nginx相关

部署

准备

需要先提前安装docker和docker compose

参考：Docker相关

安装

选择任意目录下创建文件夹nginx

在nginx文件夹下创建conf、log、html、certificate目录

在conf文件夹下创建conf.d文件夹和nginx.conf文件

在conf.d文件夹下创建default.conf文件

nginx.conf 和 default.conf （nginx.config为自己定义的配置文件，按需修改）

# 这是nginx默认的配置文件，按需修改
server {
    listen       80;
    listen  [::]:80;
    server_name  localhost;

    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #    root           html;
    #    fastcgi_pass   127.0.0.1:9000;
    #    fastcgi_index  index.php;
    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
    #    include        fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny  all;
    #}
}

在nginx文件夹下创建docker-compose.yaml文件

docker-compose.yaml

services:
  nginx:
    image: nginx:1.25.4
    restart: unless-stopped
    container_name: nginx
    network_mode: "host"
    volumes:
	  # 配置目录映射
      - ./conf/nginx.conf:/etc/nginx/nginx.conf 
      - ./conf/conf.d:/etc/nginx/conf.d 
      # 日志目录映射
      - ./log:/var/log/nginx 
      # 静态页面目录映射
      - ./html:/usr/share/nginx/html
      # 证书目录映射
      - ./certificate:/certificate 

启动

docker-compose.yaml文件配置好后启动容器

# 启动容器
docker compose up -d

其他

常用配置示例

# 默认为 1，表示开启一个业务进程
worker_processes 1;

events {
    # 单个业务进程可接受连接数
    worker_connections 1024;
}

http {
    # 引入 http mime 类型
    include mime.types;
    # 如果 mime 类型没匹配上，默认使用二进制流的方式传输。
    default_type application/octet-stream;

	# 客户端请求服务器最大允许大小-0为不限
    client_max_body_size 64m;

    # sendfile() 高效网络传输，也就是数据 0 拷贝。
    sendfile on;

    keepalive_timeout 65;
     
    # 域名：xxx.com
    server {
        listen 80;
        listen [::]:80;
        server_name xxx.com;

		# 将http请求转为https
        location = / {
            rewrite ^/(.*) https://xxx.com/$1 permanent;
        }
        location / {
            rewrite ^/(.*) https://xxx.com/ permanent;
        }
    }
    server {
        # ssl参数
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name xxx.com;
        ssl_session_timeout 5m;
        # 证书和私钥文件路径
        ssl_certificate /certificate/xxx.com.pem;
        ssl_certificate_key /certificate/xxx.com.key;

        #协议配置
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        #加密套件
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;

        location /redirectUrl {
	        # 禁用了nginx对后端服务器返回的HTTP响应中的重定向URL进行自动修改
            proxy_redirect off;
            # 转发请求的目标地址
            proxy_pass http://ip:port;
            # 设置http协议版本
            proxy_http_version 1.1;
            # 标识出客户端连接使用的协议类型是http还是https
			proxy_set_header X-Forwarded-Proto $scheme;
			# 请求头添加客户端host主机名
            proxy_set_header Host $host;
            # 请求头添加客户端真实ip
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    }
}

代理websocket的设置

以minio-console为例

server {
    listen 80;
    listen [::]:80;
    # 域名
    server_name minio.xxx.com;
    location / {
        proxy_pass http://ip:port;
        proxy_set_header HOST $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
    location /ws/ {
        proxy_pass http://ip:port;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        # 支持websocket
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}