Nginx 服务器配置与运维手册

目录

  1. Nginx 安装与部署
  2. 核心配置详解
  3. 虚拟主机配置
  4. 反向代理配置
  5. 负载均衡配置
  6. SSL/HTTPS配置
  7. 性能优化
  8. 日常运维
  9. 故障排查

1. Nginx 安装与部署

1.1 CentOS/RHEL 安装

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# 添加 Nginx 仓库
yum install -y yum-utils
cat > /etc/yum.repos.d/nginx.repo << EOF
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/\$releasever/\$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
EOF

# 安装 Nginx
yum install -y nginx

# 启动并设置开机自启
systemctl start nginx
systemctl enable nginx

1.2 Ubuntu/Debian 安装

1
2
3
4
5
6
7
8
9
10
11
12
# 添加 Nginx 仓库
apt install -y curl gnupg2 ca-certificates lsb-release
curl -fsSL https://nginx.org/keys/nginx_signing.key | gpg --dearmor -o /usr/share/keyrings/nginx-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/debian `lsb_release -cs` nginx" | tee /etc/apt/sources.list.d/nginx.list

# 安装 Nginx
apt update
apt install -y nginx

# 启动并设置开机自启
systemctl start nginx
systemctl enable nginx

1.3 验证安装

1
2
3
4
5
6
7
8
9
10
11
# 查看版本
nginx -v

# 测试配置文件
nginx -t

# 检查运行状态
systemctl status nginx

# 查看监听端口
ss -tulpn | grep nginx

2. 核心配置详解

2.1 配置文件结构

1
2
3
4
5
6
7
8
9
10
11
# 主配置文件
/etc/nginx/nginx.conf

# 配置目录
/etc/nginx/conf.d/

# 日志目录
/var/log/nginx/

# 网站根目录
/usr/share/nginx/html/

2.2 nginx.conf 核心配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
# 运行用户和组
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

# 事件模块
events {
    worker_connections 10240;
    use epoll;
    multi_accept on;
}

# HTTP 模块
http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # 日志格式
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    # 性能优化
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;

    # Gzip 压缩
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml application/json application/javascript application/xml;

    # 包含其他配置
    include /etc/nginx/conf.d/*.conf;
}

3. 虚拟主机配置

3.1 基于域名的虚拟主机

1
2
3
4
5
6
7
8
9
10
11
12
13
14
server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }

    # 错误页面
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;
}

3.2 基于端口的虚拟主机

1
2
3
4
5
6
7
8
9
10
11
server {
    listen 8080;
    server_name _;
    root /var/www/app1;
}

server {
    listen 8081;
    server_name _;
    root /var/www/app2;
}

3.3 基于 IP 的虚拟主机

1
2
3
4
5
6
7
8
9
10
11
server {
    listen 192.168.1.10:80;
    server_name _;
    root /var/www/site1;
}

server {
    listen 192.168.1.11:80;
    server_name _;
    root /var/www/site2;
}

4. 反向代理配置

4.1 基础反向代理

1
2
3
4
5
6
7
8
9
10
11
12
server {
    listen 80;
    server_name proxy.example.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

4.2 带缓存的反向代理

1
2
3
4
5
6
7
8
9
10
11
12
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:100m max_size=10g inactive=60m;

server {
    location / {
        proxy_pass http://backend;
        proxy_cache my_cache;
        proxy_cache_valid 200 302 10m;
        proxy_cache_valid 404 1m;
        proxy_cache_key $scheme$request_method$host$request_uri;
        add_header X-Cache-Status $upstream_cache_status;
    }
}

4.3 WebSocket 代理

1
2
3
4
5
6
7
8
location /ws/ {
    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_read_timeout 86400;
}

5. 负载均衡配置

5.1 轮询（默认）

1
2
3
4
5
6
7
8
9
10
11
upstream backend {
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

server {
    location / {
        proxy_pass http://backend;
    }
}

5.2 权重分配

1
2
3
4
5
upstream backend {
    server 192.168.1.10:8080 weight=3;
    server 192.168.1.11:8080 weight=2;
    server 192.168.1.12:8080 weight=1;
}

5.3 IP Hash

1
2
3
4
5
6
upstream backend {
    ip_hash;
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

5.4 最少连接

1
2
3
4
5
6
upstream backend {
    least_conn;
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

5.5 健康检查

1
2
3
4
5
upstream backend {
    server 192.168.1.10:8080 max_fails=3 fail_timeout=30s;
    server 192.168.1.11:8080 max_fails=3 fail_timeout=30s;
    server 192.168.1.12:8080 backup;
}

6. SSL/HTTPS 配置

6.1 自签名证书

1
2
3
4
5
6
7
8
# 生成私钥
openssl genrsa -out server.key 2048

# 生成 CSR
openssl req -new -key server.key -out server.csr

# 生成证书
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

6.2 HTTPS 配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    location / {
        root /var/www/example;
        index index.html;
    }
}

# HTTP 重定向到 HTTPS
server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

6.3 Let’s Encrypt 证书

1
2
3
4
5
6
7
8
# 安装 certbot
yum install -y certbot python3-certbot-nginx

# 获取证书
certbot --nginx -d example.com -d www.example.com

# 自动续期
certbot renew --dry-run

7. 性能优化

7.1 Worker 进程优化

1
2
3
4
5
6
7
8
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 65535;
    multi_accept on;
    use epoll;
}

7.2 缓存优化

1
2
3
4
5
6
7
8
# 静态文件缓存
location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
    expires 30d;
    add_header Cache-Control "public, immutable";
}

# 开启缓存
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=STATIC:100m max_size=10g;

7.3 Gzip 压缩

1
2
3
4
5
6
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_proxied expired no-cache no-store private auth;
gzip_comp_level 6;
gzip_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;

7.4 连接优化

1
2
3
4
keepalive_timeout 65;
keepalive_requests 100;
tcp_nopush on;
tcp_nodelay on;

8. 日常运维

8.1 服务管理

1
2
3
4
5
6
7
8
9
10
11
# 启动/停止/重启
systemctl start nginx
systemctl stop nginx
systemctl restart nginx

# 重载配置（不中断服务）
systemctl reload nginx
nginx -s reload

# 查看状态
systemctl status nginx

8.2 配置测试

1
2
3
4
5
# 测试配置文件语法
nginx -t

# 显示配置信息
nginx -T

8.3 日志管理

1
2
3
4
5
6
7
8
# 查看访问日志
tail -f /var/log/nginx/access.log

# 查看错误日志
tail -f /var/log/nginx/error.log

# 日志轮转
logrotate -f /etc/logrotate.d/nginx

8.4 性能监控

1
2
3
4
5
6
7
8
# 查看连接数
ss -s | grep nginx

# 查看活动连接
curl http://localhost/nginx_status

# 监控请求数
awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn

9. 故障排查

9.1 常见问题

Nginx 无法启动

1
2
3
4
5
6
7
8
# 检查端口占用
ss -tulpn | grep :80

# 检查配置文件
nginx -t

# 查看错误日志
tail -50 /var/log/nginx/error.log

502 Bad Gateway

1
2
3
4
5
6
# 检查后端服务
systemctl status backend-service

# 检查 upstream 配置
# 确认后端服务器可访问
curl -I http://backend-server:port

403 Forbidden

1
2
3
4
5
6
# 检查文件权限
ls -la /var/www/html

# 检查 SELinux
getenforce
setenforce 0  # 临时禁用测试

404 Not Found

1
2
3
4
5
# 检查 root 路径配置
# 检查文件是否存在
ls -la /var/www/html/filename

# 检查 try_files 配置

9.2 调试模式

1
2
3
4
5
# 增加日志详细程度
error_log /var/log/nginx/error.log debug;

# 开启调试日志后重启
systemctl restart nginx

文档版本: 1.0
最后更新: 2026-02-27
适用版本: Nginx 1.20+