1
sudo apt update
2
sudo apt install nginx -y

1
sudo systemctl status nginx

1
curl http://localhost

1
server {
2
    listen 80;                  # 监听端口
3
    server_name example.com;    # 域名
4
    root /var/www/example.com;  # 网站根目录
5
    index index.html index.htm;
6

7
    location / {
8
        try_files $uri $uri/ =404;
9
    }
10
}

1
location / {
2
    # 匹配根路径
3
}
4

5
location /images/ {
6
    # 匹配以 /images/ 开头的路径
7
}
8

9
location ~ \.php$ {
10
    # 正则匹配 .php 结尾的请求
11
}

1
sudo mkdir -p /var/www/example.com
2
sudo chown -R $USER:$USER /var/www/example.com

1
echo "<h1>Hello from example.com</h1>" | sudo tee /var/www/example.com/index.html

1
server {
2
    listen 80;
3
    listen [::]:80;
4
    server_name example.com www.example.com;
5

6
    root /var/www/example.com;
7
    index index.html index.htm;
8

9
    location / {
10
        try_files $uri $uri/ =404;
11
    }
12
}

1
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/

1
sudo nginx -t          # 测试配置文件语法
2
sudo systemctl reload nginx

1
server {
2
    listen 80;
3
    server_name api.example.com;
4

5
    location / {
6
        proxy_pass http://localhost:3000;
7
        proxy_set_header Host $host;
8
        proxy_set_header X-Real-IP $remote_addr;
9
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
10
        proxy_set_header X-Forwarded-Proto $scheme;
11
    }
12
}

1
location /ws/ {
2
    proxy_pass http://localhost:8080;
3
    proxy_http_version 1.1;
4
    proxy_set_header Upgrade $http_upgrade;
5
    proxy_set_header Connection "upgrade";
6
    proxy_set_header Host $host;
7
}

1
upstream backend {
2
    server backend1.example.com weight=3;
3
    server backend2.example.com;
4
    server backend3.example.com backup;  # 备份服务器
5
}

1
server {
2
    listen 80;
3
    server_name app.example.com;
4

5
    location / {
6
        proxy_pass http://backend;
7
        proxy_set_header Host $host;
8
        proxy_set_header X-Real-IP $remote_addr;
9
    }
10
}

1
sudo apt install certbot python3-certbot-nginx -y

1
sudo certbot --nginx -d example.com -d www.example.com

1
server {
2
    listen 443 ssl http2;
3
    listen [::]:443 ssl http2;
4
    server_name example.com;
5

6
    ssl_certificate /etc/ssl/certs/example.com.crt;
7
    ssl_certificate_key /etc/ssl/private/example.com.key;
8

9
    ssl_protocols TLSv1.2 TLSv1.3;
10
    ssl_ciphers HIGH:!aNULL:!MD5;
11

12
    root /var/www/example.com;
13
    index index.html;
14
}

1
server {
2
    listen 80;
3
    listen [::]:80;
4
    server_name example.com;
5
    return 301 https://$server_name$request_uri;
6
}

1
location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
2
    expires 30d;
3
    add_header Cache-Control "public, no-transform";
4
}

1
http {
2
    proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=mycache:10m inactive=60m;
3
    proxy_cache_key "$scheme$request_method$host$request_uri";
4

5
    server {
6
        location / {
7
            proxy_cache mycache;
8
            proxy_cache_valid 200 302 60m;
9
            proxy_cache_valid 404 1m;
10
            proxy_pass http://backend;
11
        }
12
    }
13
}

1
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
2
                '$status $body_bytes_sent "$http_referer" '
3
                '"$http_user_agent" "$http_x_forwarded_for"';
4

5
access_log /var/log/nginx/access.log main;

1
server {
2
    access_log /var/log/nginx/example.com.access.log main;
3
    error_log  /var/log/nginx/example.com.error.log warn;
4
}

1
worker_processes auto;

1
events {
2
    worker_connections 10240;
3
    multi_accept on;
4
}

1
sendfile on;
2
tcp_nopush on;

1
gzip on;
2
gzip_vary on;
3
gzip_proxied any;
4
gzip_comp_level 6;
5
gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml image/svg+xml;

1
client_max_body_size 100M;
2
client_body_buffer_size 128k;
3
client_header_buffer_size 1k;

1
server_tokens off;

1
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
2
    return 405;
3
}

1
location /admin {
2
    allow 192.168.1.0/24;
3
    deny all;
4
}

1
ssl_protocols TLSv1.2 TLSv1.3;
2
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
3
ssl_prefer_server_ciphers off;