生产环境中SpringBoot 一般不直接暴露端口给用户前面都会加一层 Nginx。Nginx 负责反向代理、负载均衡、SSL 证书、静态资源缓存等。一、反向代理基本配置server { listen 80; server_name api.example.com; location / { proxy_pass http://127.0.0.1:9090; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } }二、负载均衡upstream seckill_backend { # weight 越大分配到的请求越多 server 192.168.1.101:9090 weight3; server 192.168.1.102:9090 weight2; server 192.168.1.103:9090 weight1; } server { listen 80; location / { proxy_pass http://seckill_backend; proxy_http_version 1.1; proxy_set_header Connection ; } }三、HTTPSsudoaptinstallcertbot python3-certbot-nginx-ysudocertbot--nginx-dapi.example.comserver { listen 443 ssl; server_name api.example.com; ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem; location / { proxy_pass http://127.0.0.1:9090; } }四、WebSocket 支持location /ws { proxy_pass http://127.0.0.1:9090; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade; proxy_set_header Host $host; proxy_read_timeout 300s; }五、静态资源缓存location /static/ { root /opt/app/; expires 7d; add_header Cache-Control public, immutable; }六、安全与限流# 限制同一 IP 每秒最多 10 个请求 limit_req_zone $binary_remote_addr zoneapi_limit:10m rate10r/s; server { location /api/ { limit_req zoneapi_limit burst20 nodelay; proxy_pass http://127.0.0.1:9090; } } 觉得有用的话点赞 关注【张老师技术栈】吧每周更新 Java/Python/爬虫 实战干货不让你白来。