nginx

常用命令

# 启动
sudo systemctl start nginx

# 停止
sudo systemctl stop nginx

# 重启
sudo systemctl restart nginx

# 重新加载配置文件
sudo nginx -s reload

代理和反向代理

root@ubuntu:/etc/nginx# cat nginx.conf
user orig;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
    # multi_accept on;
}

http {
    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL Settings
    ##

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;

    server {
        listen 80;
        server_name wenjianfeng.top;

        location / {
            root        /home/orig/blog/apaki/docs/.vuepress/dist;
            index       index.html;
        }
    }

    server {
        listen 80;
        server_name git.wenjianfeng.top;

        location / {
            proxy_pass http://xxx.xxx.xxx.xxx:yyyy;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

证书

user orig;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
    # multi_accept on;
}

http {
    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;
    # server_tokens off;
    
    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;
    
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    ##
    # SSL Settings
    ##
    
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;
    
    ##
    # Logging Settings
    ##
    
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;
    
    ##
    # Gzip Settings
    ##
    
    gzip on;
    

    server {
        listen 443 ssl;  
        server_name blog.wenjianfeng.top;
        
        ssl_certificate /xxx_your_path/blog.wenjianfeng.top.pem;
        ssl_certificate_key /xxx_your_path/blog.wenjianfeng.top.key;
        
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        
        location / {
            root	/home/orig/blog/apaki/docs/.vuepress/dist;
            index 	index.html;
        }
    }
    
    server {
        listen 443 ssl;  
        server_name git.wenjianfeng.top;  
            
        ssl_certificate /xxx_your_path/git.wenjianfeng.top.pem;
        ssl_certificate_key /xxx_your_path/git.wenjianfeng.top.key;
        
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        
        location / {
            proxy_pass http://xxx.xxx.xxx.xxx:yyyy;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
    
    server {
        listen 80;  
        server_name blog.wenjianfeng.top;
        
        # 80 -> 443
        rewrite ^(.*) https://$server_name$1 permanent;
    }
    
    server {
        listen 80;  
        server_name git.wenjianfeng.top;  
        
        # 80 -> 443
        rewrite ^(.*) https://$server_name$1 permanent;
    }
}

问题和解决方案

• 子域名反向代理

  最初想使用域名子路径的方式来实现反向代理，但是会遇到诸多问题。且某些第三方工具配置到子地址会很繁琐。因此采用子域名反向代理。