Nginx 部署和配置

1. 安装

[root@localhost ~]# yum -y install gcc wget pcre-devel openssl-devel# sticky 第三方扩展的模块用于 session 绑定, 比 nginx 默认实现的 session 绑定模块更加强大[root@localhost ~]# wget https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng/get/master.tar.gz[root@localhost ~]# wget http://nginx.org/download/nginx-1.14.2.tar.gz[root@localhost ~]# tar xvf nginx-1.14.2.tar.gz [root@localhost ~]# tar xvf master.tar.gz[root@localhost ~]# cd nginx-1.14.2[root@localhost ~]# ./configure --prefix=/opt/nginx-1.14.2 --user=nginx --group=nginx --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module \--add-module=../nginx-goodies-nginx-sticky-module-ng-08a395c66e42/[root@localhost ~]# make -j $(cat /proc/cpuinfo | grep -c processor) && make install[root@localhost ~]# ln -s /opt/nginx-1.14.2/ /opt/nginx[root@localhost ~]# echo 'PATH=${PATH}:/opt/nginx/sbin/' > /etc/profile.d/nginx.sh[root@localhost ~]# useradd -M -s /sbin/nologin nginx

2. 配置

user  nginx;worker_processes  6;worker_cpu_affinity 000001 000010 000100 001000 010000 100000;pid        logs/nginx.pid;events {    worker_connections  10240;}http {    include       mime.types;    default_type  application/octet-stream;    server_names_hash_bucket_size 512;    server_names_hash_max_size 512 ;    log_format  main  '$http_x_real_ip $remote_addr $http_host - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';    sendfile        on;    keepalive_timeout  120;    client_max_body_size 15m;    proxy_store off;    proxy_redirect off;    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    proxy_set_header X-Real-IP $http_x_real_ip;    proxy_set_header Host $http_host;    proxy_connect_timeout 120;    proxy_read_timeout 120;    proxy_send_timeout 120;    upstream test {        sticky expires=30d name=test1;        server 192.168.1.1:80;        server 192.168.1.2:80;        server 192.168.1.3:80;    }    # 强制 http 跳转到 https    # if ($server_port = 80) {    #     return 301 https://$host$request_uri;    # }    server {        listen       80;        server_name  http.test.com;        access_log  logs/access.log  main;        location / {            proxy_pass    https://test;        }    }    server {        listen       443 ssl;        server_name  https.test.com;        access_log  logs/access.log  main;        ssl_certificate "/PATH/xxxxx.crt";        ssl_certificate_key "/PATH/xxxxx.key";        ssl_session_cache shared:SSL:1m;        ssl_session_timeout  10m;        ssl_ciphers HIGH:!aNULL:!MD5;        ssl_prefer_server_ciphers on;        location / {            proxy_pass    https://test;        }    }}

3. 创建 UnitFile 文件

[root@localhost ~]# cat > /usr/lib/systemd/system/nginx.service << EOF[unit]Description=The NGINX HTTP and reverse proxy serverAfter=syslog.target network.target remote-fs.target nss-lookup.target[Service]Type=forkingExecStart=/opt/nginx/sbin/nginxExecReload=/opt/nginx/sbin/nginx -s reloadExecStop=/bin/kill -s QUIT $MAINPIDPrivateTmp=true[Install]WantedBy=multi-user.targetEOF[root@localhost ~]# systemctl daemon-reload[root@localhost ~]# systemctl start nginx