Nginx笔记（二）Nginx基础

Nginx配置文件

nginx.conf是主配置文件，在文件尾通过include /etc/nginx/conf.d/*.conf引入了default.conf配置，组成完整的Nginx配置：

# 查看nginx.conf配置
cat /etc/nginx/nginx.conf

# nginx服务的系统使用用户
user  nginx;
# 工作进程数，设置为CPU核心数就可以了
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

# 查看default.conf配置
cat /etc/nginx/conf.d/default.conf

server {
    listen       80;
    server_name  localhost;

    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #    root           html;
    #    fastcgi_pass   127.0.0.1:9000;
    #    fastcgi_index  index.php;
    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
    #    include        fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny  all;
    #}
}

可以观察到，整个配置上下文分http、server和location三个层级，分别对应着http请求的全局性配置、server级配置和请求路径级配置。nginx.conf负责http请求的全局配置，default.conf负责具体server及其下具体location的配置。

验证和重载配置
当修改了配置文件，无需重启Nginx。可通过以下命令验证配置文件正确性，并重载配置

# 校验配置
nginx -tc /etc/nginx/nginx.conf
# 重载配置
systemctl reload nginx.service

Nginx变量

我们在Nginx相关应用场景的配置中，可以充分利用这些变量。

HTTP请求变量

arg_参数名
例如，我们用$arg_userid，就可以引用到请求参数userid的值
http_请求HEADER名
例如，我们用$http_user_agent，就可以引用到请求头信息User-Agent的值
sent_http_返回HEADER名
在响应客户端可添加header头信息

内置变量
可以参考Nginx文档的Logging to syslog页，比如你要查看access log，可以看到各种内置变量

自定义变量

Nginx日志

Nginx默认访问日志存放路径：/var/log/nginx/access.log
Nginx默认错误日志存放路径：/var/log/nginx/error.log

日志格式由nginx.conf配置中的log_format指定：

log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

我们查看下Nginx的访问日志：

cat /var/log/nginx/access.log

115.198.157.60 - - [03/Feb/2018:10:04:04 +0800] "GET / HTTP/1.1" 200 612 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36" "-"
115.198.157.60 - - [03/Feb/2018:10:04:05 +0800] "GET /favicon.ico HTTP/1.1" 404 571 "http://39.104.93.171/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36" "-"

日志格式定制

# 配置nginx.conf
vi /etc/nginx/nginx.conf

# 修改log_format，在日志最前面增加输出host头信息
log_format  main  '$http_host '
                      '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

# 校验配置
nginx -tc /etc/nginx/nginx.conf
# 重载配置
nginx -s reload -c /etc/nginx/nginx.conf

# 客户端再次访问
http://39.104.93.171/

# 再次查看访问日志
tail -n 200 /var/log/nginx/access.log

# 可以看到日志最前面已经输出host了
39.104.93.171 115.198.157.60 - - [03/Feb/2018:11:24:23 +0800] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36" "-"

Nginx虚拟主机配置

Nginx作为接入层，主要以虚拟主机的方式对外提供多套业务服务

3种配置方式

基于多个IP的配置

server {
    listen       192.168.1.100:80;
    server_name  localhost;
    ...
}
server {
    listen       192.168.1.101:80;
    server_name  localhost;
    ...
}

基于多个端口的配置

server {
    listen       80;
    server_name  localhost;
    ...
}
server {
    listen       81;
    server_name  localhost;
    ...
}

基于域名的配置

server {
    listen       80;
    server_name  1.zhutx.com;
    ...
}
server {
    listen       80;
    server_name  2.zhutx.com;
    ...
}

Nginx模块

Nginx采用模块化的架构，Nginx中大部分功能都是通过模块方式提供的，比方Http模块、Mail模块等。通过开发模块扩展Nginx，能够将Nginx打造成一个全能的应用server。

# 查看nginx编译参数，--with开头的就是nginx依赖的模块
nginx -V

# 可以看到上一节我们用官方yum源安装的nginx，已经把一些常用模块都编译进来了
nginx version: nginx/1.12.2
......
--with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie'

下面先介绍几个模块的使用配置，后面介绍Nginx场景应用时，将会继续接触到其他的模块。

我们每次将从/backup目录恢复一个default.conf默认配置，并改为具名。

Nginx运行状态监控

使用模块
http_stub_status_module

配置上下文
server | location

配置实践

# 编辑stub_status.conf
cd /etc/nginx/conf.d
mv default.conf stub_status.conf
vi stub_status.conf

# 配置如下
server {
    ...
    # 增加一个location配置
    location /nginx-status {
        stub_status on; # 这里写这个
        access_log off;
        allow 127.0.0.1;
        deny all;
    }
    ...
}

# 校验配置
nginx -tc /etc/nginx/nginx.conf
# 重载配置
systemctl reload nginx.service

验证结果

Nginx随机首页

使用模块
http_random_index_module

配置上下文
location

配置实践

我们先在/opt/app/code目录下准备3个页面index_1.html、index_2.html和index_3.html

cd /opt/app/code

vi index_1.html

<!DOCTYPE HTML>
<html lang="zh-CN">
<head>
    <title>index_1</title>
    <meta charset="UTF-8"/>
    <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1"/>
</head>
<body>hello world</body>
</html>

vi index_2.html

<!DOCTYPE HTML>
<html lang="zh-CN">
<head>
    <title>index_2</title>
    <meta charset="UTF-8"/>
    <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1"/>
</head>
<body>hello world</body>
</html>

vi index_3.html

<!DOCTYPE HTML>
<html lang="zh-CN">
<head>
    <title>index_3</title>
    <meta charset="UTF-8"/>
    <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1"/>
</head>
<body>hello world</body>
</html>

以上3个页面，只是title不同。body内容都是hello world。

接下来开始配置

# 先把之前的配置示例保留下来
cd /etc/nginx/conf.d
mv stub_status.conf stub_status.conf.bak
# 从备份目录恢复一个配置并改名
cp /opt/backup/default.conf random_index.conf
# 编辑配置
vi random_index.conf

# 配置如下
server {
    ...
    location / {
        #root   /usr/share/nginx/html;
        #index  index.html index.htm;
        root /opt/app/code; # 根路径指定到我们的这个目录
        random_index on; # 打开随机开关
    }
    ...
}

# 验证配置
nginx -tc /etc/nginx/nginx.conf
# 重载配置
systemctl reload nginx.service

验证结果

# 我们直接在nginx服务上用curl命令多次发起http请求：
[root@centos7 conf.d]# curl http://127.0.0.1
<!DOCTYPE HTML>
<html lang="zh-CN">
<head>
    <title>index_2</title>
    <meta charset="UTF-8"/>
    <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1"/>
</head>
<body>hello world</body>
</html>
[root@centos7 conf.d]# curl http://127.0.0.1
<!DOCTYPE HTML>
<html lang="zh-CN">
<head>
    <title>index_3</title>
    <meta charset="UTF-8"/>
    <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1"/>
</head>
<body>hello world</body>
</html>
[root@centos7 conf.d]# curl http://127.0.0.1
<!DOCTYPE HTML>
<html lang="zh-CN">
<head>
    <title>index_1</title>
    <meta charset="UTF-8"/>
    <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1"/>
</head>
<body>hello world</body>
</html>

可以看到，3次请求分别输出了<title>index_2</title>、<title>index_3</title>、<title>index_1</title>

Nginx请求返回字符替换

使用模块
http_sub_module

配置上下文
http | server | location

配置实践

# 先把之前的配置示例保留下来
cd /etc/nginx/conf.d
mv random_index.conf random_index.conf.bak
# 从备份目录恢复一个配置并改名
cp /opt/backup/default.conf sub.conf
# 编辑配置
vi sub.conf

# 配置如下
server {
    ...
    location / {
        #root   /usr/share/nginx/html;
        #index  index.html index.htm;
        root /opt/app/code;
        random_index on;
        sub_filter 'world' 'python'; # 将response信息中的world替换为python
        sub_filter_once off; # 若匹配到多个，都进行替换
    }
    ...
}

# 配置校验
nginx -tc /etc/nginx/nginx.conf
# 重载配置
systemctl reload nginx.service

验证结果

# 发起多次http请求，输出结果字符串都已经被替换成python了：
[root@centos7 conf.d]# curl http://127.0.0.1
<!DOCTYPE HTML>
<html lang="zh-CN">
<head>
    <title>index_1</title>
    <meta charset="UTF-8"/>
    <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1"/>
</head>
<body>hello python</body>
</html>
[root@centos7 conf.d]# curl http://127.0.0.1
<!DOCTYPE HTML>
<html lang="zh-CN">
<head>
    <title>index_2</title>
    <meta charset="UTF-8"/>
    <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1"/>
</head>
<body>hello python</body>
</html>
[root@centos7 conf.d]# curl http://127.0.0.1
<!DOCTYPE HTML>
<html lang="zh-CN">
<head>
    <title>index_3</title>
    <meta charset="UTF-8"/>
    <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1"/>
</head>
<body>hello python</body>
</html>

Nginx的请求限制

使用模块
limit_conn_module、limit_req_module
前者控制连接频率，后者控制请求频率。

配置上下文
limit_conn_zone和limit_req_zone可配置于http内
limit_conn和limit_req可配置于http、server或location内

配置实践

# 先把之前的配置示例保留下来
cd /etc/nginx/conf.d
mv sub.conf sub.conf.bak
# 从备份目录恢复一个默认配置并改名
cp /opt/backup/default.conf conn_req.conf
# 编辑配置
vi conn_req.conf

# 配置如下
# 开辟一个1m的连接空间，命名为conn_zone。
limit_conn_zone $binary_remote_addr zone=conn_zone:1m;
# 开辟一个1m的请求空间，命名为req_zone。接受每个IP每秒1个的请求频率
limit_req_zone $binary_remote_addr zone=req_zone:1m rate=1r/s;
server {
    ...
    location / {
        #root   /usr/share/nginx/html;
        #index  index.html index.htm;
        root /opt/app/code;
        # 最多允许建立100个连接
        limit_conn conn_zone 100;
        # 按req_zone指定限制请求，即同一IP 1秒只允许1个请求
        limit_req zone=req_zone;
        # 再宽限3个请求，延时处理，按配置速率1秒处理1个
        #limit_req zone=req_zone burst=3;
        # 再宽限3个请求，立即处理，不延时
        #limit_req zone=req_zone burst=3 nodelay;
    }
    ...
}

# 校验配置
nginx -tc /etc/nginx/nginx.conf
# 重载配置
systemctl reload nginx.service

验证结果

# 为方便验证，先按以下命令安装下apache的压测工具ab
yum install apr-util
yum install yum-utils
mkdir /opt/ab
cd /opt/ab
yum install yum-utils.noarch
yumdownloader httpd-tools*
rpm2cpio httpd-*.rpm | cpio -idmv
cp /opt/ab/usr/bin/ab /usr/bin/

# 额外开2个终端窗口分别观察错误日志和访问日志
# 开启错误日志滚动查看
tail -f /var/log/nginx/error.log
# 开启访问日志滚动查看
tail -f /var/log/nginx/access.log

# 用ab命令发出总共10个请求，最大允许同时并发10个
ab -n 10 -c 10 http://127.0.0.1/index_1.html

# 观察error.log日志，可以看到9个被限制的请求：
2018/02/03 17:41:08 [error] 19812#19812: *77 limiting requests, excess: 0.999 by zone "req_zone", client: 127.0.0.1, server: localhost, request: "GET /index_1.html HTTP/1.0", host: "127.0.0.1"
2018/02/03 17:41:08 [error] 19812#19812: *78 limiting requests, excess: 0.999 by zone "req_zone", client: 127.0.0.1, server: localhost, request: "GET /index_1.html HTTP/1.0", host: "127.0.0.1"
2018/02/03 17:41:08 [error] 19812#19812: *79 limiting requests, excess: 0.999 by zone "req_zone", client: 127.0.0.1, server: localhost, request: "GET /index_1.html HTTP/1.0", host: "127.0.0.1"
2018/02/03 17:41:08 [error] 19812#19812: *80 limiting requests, excess: 0.999 by zone "req_zone", client: 127.0.0.1, server: localhost, request: "GET /index_1.html HTTP/1.0", host: "127.0.0.1"
2018/02/03 17:41:08 [error] 19812#19812: *81 limiting requests, excess: 0.999 by zone "req_zone", client: 127.0.0.1, server: localhost, request: "GET /index_1.html HTTP/1.0", host: "127.0.0.1"
2018/02/03 17:41:08 [error] 19812#19812: *82 limiting requests, excess: 0.999 by zone "req_zone", client: 127.0.0.1, server: localhost, request: "GET /index_1.html HTTP/1.0", host: "127.0.0.1"
2018/02/03 17:41:08 [error] 19812#19812: *83 limiting requests, excess: 0.999 by zone "req_zone", client: 127.0.0.1, server: localhost, request: "GET /index_1.html HTTP/1.0", host: "127.0.0.1"
2018/02/03 17:41:08 [error] 19812#19812: *84 limiting requests, excess: 0.999 by zone "req_zone", client: 127.0.0.1, server: localhost, request: "GET /index_1.html HTTP/1.0", host: "127.0.0.1"
2018/02/03 17:41:08 [error] 19812#19812: *85 limiting requests, excess: 0.999 by zone "req_zone", client: 127.0.0.1, server: localhost, request: "GET /index_1.html HTTP/1.0", host: "127.0.0.1"

# 观察access.log日志，可以看到只有第1个请求返回200，后面9个都返回503：
127.0.0.1 127.0.0.1 - - [03/Feb/2018:17:41:08 +0800] "GET /index_1.html HTTP/1.0" 200 208 "-" "ApacheBench/2.3" "-"
127.0.0.1 127.0.0.1 - - [03/Feb/2018:17:41:08 +0800] "GET /index_1.html HTTP/1.0" 503 537 "-" "ApacheBench/2.3" "-"
127.0.0.1 127.0.0.1 - - [03/Feb/2018:17:41:08 +0800] "GET /index_1.html HTTP/1.0" 503 537 "-" "ApacheBench/2.3" "-"
127.0.0.1 127.0.0.1 - - [03/Feb/2018:17:41:08 +0800] "GET /index_1.html HTTP/1.0" 503 537 "-" "ApacheBench/2.3" "-"
127.0.0.1 127.0.0.1 - - [03/Feb/2018:17:41:08 +0800] "GET /index_1.html HTTP/1.0" 503 537 "-" "ApacheBench/2.3" "-"
127.0.0.1 127.0.0.1 - - [03/Feb/2018:17:41:08 +0800] "GET /index_1.html HTTP/1.0" 503 537 "-" "ApacheBench/2.3" "-"
127.0.0.1 127.0.0.1 - - [03/Feb/2018:17:41:08 +0800] "GET /index_1.html HTTP/1.0" 503 537 "-" "ApacheBench/2.3" "-"
127.0.0.1 127.0.0.1 - - [03/Feb/2018:17:41:08 +0800] "GET /index_1.html HTTP/1.0" 503 537 "-" "ApacheBench/2.3" "-"
127.0.0.1 127.0.0.1 - - [03/Feb/2018:17:41:08 +0800] "GET /index_1.html HTTP/1.0" 503 537 "-" "ApacheBench/2.3" "-"
127.0.0.1 127.0.0.1 - - [03/Feb/2018:17:41:08 +0800] "GET /index_1.html HTTP/1.0" 503 537 "-" "ApacheBench/2.3" "-"

# 从ab命令执行后的输出结果，我们也可以看到共10次请求，9次失败：
Concurrency Level:      10
Time taken for tests:   0.002 seconds
Complete requests:      10
Failed requests:        9
   (Connect: 0, Receive: 0, Length: 9, Exceptions: 0)

上面配置里注释掉的burst=3和burst=3 nodelay的情况，可自行尝试。

Nginx的访问控制

基于规则

使用模块
http_access_module

配置上下文

http | server | location | limit_except

配置实践

# 先把之前的配置示例保留下来
cd /etc/nginx/conf.d
mv conn_req.conf conn_req.conf.bak
# 从备份目录恢复一个默认配置并改名
cp /opt/backup/default.conf access.conf
# 编辑配置
vi access.conf

# 配置如下
...
server {
    ...
    location ~ ^/index_1.html {
        root   /opt/app/code;
        deny 115.198.157.60; # 拒绝这个IP访问
        allow all; # 允许其他所有IP访问
    }

    location ~ ^/index_2.html {
        root   /opt/app/code;
        allow 115.198.157.60; # 允许这个IP访问
        deny all; # 拒绝其他所有IP访问
    }
    ...
}

# 校验配置
nginx -tc /etc/nginx/nginx.conf
# 重载配置
systemctl reload nginx.service

验证结果

# 监控错误日志
tail -f /var/log/nginx/error.log

我们用IP为115.198.157.60的客户端去请求。

访问index_1.html：

# 输出错误日志：
2018/02/03 18:34:02 [error] 20000#20000: *10 access forbidden by rule, client: 115.198.157.60, server: localhost, request: "GET /index_1.html HTTP/1.1", host: "39.104.93.171"

访问index_2.html，正常：

当切换另一个IP客户端去访问时，情况是正好相反。

基于认证

使用模块
http_auth_basic_module

配置上下文
http | server | location | limit_except

配置实践

# 我们先创建一个管理页admin.html，我们只允许认证用户访问这个页面
cd /opt/app/code
# 编辑页面内容
vi admin.html

# 输入页面内容如下
<!DOCTYPE HTML>
<html lang="zh-CN">
<head>
    <title>admin</title>
    <meta charset="UTF-8"/>
    <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1"/>
</head>
<body>welcome!!!</body>
</html>

# 安装httpd-tools工具
yum -y install httpd-tools

# 创建账号密码文件, 这里我指定账号为admin
cd /etc/nginx
htpasswd -c ./auth_conf admin

按照提示重复输入两次密码后，auth_conf这个密码文件就创建成功了。

# 查看下密码文件
cat auth_conf

# 长这个样子，就是成对的账号密码，密码加密过
admin:$apr1$NCYCrCl7$3ylJcPn3LEa7FgmwOi1Hy.

接下来我们进行Nginx配置：

# 先把之前的配置示例保留下来
cd /etc/nginx/conf.d
mv access.conf access.conf.bak
# 从备份目录恢复一个默认配置并改名
cp /opt/backup/default.conf auth_basic.conf
# 编辑配置
vi auth_basic.conf

# 配置如下
...
server {
    ...
    location ~ ^/admin.html {
        root    /opt/add/code;
        auth_basic "Auth access!input your password!";
        auth_basic_user_file /etc/nginx/auth_conf;
    }
    ...
}

# 校验配置
nginx -tc /etc/nginx/nginx.conf
# 重载配置
systemctl reload nginx.service

验证结果

客户端网页访问nginx服务器的admin.html页面时显示：

当输错用户名或密码时，会显示：

同时error.log输出：

2018/02/03 19:00:52 [error] 20045#20045: *12 user "hello" was not found in "/etc/nginx/auth_conf", client: 115.198.157.60, server: localhost, request: "GET /admin.html HTTP/1.1", host: "39.104.93.171"
2018/02/03 19:01:11 [error] 20045#20045: *12 user "admin": password mismatch, client: 115.198.157.60, server: localhost, request: "GET /admin.html HTTP/1.1", host: "39.104.93.171"

再次访问，输入正确的账号密码，显示：

Nginx笔记（二）Nginx基础

Nginx配置文件

Nginx变量

Nginx日志

Nginx虚拟主机配置

Nginx模块

Nginx运行状态监控

Nginx随机首页

Nginx请求返回字符替换

Nginx的请求限制

Nginx的访问控制

基于规则

基于认证

zhutianxiang

引用和评论

以太坊实践整理（一）区块链基础知识

TLSv1.3 Support：主流 Web 客户端和服务端对 TLSv1.3 的支持情况

compression-webpack-plugin项目加载优化+nginx配置

在 OpenResty 里实现异步的流式代理

如何获取客户端真实 IP

还在手写Nginx配置？这款Nginx可视化管理工具用起来够方便！

Ubuntu20.04升级openssh9.4（源码升级）