Nginx安装及设置成开机启动

nginx配置https和IP白名单nginx安装ssl证书并配置nginx限制IP访问通过yum来直接安装# add the yum repo: wget https://openresty.org/package/centos/openresty.repo sudo mv openresty.repo /etc/yum.repos.d/ # update the yum index: sudo yum check-update sudo yum install -y openrestyopenresty.repo:[openresty] nameOfficial OpenResty Open Source Repository for CentOS baseurlhttps://openresty.org/package/centos/$releasever/$basearch skip_if_unavailableFalse gpgcheck1 repo_gpgcheck0 gpgkeyhttps://openresty.org/package/pubkey.gpg enabled1 enabled_metadata1官方yum安装教程其中核心包括如何加入到service可以使用systemctl start nginx的命令参考链接也可以参考手动安装的过程安装建议直接安装openresty官方安装教程yum install pcre-devel openssl-devel gcc curl tar -xzvf openresty-VERSION.tar.gz cd openresty-VERSION/ ./configure make sudo make install1、安装PCRE库 # 解压文件 tar -zxvf pcre-8.37.tar.gz cd pcre-8.34 ./configure make make install 2、安装zlib库 # 解压文件 tar -zxvf zlib-1.2.11.tar.gz cd zlib-1.2.11 ./configure make make install 3、解压nginx_mod_h264_streaming-2.2.7 #解压文件 tar -zxvf nginx_mod_h264_streaming-2.2.7.tar.gz 4、安装nginx unzip nginx-1.5.3.zip cd nginx-1.5.3 ./configure --add-module../nginx_mod_h264_streaming-2.2.7 make make install 5、配置nginx cd /usr/local/nginx/conf/ vi nginx.conf 在http增加 loadstream ffcsvideo{ loadserver 192.168.34.182:7777;//流媒体管理的ip和端口 } include /etc/nginx/conf.d/*.conf; include /etc/nginx/sites-enabled/*; include /etc/nginx/tmp-test.conf; 在server增加 location ~\.mp4$ { mp4; load_proxy_pass http://ffcsvideo; } 修改server 的root目录跟流媒体服务的目录一致 启动nginx ../sbin/nginxnginx加载自定义的conf文件在nginx.conf里中的http加入include /etc/nginx/conf.d/*.conf; include /etc/nginx/sites-enabled/*; include /etc/nginx/tmp-test.conf;编译安装的nginx放到全局里执行vim ~/.bash_profile alias nginx/usr/local/nginx/sbin/nginx source ./bash_profile开启nginx请求日志获取请求体开启这类日志需要确保nginx安装了echo模块echo-nginx-module推荐安装openresty他自带了许多模块如果是nginx的可以参考github nginx安装安装完成后在nginx.conf里添加log_format记住需要顶格写在http下log_format main escapejson $remote_addr - $remote_user [$time_local] $request $status $body_bytes_sent $http_referer dm:$request_body $http_user_agent $http_x_forwarded_for;在具体请求配置文件里开启日志server { listen 80; server_name api.stkmart.com.au; access_log /service/access_log/litemall_80.log main;最后nginx -s reload一下即可遗留问题某种情况下上述这样设置后没能生效需要在具体请求配置文件里再加一句echo_read_request_body;server { listen 8083; server_name localhost; access_log /service/logs/access.log diy; location /test{ echo_read_request_body; echo hello; echo the word is $dollar; echo $dollar; } }但是问题是有服务器加了这个后nginx无法再解析请求nginx转发路径server { listen 80; server_name 192.168.188.149; charset utf-8; location / { proxy_pass http://192.168.188.149:81; } location /console { proxy_pass http://192.168.188.149:7001; } location /mytest { proxy_pass http://192.168.188.149:8080; }访问http://192.168.188.149/ 就是iis的应用,相当于访问http://192.168.188.149:81访问http://192.168.188.149/console 就是访问weblogic应用相当于访问http://192.168.188.149:7001/console访问http://192.168.188.149/mytest就是访问tomcat应用相当于访问http://192.168.188.149:8080/mytest如果想要达到访问http://192.168.188.149/mytest相当于访问http://192.168.188.149:8080/的效果去掉后缀只需要在8080后加/即可proxy_pass http://192.168.188.149:8080;添加模块此处比如要添加openssl模块#查看已有的modulenginx-Vconfigure arguments:--prefix/opt/nginx--usernginx--groupnginx --with-http_ssl_module --with-http_gzip_static_module --with-http_stub_status_module --with-pcre/opt/software/pcre-8.35 --with-zlib/opt/software/zlib-1.2.8 --with-openssl/opt/software/openssl-1.0.1i将上述的nginx模块显示加入到configure命令里./configure --with-openssl/usr/local/openssl -with-http_ssl_module --with-http_gzip_static_module makemake结束后备份原nginx可执行程序cp /opt/nginx/sbin/nginx /opt/nginx/sbin/nginx.bak cp -f /opt/software/nginx-1.8.1/objs/nginx /opt/nginx/sbin/nginx安装openssl和http2openssl安装openssl下载./config make make install make -t make depend设置环境变量/etc/profile增加export PATH$PATH:/usr/local/ssl/bin/然后执行source /etc/profilenginx添加http2openssl模块./configure --with-openssl/usr/local/openssl --with-http_ssl_module --with-http_v2_module配置nginx限制文件类型访问这里有两个思路一类是只允许特定文件类型访问一类是禁止特定文件类型访问直接看在nginx上的配置return 403的是拒绝了以zip尾缀和带有myadmin的访问另外一个则是只允许htmljs这类的访问server { listen 8091; server_name localhost; location ~* \.(html|htm|php|gif|jpg|jpeg|bmp|png|ico|js|css)$ { root /etc/nginx/test; index index.html index.htm index.php; expires 3d; } error_page 500 502 503 504 /50x.html; location /50x.html { root html; } location ~ (\.zip$|myadmin) { return 403; } }配置https#以下属性中以ssl开头的属性表示与证书配置有关。 server { listen 443 ssl; #配置HTTPS的默认访问端口为443。 #如果未在此处配置HTTPS的默认访问端口可能会造成Nginx无法启动。 #如果您使用Nginx 1.15.0及以上版本请使用listen 443 ssl代替listen 443和ssl on。 server_name yourdomain.com; #需要将yourdomain.com替换成证书绑定的域名。 root html; index index.html index.htm; ssl_certificate cert/cert-file-name.pem; #需要将cert-file-name.pem替换成已上传的证书文件的名称。 ssl_certificate_key cert/cert-file-name.key; #需要将cert-file-name.key替换成已上传的证书私钥文件的名称。 ssl_session_timeout 5m; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; #表示使用的加密套件的类型。 ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3; #表示使用的TLS协议的类型。 ssl_prefer_server_ciphers on; location / { root html; #站点目录。 index index.html index.htm; } }如果需要http自动跳转httpsserver { listen 80; server_name yourdomain.com; #需要将yourdomain.com替换成证书绑定的域名。 rewrite ^(.*)$ https://$host$1; #将所有HTTP请求通过rewrite指令重定向到HTTPS。 location / { index index.html index.htm; } }配置无缓存# kill cache add_header Last-Modified $date_gmt; add_header Cache-Control no-store, no-cache; if_modified_since off; expires off; etag off;nginx跨域问题在配置文件里加入方式1location / { add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Methods GET, POST, OPTIONS; add_header Access-Control-Allow-Headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization; if ($request_method OPTIONS) { return 204; } }方式2location /{proxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;proxy_pass http://127.0.0.1:8099;proxy_set_header Host$host;add_header Access-Control-Allow-Origin*always;add_header Access-Control-Allow-MethodsGET, POST, OPTIONS, DELETE, PATCHalways;add_header Access-Control-Allow-HeadersDNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Access-Source,Authorizationalways;add_header Access-Control-Expose-HeadersAccess-Source,Authorizationalways;add_header Access-Control-Max-Age86400always;add_header Access-Control-Allow-Credentialstruealways;if($request_methodOPTIONS){return204;}}如果出现提示The Access-Control-Allow-Origin header contains multiple values http://welfare-exchange.health100tech.com, *, but only one is allowed.意味着后端代码也做了跨域的配置可在nginx中添加proxy_hide_header Access-Control-Allow-Origin;