf

nginx -s reload
systemctl reload nginx

nginx -V