NGINX 备忘清单

# Upstreams
upstream backend {
    server 127.0.0.1:3000;
    keepalive 5;
}
# HTTP Server
server {
  server_name your_hostname.com;
  error_log /var/log/nginx/rocketchat.access.log;
  location / {
      proxy_pass http://backend;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forward-Proto http;
      proxy_set_header X-Nginx-Proxy true;
      proxy_redirect off;
  }
}

server {
  server_name domain.tld;

  access_log /log/domain.tld.access.log;
  error_log /log/domain.tld.error.log;
  root /var/www/domain.tld/htdocs;

  # 将请求传递给 Apache 后端
  location / {
      proxy_pass http://backend;
  }
  # 使用后备处理静态文件
  location ~* \.(ogg|ogv|svg|svgz|eot|otf|woff|woff2|ttf|m4a|mp4|ttf|rss|atom|jpe?g|gif|cur|heic|png|tiff|ico|zip|webm|mp3|aac|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf|swf|webp)$ {
      add_header "Access-Control-Allow-Origin" "*";
      access_log off;
      log_not_found off;
      expires max;
      try_files $uri @fallback;
  }
  # 如果找不到文件，则回退以将请求传递给 Apache
  location @fallback {
      proxy_pass http://backend;
  }
}

server {
  server_name old-site.com;
  return 301 $scheme://new-site.com$request_uri;
}

server {
  location = /oldpage.html {
    return 301 http://example.org/newpage.html;
  }
}

location /old-site {
  rewrite ^/old-site/(.*) http://example.org/new-site/$1 permanent;
}

upstream example {
  ip_hash;
  # upstream的负载均衡，weight是权重，可以根据机器配置定义权重。
  # weigth参数表示权值，权值越高被分配到的几率越大。
  server 192.168.122.11:8081 ;
  server 127.0.0.1:82 weight=3;
  server 127.0.0.1:83 weight=3 down;
  server 127.0.0.1:84 weight=3; max_fails=3  fail_timeout=20s;
  server 127.0.0.1:85 weight=4;
  keepalive 32;
}
server {
  #侦听的80端口
  listen       80;
  server_name  git.example.cn;
  location / {
    # 在这里设置一个代理，和 upstream 的名字一样
    proxy_pass   http://example;
  }
}

允许浏览器基本上永久地缓存静态内容。 Nginx 将为您设置 Expires 和 Cache-Control 头信息

location /static {
    root /data;
    expires max;
}

如果要求浏览器永远不会缓存响应（例如用于跟踪请求），请使用 -1

location = /empty.gif {
    empty_gif;
    expires -1;
}

server {
  listen 80;
  server_name api.xxx.com;
    
  add_header 'Access-Control-Allow-Origin' '*';
  add_header 'Access-Control-Allow-Credentials' 'true';
  add_header 'Access-Control-Allow-Methods' 'GET,POST,HEAD';

  location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host  $http_host;    
  } 
}

server {
  listen 80;
  # 配置正常的带www的域名
  server_name www.wangchujiang.com;
  root /home/www/wabg/download;
  location / {
      try_files $uri $uri/ /index.html =404;
  }
}

server {
  # 将不带 www 的 wangchujiang.com 
  # 永久性重定向到 https://www.wangchujiang.com
  server_name wangchujiang.com;
  rewrite ^(.*) https://www.wangchujiang.com$1 permanent;
}

可以放到 http, server, location, limit_except 语句块

include blockip.conf;

在 blockip.conf 里面输入内容，如：

deny 165.91.122.67;

deny IP;            # 屏蔽单个 ip 访问
allow IP;           # 允许单个 ip 访问
deny all;           # 屏蔽所有 ip 访问
allow all;          # 允许所有 ip 访问
deny 123.0.0.0/8;   # 屏蔽整个段即从 123.0.0.1 到 123.255.255.254 访问的命令
deny 124.45.0.0/16; # 屏蔽IP段即从 123.45.0.1 到 123.45.255.254 访问的命令
deny 123.45.6.0/24; # 屏蔽IP段即从 123.45.6.1 到 123.45.6.254 访问的命令

# 如果你想实现这样的应用，除了几个IP外，其他全部拒绝
allow 1.1.1.1; 
allow 1.1.1.2;
deny all; 

server {
  listen       80;
  server_name  example.com;
  rewrite ^ https://$http_host$request_uri? permanent; # 强制将 http 重定向到 https
  # 在错误页面和“服务器”响应头字段中启用或禁用发射nginx版本。 防止黑客利用版本漏洞攻击
  server_tokens off;
}

location ^~/api/upload {
  rewrite ^/(.*)$ /wfs/v1/upload break;
  proxy_pass http://wfs-api;
}

将地址 /api/upload 替换为 /wfs/v1/upload

location / {
  if ($http_user_agent ~* "python|curl|java|wget|httpclient|okhttp") {
      return 503;
  }
  # 正常处理
  # ...
}

location ~* \.(gif|jpg|png|swf|flv)$ {
  root html;

  valid_referers none blocked *.nginx.com;

  if ($invalid_referer) {
    rewrite ^/ www.nginx.cn;
    # return 404;
  }
}

location /img/ {
  alias /var/www/image/;
}
# 访问 /img/ 目录里面的文件时，
# 会自动去 /var/www/image/ 目录找文件
location /img/ {
  root /var/www/image;
}
# 访问 /img/ 目录下的文件时，
# 会去 /var/www/image/img/ 目录下找文件

location ~ \/public\/(css|js|img)\/.*\.(js|css|gif|jpg|jpeg|png|bmp|swf) {
  valid_referers none blocked *.jslite.io;
  if ($invalid_referer) {
      rewrite ^/%20%20http_/wangchujiang_com/piratesp.png;
  }
}

• 执行 status 命令

  sudo service nginx status
  

  执行 status 命令，看到 Loaded: loaded (/lib/systemd/system/nginx.service;...) 这一行的nginx.service 文件位置

• 打开 service 文件

  sudo vim /lib/systemd/system/nginx.service
  

• 修改 service 中的配置 找到 [Service] 部分，将 LimitNOFILE=65535 添加到该部分

  [Service]
  ...
  LimitNOFILE=65535
  ...
  

解决 systemctl 管理的 ulimit 不继承系统设置的问题

gzip  on;
gzip_buffers 16 8k;
gzip_comp_level 6;
gzip_http_version 1.1;
gzip_min_length 256;
gzip_proxied any;
gzip_vary on;
gzip_types
    text/xml application/xml application/atom+xml application/rss+xml application/xhtml+xml image/svg+xml
    text/javascript application/javascript application/x-javascript
    text/x-json application/json application/x-web-app-manifest+json
    text/css text/plain text/x-component
    font/opentype application/x-font-ttf application/vnd.ms-fontobject
    image/x-icon;
gzip_disable  "msie6";

add_header X-Robots-Tag "noindex";

location = /robots.txt {
  return 200 "User-agent: *\nDisallow: /\n";
}