程序小院

Nginx常用的配置

1、web配置

server {
  # 项目启动端口
  listen            80;
  # 域名（localhost）
  server_name;
  # 禁止 iframe 嵌套
  add_header        X-Frame-Options SAMEORIGIN;
  # 访问地址 根路径配置
  location / {
    # 项目目录地址
    root         server/html;
    # 默认读取文件
    index           index.html;
    # 配置 history 模式的刷新空白
    try_files       $uri $uri/ /index.html;
  }
}

2、后缀匹配，解决静态资源找不到问题

location ~* \.(gif|jpg|jpeg|png|css|js|ico)$ { 
    root     html/static/;
}

3、图片防盗链

location ~/static/.*\.(jpg|jpeg|png|gif|webp)$ {
    root              html;
    valid_referers    *.deeruby.com;
    if ($invalid_referer) {
      return          403;
    }
}

4、访问限制

location /static {
    root               html;
    # allow 允许
    allow              xx.xxx.xxx.xxx;
    # deny  拒绝
    deny               all;
}

5、隐藏 Nginx 版本信息

http {
  server_tokens         off;
}

6、禁止ip直接访问80端口

server {
  listen                80 default;
  server_name           _;
  return                500;
}

7、PC端和移动端使用不同的项目文件映射

server {
  location / {
    root /home/static/pc;
    if ($http_user_agent ~* '(mobile|android|iphone|ipad|phone)') {
      root /home/static/mobile;
    }
    index index.html;
  }
}

8、配置负载均衡

upstream my_upstream {
  server                http://127.0.0.1:9001;
  server                http://127.0.0.1:9002;
  server                http://127.0.0.1:9003;
}
server {
  listen                9000;
  server_name           test.com;
  location / {
    proxy_pass          my_upstream;
    proxy_set_header    Host $proxy_host;
    proxy_set_header    X-Real-IP $remote_addr;
    proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
  }
}

9、SSL 配置 HTTPS

server {
  listen                      80;
  server_name                 www.xxx.com;
  # 将 http 重定向转移到 https
  return 301 https://$server_name$request_uri;
}
server {
  listen                      443 ssl;
  server_name                 www.xxx.com;
  ssl_certificate             /etc/nginx/ssl/www.xxx.com.pem;
  ssl_certificate_key         /etc/nginx/ssl/www.xxx.com.key;
  ssl_session_timeout         10m;
  ssl_ciphers                 ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
  ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers   on;
  location / {
    root                    /project/xxx;
    index                   index.html index.htm index.md;
    try_files               $uri $uri/ /index.html;
  }
}