前端 Nginx https SSL proxy + 后端 Nginx http 应用的布署教程
这里主要讲述《前端 Nginx https SSL proxy + 后端 Nginx http 应用的布署教程》有关nginx后端的服务配置优化这里不再复述,将在别外的贴子分享。 有关如何申请Let's Encrypt SSL/TLS免费证书,已经在《免费SSL安全证书Let's Encrypt SSL/TLS - FreeBSD NGINX 配置教程》贴子里已经有详细说明。 我有代码洁癖,所以在以下的配置文件进行了归集整理,固定的配置进行归集分类,尽可能的减少维护成本。
前端代理服务器 HTTPS and HTTP2
操作系统: | FreeBSD |
web 代理服务: | Nginx |
SSL工具: | LibreSSL |
免费证书: | Let’s Encrypt |
证书申请工具: | py-certbot 依赖包 letsencrypt |
后端应用服力器 HTTP
操作系统: | FreeBSD |
web 应用服务: | Nginx / Tomcat |
前/后 端的布署结构
nginx proxy https (192.168.0.1)
[ 80 + 443 ]
|
|
↓
[ 80 ]
nginx http / tomcat http (192.168.0.10)
前端代理服务器 nginx proxy https (192.168.0.1)布署结构
nginx and www 目录地址:
nginx 配置目录:/usr/local/etc/nginx/
www 网站目录:/usr/local/www/nginx/
前端nginx 配置目录结构:
nginx 配置文件目录结构
|--fastcgi_params
|--uwsgi_params
|--scgi_params
|--koi-utf
|--koi-win
|--win-utf
|--mime.types
|--nginx.conf #nginx的主配置文件
|--proxy
| |--proxy_cache # nginx 缓存配置配置文件
| |--proxy_hosts # nginx 反向代理配置文件
| |--proxy_letsencrypt #Let’s Encrypt 申请证书的验证目录
| |--proxy_security #nginx 的安全配置文件
| |--proxy_ssl #nginx SSL 配置文件
|
|--vhosts
|
|--qi-cloud.com #虚拟目录网站配置文件
|--.. #更多vd域久配置文件
nginx 优化后的配置文件:
root@Proxy:/ # vi /usr/local/etc/nginx/nginx.conf
user www www;
worker_processes auto;
pid /var/run/nginx.pid;
error_log /dev/null;
worker_rlimit_nofile 102400;
events {
use kqueue; #kqueue用在bsd上,epoll用在linux上
multi_accept on;
worker_connections 20480;
}
http {
server_tokens off;
include mime.types;
default_type application/octet-stream;
source_charset utf-8;
server_names_hash_bucket_size 256;
client_header_buffer_size 256k;
large_client_header_buffers 4 256k;
client_max_body_size 50m;
client_body_buffer_size 256k;
client_header_timeout 3m;
client_body_timeout 3m;
send_timeout 300;
sendfile on;
tcp_nopush on;
keepalive_timeout 120;
tcp_nodelay on;
reset_timedout_connection on;
limit_conn_zone $binary_remote_addr zone=addr:5m;
limit_conn addr 100;
open_file_cache max=100000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors on;
gzip on;
gzip_disable "msie6";
gzip_proxied any;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.0;
gzip_comp_level 4;
gzip_types text/plain application/x-javascript text/css application/xml;
gzip_vary on;
proxy_connect_timeout 300; #这里的时间设置,避免后台服务执行超时问题
proxy_send_timeout 300; #这里的时间设置,避免后台服务执行超时问题
proxy_read_timeout 600; #这里的时间设置,避免后台服务执行超时问题
proxy_buffer_size 256k;
proxy_buffers 128 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_next_upstream error timeout invalid_header http_500 http_503 http_404;
proxy_max_temp_file_size 128m;
proxy_cache_path /var/tmp/nginx/proxy_cache levels=1:2 keys_zone=proxy_cache_one:300m inactive=1d max_size=5g;
access_log off;
server{ #拦截所有指向过来的域名,没有配置时返回403
listen 80 default;
server_name _;
return 403;
}
include vhosts/*;
}
root@Proxy:/ # vi /usr/local/etc/nginx/proxy/proxy_cache
location ~ /purge(/.*)
{ #清理nginx的静态缓存权限
allow 127.0.0.1;
allow 10.10.0.0/16;
allow 192.168.0.0/16;
deny all;
}
location ~* ^.+.gzjs$ { #已是压缩后的数据不再进行gzip压缩处理
add_header Content-Encoding gzip;
gzip off;
}
root@Proxy:/ # vi /usr/local/etc/nginx/proxy/proxy_hosts
location /
{
proxy_cache proxy_cache_one;
proxy_cache_valid 200 301 302 304 20m;
proxy_cache_key $host$uri$is_args$args;
expires 30m;
proxy_redirect off;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Scheme $scheme;
proxy_set_header Accept-Encoding "";
proxy_pass_header User-Agent;
proxy_pass http://$proxy_vps_add;
#这里是解决https前端代理时后端传过来的url地址带有http url时不显示图片及css问题
#这里用nginx的sub_filter,把http替换为https url,很多人卡在这个上面
sub_filter_types text/css text/xml;
sub_filter http://$host $scheme://$host;
sub_filter_once off;
}
root@Proxy:/ # vi /usr/local/etc/nginx/proxy/proxy_letsencrypt
location /.well-known/ { #这是主要是为了申请证书及证书续签时的验证
default_type "text/plain";
alias /usr/local/www/nginx/.well-known/;
}
root@Proxy:/ # vi /usr/local/etc/nginx/proxy/proxy_security
location ~ ^/images/.*\.(do|php|jsp|cgi|pl|asp|aspx)$
{
deny all;
}
location ~ ^/static/.*\.(do|php|jsp|cgi|pl|asp|aspx)$
{
deny all;
}
location ~ ^/data/(attachment|avatar)/.*\.(do|php|jsp|cgi|pl|asp|aspx)$
{
deny all;
}
if ($fastcgi_script_name ~ \..*\/.*(do|php|jsp|cgi|pl|asp|aspx)) {
return 403;
}
root@Proxy:/ # vi /usr/local/etc/nginx/proxy/proxy_ssl
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA";
ssl_prefer_server_ciphers on;
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1440m;
ssl_session_tickets on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 10s;
root@Proxy:/ # vi /usr/local/etc/nginx/vhosts/qi-cloud.com
server
{
#启动http、https、http2
listen 80;
listen 443 ssl http2;
#配置域名
server_name qi-cloud.com;
server_name www.qi-cloud.com;
#Let’s Encrypt 申请证书及续签证书时的验证目录配置文件,这个必须放在前面。
include proxy/proxy_letsencrypt;
#将不带www访问过来的url转换为https://www.访问
if ($host != 'www.qi-cloud.com') {
return 301 https://www.qi-cloud.com$request_uri;
}
#将http访问过来的url转换为https访问
if ($scheme = 'http') {
return 301 https://www.qi-cloud.com$request_uri;
}
#Let’s Encrypt 针对qi-cloud.com域名的证书地址
ssl_certificate /usr/local/etc/letsencrypt/live/qi-cloud.com/fullchain.pem;
ssl_certificate_key /usr/local/etc/letsencrypt/live/qi-cloud.com/privkey.pem;
#反向代理后端服务器的地址及http端口
set $proxy_vps_add 192.168.0.10:80;
#加载其它的公共配置文件
include proxy/proxy_ssl; #Htts ssl相关配置文件
include proxy/proxy_cache; #nginx SSL 配置文件
include proxy/proxy_security; #nginx 的安全配置文件
include proxy/proxy_hosts; #nginx 反向代理配置文件
}
后端应用服务器 nginx http(192.168.0.10)布署结构
nginx and www 目录地址:
nginx 配置目录:/usr/local/etc/nginx/
www 网站目录:/usr/local/www/nginx/
后端nginx 配置目录结构:
nginx 配置文件目录结构
|--fastcgi_params
|--uwsgi_params
|--scgi_params
|--koi-utf
|--koi-win
|--win-utf
|--mime.types
|--nginx.conf #nginx的主配置文件
|--vhosts_params #vd虚拟主机公共配置文件
|--vhosts
|
|--qi-cloud.com #虚拟目录网站配置文件
|--.. #更多vd域久配置文件
nginx 优化后的配置文件:
load_module /usr/local/libexec/nginx/ngx_stream_module.so;
load_module /usr/local/libexec/nginx/ngx_mail_module.so;
load_module /usr/local/libexec/nginx/ngx_http_perl_module.so;
user www www;
worker_processes auto;
pid /var/run/nginx.pid;
error_log /dev/null;
worker_rlimit_nofile 102400;
events {
use kqueue; #kqueue用在bsd上,epoll用在linux上
multi_accept on;
worker_connections 20480;
}
http {
server_tokens off;
include mime.types;
default_type application/octet-stream;
source_charset utf-8;
server_names_hash_bucket_size 256;
client_header_buffer_size 256k;
large_client_header_buffers 4 256k;
client_max_body_size 50m;
client_body_buffer_size 256k;
client_header_timeout 3m;
client_body_timeout 3m;
send_timeout 300;
sendfile on;
tcp_nopush on;
keepalive_timeout 120;
tcp_nodelay on;
reset_timedout_connection on;
limit_conn_zone $binary_remote_addr zone=addr:5m;
limit_conn addr 100;
open_file_cache max=100000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors on;
gzip on;
gzip_disable "msie6";
gzip_proxied any;
gzip_min_length 1k;
gzip_buffers 8 32k;
gzip_http_version 1.0;
gzip_comp_level 4;
gzip_types text/plain application/x-javascript text/css application/xml;
gzip_vary on;
fastcgi_connect_timeout 300;
fastcgi_send_timeout 300;
fastcgi_read_timeout 300;
fastcgi_buffer_size 256k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 512k;
fastcgi_temp_file_write_size 256k;
fastcgi_temp_path /var/tmp/nginx/fastcgi_temp;
fastcgi_cache_path /var/tmp/nginx/fastcgi_cache levels=1:2 keys_zone=ngx_fcgi_cache:10m inactive=5m max_size=2g;
fastcgi_cache_valid 200 302 1h;
fastcgi_cache_valid 301 1d;
fastcgi_cache_valid any 1m;
fastcgi_cache_min_uses 1;
fastcgi_cache_use_stale error timeout invalid_header http_500;
access_log off;
server{
listen 80 default;
server_name _;
return 403;
}
include vhosts/*;
}
root@Proxy:/ # vi /usr/local/etc/nginx/vhosts_params
location ~ .*\.(php|php5)?$ { #支持php脚本运行
gzip off;
fastcgi_pass unix:/tmp/php-fcgi.sock; #采用sock通道链接,提升效率
fastcgi_index index.php;
include fastcgi_params;
fastcgi_intercept_errors off;
fastcgi_cache ngx_fcgi_cache;
fastcgi_cache_key $scheme$request_method$host$request_uri;
}
location ~ .*\.(pl|cgi)?$ { #支持perl脚本运行
gzip off;
fastcgi_pass unix:/tmp/perl-fcgi.sock; #采用sock通道链接,提升效率
fastcgi_index index.cgi;
include fastcgi_params;
fastcgi_intercept_errors off;
fastcgi_cache ngx_fcgi_cache;
fastcgi_cache_key $scheme$request_method$host$request_uri;
}
location ~ ^/nginxstatus/ {
stub_status on;
}
location ~* ^.+.gzjs$ {
add_header Content-Encoding gzip;
gzip off;
}
root@Proxy:/ # vi /usr/local/etc/nginx/vhosts/qi-cloud.com
server
{ #后台nginx 网站配置信息
listen 80;
server_name www.qi-cloud.com;
index index.html index.htm index.php;
root /usr/local/www/qi-cloud.com;
include vhosts_params;
}
No Comments