【Nginx】底层架构、核心配置与高并发生产实战全解

# 1. 下载源码并解压
wget https://nginx.org/download/nginx-1.24.0.tar.gz
tar -zxvf nginx-1.24.0.tar.gz
cd nginx-1.24.0

# 2. 预编译检查与模块装配
./configure \
  --prefix=/usr/local/nginx \
  --user=nginx \
  --group=nginx \
  --with-http_ssl_module \
  --with-http_v2_module \
  --with-http_realip_module \
  --with-http_stub_status_module \
  --with-http_gzip_static_module \
  --with-pcre \
  --with-stream \
  --with-stream_ssl_module

# 3. 编译并安装
make -j $(nproc) && sudo make install

main (全局配置：进程数、用户、错误日志、全局 PID)
├── events (事件模型与最大并发连接)
└── http (HTTP 服务器核心)
    ├── upstream (负载均衡后端节点池)
    └── server (虚拟主机配置)
        └── location (URL 路由匹配与反向代理)

# ==================== 1. 全局配置 (Main Context) ====================
user nginx nginx;
worker_processes auto;                 # 自动适配宿主机 CPU 核心数
worker_cpu_affinity auto;              # 自动进行 CPU 绑核，减少缓存失效
worker_rlimit_nofile 65535;            # 单个进程能够打开的最大文件描述符数
pid /var/run/nginx.pid;
error_log /var/log/nginx/error.log warn;

# ==================== 2. 事件模型 (Events Context) ====================
events {
    use epoll;                         # Linux 高性能多路复用 I/O 模型
    worker_connections 65535;          # 单个 Worker 进程的最大并发连接数
    multi_accept on;                   # 允许一个 Worker 进程同时接收多个新连接
}

# ==================== 3. HTTP 服务器核心 (HTTP Context) ====================
http {
    include       mime.types;
    default_type  application/octet-stream;

    # 日志格式定义 (接入真实客户端 IP 与追踪耗时)
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for" '
                    'rt=$request_time uct="$upstream_connect_time" uht="$upstream_header_time" urt="$upstream_response_time"';

    access_log /var/log/nginx/access.log main;

    # 高效传输与文件 I/O
    sendfile        on;                # 开启操作系统内核级零拷贝 (Zero-Copy)
    tcp_nopush      on;                # 累积数据包后一次性发送，降低网络拥塞
    tcp_nodelay     on;                # 禁用 Nagle 算法，小数据包低延迟即时发出

    # 超时时间控制
    keepalive_timeout  65;             # HTTP 长连接超时保活时间 (秒)
    client_header_timeout 15;          # 读取客户端请求头的超时上限
    client_body_timeout 15;            # 读取客户端请求体的超时上限
    send_timeout 15;                   # 向客户端发送响应报文的超时上限

    # 客户端请求体缓冲限制
    client_max_body_size 20m;          # 允许客户端上传的最大文件容量
    client_body_buffer_size 128k;

    # Gzip 传输压缩
    gzip on;
    gzip_min_length 1k;                # 小于 1KB 的文件不压缩
    gzip_buffers 4 16k;
    gzip_comp_level 4;                 # 权衡 CPU 开销与压缩率的黄金档位
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
    gzip_vary on;

    # 上游后端服务器集群
    upstream backend_cluster {
        least_conn;                    # 采用最小连接数负载均衡算法
        server 192.168.10.11:8080 weight=3 max_fails=3 fail_timeout=30s;
        server 192.168.10.12:8080 weight=2 max_fails=3 fail_timeout=30s;
        keepalive 32;                  # 与后端保持的长连接池容量
    }

    # ==================== 4. 虚拟主机 (Server Context) ====================
    server {
        listen 80;
        server_name example.com www.example.com;

        # 80 端口一律优雅 301 永久重定向至 HTTPS
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl http2;
        server_name example.com www.example.com;

        # SSL 证书与安全套件
        ssl_certificate /etc/nginx/ssl/example.com.crt;
        ssl_certificate_key /etc/nginx/ssl/example.com.key;
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:10m;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        # 根路径反向代理
        location / {
            proxy_pass http://backend_cluster;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # 代理超时与缓冲控制
            proxy_connect_timeout 60s;
            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
        }

        # 静态资源由 Nginx 直接响应并开启浏览器长缓存
        location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2)$ {
            root /var/www/html;
            expires 30d;
            add_header Cache-Control "public, no-transform";
            access_log off;
        }

        # 监控端点配置 (仅允许运维内网访问)
        location /nginx_status {
            stub_status on;
            access_log off;
            allow 192.168.0.0/16;
            deny all;
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /usr/share/nginx/html;
        }
    }
}

worker_rlimit_nofile 65535;

# 1. 生成 2048 位 RSA 专用私钥
openssl genrsa -out server.key 2048

# 2. 生成证书签名请求文件 (CSR)
openssl req -new -key server.key -out server.csr -subj "/C=CN/ST=Beijing/L=Beijing/O=DevOps/CN=example.com"

# 3. 自签署生成 X.509 数字证书 (有效周期 365 天)
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

# 推荐的标准写法：轻量、高效、零隐患
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;