# 1. 校驗(yàn)網(wǎng)絡(luò)連通性
ping -c 4 www.baidu.com
# 2. 校驗(yàn)YUM可用性
yum clean all && yum makecache
# 3. 關(guān)閉防火墻（臨時(shí)+永久）
systemctl stop firewalld
systemctl disable firewalld
# 4. 關(guān)閉SELinux（臨時(shí)+永久）
setenforce 0
sed -i 's/^SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

# 一鍵安裝所有編譯依賴
yum -y install gcc gcc-c++ make automake pcre pcre-devel zlib zlib-devel openssl openssl-devel

# 1. 創(chuàng)建源碼存放目錄
mkdir -p /opt/apps
cd /opt/apps
# 2. 下載Nginx1.24.0穩(wěn)定版源碼
wget http://nginx.org/download/nginx-1.24.0.tar.gz
# 3. 解壓源碼包
tar -zxvf nginx-1.24.0.tar.gz
cd nginx-1.24.0

# 創(chuàng)建臨時(shí)緩存目錄（必須手動(dòng)創(chuàng)建，否則啟動(dòng)報(bào)錯(cuò)）
mkdir -p /var/temp/nginx/{client,proxy,fastcgi,uwsgi,scgi}
# 完整編譯配置命令
./configure \
--prefix=/usr/local/nginx \
--sbin-path=/usr/local/nginx/sbin/nginx \
--conf-path=/usr/local/nginx/conf/nginx.conf \
--pid-path=/usr/local/nginx/logs/nginx.pid \
--error-log-path=/usr/local/nginx/logs/error.log \
--http-log-path=/usr/local/nginx/logs/access.log \
--lock-path=/usr/local/nginx/logs/nginx.lock \
--http-client-body-temp-path=/var/temp/nginx/client \
--http-proxy-temp-path=/var/temp/nginx/proxy \
--http-fastcgi-temp-path=/var/temp/nginx/fastcgi \
--http-uwsgi-temp-path=/var/temp/nginx/uwsgi \
--http-scgi-temp-path=/var/temp/nginx/scgi \
--user=nginx \
--group=nginx \
--with-http_ssl_module \
--with-http_gzip_module \
--with-http_gzip_static_module \
--with-http_stub_status_module \
--with-http_realip_module

# 編譯+安裝（分步執(zhí)行，便于排查報(bào)錯(cuò)）
make
make install
# 創(chuàng)建Nginx運(yùn)行用戶與用戶組
useradd -s /sbin/nologin nginx

# 拉取官方最新穩(wěn)定鏡像
docker pull nginx:stable
# 啟動(dòng)基礎(chǔ)Nginx容器
docker run -d \
--name nginx-base \
--rm \
-p 8080:80 \
nginx:stable

# 創(chuàng)建本地持久化目錄
mkdir -p /docker/nginx/{conf,html,logs}
# 臨時(shí)啟動(dòng)容器，拷貝默認(rèn)配置文件
docker run -d --name nginx-tmp nginx:stable
docker cp nginx-tmp:/etc/nginx/nginx.conf /docker/nginx/conf/
docker cp nginx-tmp:/etc/nginx/conf.d /docker/nginx/conf/
docker stop nginx-tmp && docker rm nginx-tmp
# 啟動(dòng)持久化Nginx容器
docker run -d \
--name nginx-prod \
-p 80:80 \
-p 443:443 \
-v /docker/nginx/conf/nginx.conf:/etc/nginx/nginx.conf \
-v /docker/nginx/conf/conf.d:/etc/nginx/conf.d \
-v /docker/nginx/html:/usr/share/nginx/html \
-v /docker/nginx/logs:/var/log/nginx \
--restart always \
nginx:stable

# 查看Nginx版本
/usr/local/nginx/sbin/nginx -v
# 查看詳細(xì)版本與編譯參數(shù)
/usr/local/nginx/sbin/nginx -V
# 校驗(yàn)配置文件語(yǔ)法（核心！修改配置后必執(zhí)行）
/usr/local/nginx/sbin/nginx -t
# 靜默校驗(yàn)配置（僅輸出錯(cuò)誤信息）
/usr/local/nginx/sbin/nginx -q

# 啟動(dòng)Nginx
/usr/local/nginx/sbin/nginx
# 快速停止（強(qiáng)制終止所有請(qǐng)求，不推薦生產(chǎn)使用）
/usr/local/nginx/sbin/nginx -s stop
# 平緩?fù)Ｖ梗ㄌ幚硗戤?dāng)前請(qǐng)求后關(guān)閉，生產(chǎn)推薦）
/usr/local/nginx/sbin/nginx -s quit
# 熱重載配置（修改配置后必用，零停機(jī)更新）
/usr/local/nginx/sbin/nginx -s reload
# 重啟日志文件
/usr/local/nginx/sbin/nginx -s reopen

# 定義運(yùn)行Nginx的用戶與組
user nginx nginx;
# 工作進(jìn)程數(shù)，建議與CPU核心數(shù)一致（auto自動(dòng)適配）
worker_processes auto;
# 錯(cuò)誤日志路徑與日志級(jí)別（debug/info/warn/error/crit）
error_log /usr/local/nginx/logs/error.log error;
# 主進(jìn)程PID文件路徑
pid /usr/local/nginx/logs/nginx.pid;
# 最大文件打開數(shù)
worker_rlimit_nofile 65535;

events {
    # 啟用Linux高效epoll事件模型
    use epoll;
    # 單個(gè)工作進(jìn)程最大連接數(shù)
    worker_connections 10240;
    # 開啟多進(jìn)程accept鎖
    accept_mutex on;
    # 批量接收新連接
    multi_accept on;
}

http {
    # 引入資源類型配置
    include mime.types;
    default_type application/octet-stream;
    # 自定義日志格式
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    access_log /usr/local/nginx/logs/access.log main;
    # 開啟零拷貝傳輸
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    # 連接超時(shí)時(shí)間
    keepalive_timeout 120s 100s;
    # 請(qǐng)求緩沖區(qū)配置
    client_header_buffer_size 16k;
    large_client_header_buffers 4 64k;
    # 開啟Gzip全局壓縮
    gzip on;
    gzip_min_length 1k;
    gzip_buffers 4 16k;
    gzip_http_version 1.1;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/js application/json application/javascript;
    gzip_disable "MSIE [1-6]\.";
}

server {
    listen 80;
    server_name www.demo.com demo.com;
    root /usr/local/nginx/html/demo;
    index index.html index.htm index.php;
    access_log /usr/local/nginx/logs/demo-access.log main;
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root html;
    }
}

# 精準(zhǔn)匹配根路徑
location = / {
    index index.html;
}
# 鎖定靜態(tài)資源前綴，停止后續(xù)匹配
location ^~ /static/ {
    root /usr/local/nginx/html;
    expires 30d;
}
# 正則匹配圖片資源（區(qū)分大小寫）
location ~ \.(jpg|png|gif|ico)$ {
    expires 7d;
    add_header Cache-Control "public";
}
# 通用匹配所有請(qǐng)求
location / {
    proxy_pass http://127.0.0.1:8080;
}

# 1. 網(wǎng)卡配置多IP（CentOS7）
vim /etc/sysconfig/network-scripts/ifcfg-ens33
BOOTPROTO="static"
IPADDR=192.168.66.100
IPADDR1=192.168.66.101
NETMASK=255.255.255.0
GATEWAY=192.168.66.2
# 重啟網(wǎng)絡(luò)
systemctl restart network
# 2. Nginx虛擬主機(jī)配置
server {
    listen 80;
    server_name 192.168.66.100;
    root /usr/local/nginx/html/ip100;
    index index.html;
}
server {
    listen 80;
    server_name 192.168.66.101;
    root /usr/local/nginx/html/ip101;
    index index.html;
}

# hosts域名映射（本地測(cè)試）
192.168.66.100 www.frontend.com
192.168.66.100 www.backend.com
# 前端站點(diǎn)配置
server {
    listen 80;
    server_name www.frontend.com;
    root /usr/local/nginx/html/frontend;
    index index.html;
}
# 后端站點(diǎn)配置
server {
    listen 80;
    server_name www.backend.com;
    root /usr/local/nginx/html/backend;
    index index.html;
}

server {
    listen 8088;
    server_name 192.168.66.100;
    root /usr/local/nginx/html/test8088;
    index index.html;
}
server {
    listen 9099;
    server_name 192.168.66.100;
    root /usr/local/nginx/html/test9099;
    index index.html;
}

# 1. 舊域名永久跳轉(zhuǎn)新域名
server {
    listen 80;
    server_name old.com www.old.com;
    rewrite ^/(.*)$ https://www.new.com/$1 permanent;
}
# 2. 偽靜態(tài)配置（動(dòng)態(tài)URL轉(zhuǎn)靜態(tài)URL）
location / {
    rewrite ^/article-(\d+)\.html$ /article.php?id=$1 last;
}
# 3. 目錄跳轉(zhuǎn)
location /admin {
    rewrite ^/admin$ /admin/index.html redirect;
}

# 禁止POST請(qǐng)求訪問靜態(tài)資源
location ~ \.(html|js|css)$ {
    if ($request_method = POST) {
        return 405;
    }
}
# 攔截指定IP訪問
if ($remote_addr = "192.168.66.200") {
    return 403;
}
# 攔截爬蟲訪問
if ($http_user_agent ~* (spider|crawler)) {
    return 403;
}

server {
    listen 80;
    server_name www.demo.com;
    # 圖片、視頻緩存30天
    location ~ \.(jpg|png|gif|mp4|ico)$ {
        expires 30d;
        add_header Cache-Control "max-age=2592000, public";
    }
    # JS、CSS緩存7天
    location ~ \.(js|css)$ {
        expires 7d;
        add_header Cache-Control "max-age=604800, public";
    }
    # HTML禁止緩存，保證實(shí)時(shí)更新
    location ~ \.(html|htm)$ {
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Pragma "no-cache";
        expires -1;
    }
}

location ~ \.(jpg|png|gif|js|css)$ {
    # 允許空Referer、本機(jī)、合法域名訪問
    valid_referers none blocked www.demo.com demo.com 192.168.66.100;
    # 非法請(qǐng)求返回403
    if ($invalid_referer) {
        return 403;
    }
}

location / {
    add_header Access-Control-Allow-Origin *;
    add_header Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS;
    add_header Access-Control-Allow-Headers DNT,X-Requested-With,Content-Type,Authorization;
    # 處理預(yù)檢請(qǐng)求
    if ($request_method = OPTIONS) {
        return 204;
    }
    proxy_pass http://127.0.0.1:8080;
}

upstream tomcat_cluster {
    server 192.168.66.102:8080 weight=5;
    server 192.168.66.103:8080 weight=5;
}
server {
    listen 80;
    server_name www.demo.com;
    # 靜態(tài)資源直接由Nginx處理
    location ~ \.(html|js|css|jpg|png|gif|ico)$ {
        root /usr/local/nginx/static;
        expires 10d;
    }
    # 動(dòng)態(tài)請(qǐng)求轉(zhuǎn)發(fā)至Tomcat集群
    location ~ \.(jsp|do|action)$ {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://tomcat_cluster;
    }
    # 通用接口請(qǐng)求轉(zhuǎn)發(fā)
    location /api/ {
        proxy_pass http://tomcat_cluster;
    }
}

http {
    # 定義后端服務(wù)集群
    upstream backend_cluster {
        # 權(quán)重配置，weight越大分發(fā)請(qǐng)求越多
        server 192.168.66.102:8080 weight=3 max_fails=3 fail_timeout=10s;
        server 192.168.66.103:8080 weight=2 max_fails=3 fail_timeout=10s;
        # 備用節(jié)點(diǎn)，主節(jié)點(diǎn)全部故障時(shí)啟用
        server 192.168.66.104:8080 backup;
    }
    server {
        listen 80;
        server_name www.demo.com;
        location / {
            # 轉(zhuǎn)發(fā)請(qǐng)求至集群
            proxy_pass http://backend_cluster;
            # 保留真實(shí)客戶端信息
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            # 超時(shí)配置
            proxy_connect_timeout 5s;
            proxy_send_timeout 10s;
            proxy_read_timeout 10s;
            # 故障轉(zhuǎn)移
            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
        }
    }
}

http {
    # 速率限流：?jiǎn)蜪P每秒1次請(qǐng)求，緩沖區(qū)5個(gè)
    limit_req_zone $binary_remote_addr zone=req_limit:10m rate=1r/s;
    # 并發(fā)限流：?jiǎn)蜪P最大10個(gè)并發(fā)連接
    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
    server {
        listen 80;
        server_name www.demo.com;
        location / {
            # 啟用速率限流
            limit_req zone=req_limit burst=5 nodelay;
            # 啟用并發(fā)限流
            limit_conn conn_limit 10;
            proxy_pass http://backend_cluster;
        }
    }
}

http {
    # 緩存路徑、層級(jí)、內(nèi)存空間、過期時(shí)間
    proxy_cache_path /var/nginx/cache levels=1:2 keys_zone=api_cache:100m inactive=7d max_size=5G;
    server {
        listen 80;
        server_name www.demo.com;
        location /api/data/ {
            # 啟用緩存
            proxy_cache api_cache;
            # 200/304狀態(tài)碼緩存10分鐘
            proxy_cache_valid 200 304 10m;
            # 自定義緩存key
            proxy_cache_key "$host$request_uri$args";
            # 緩存狀態(tài)響應(yīng)頭
            add_header Nginx-Cache "$upstream_cache_status";
            proxy_pass http://backend_cluster;
        }
        # 手動(dòng)清理緩存接口（僅本機(jī)訪問）
        location /purge/cache {
            allow 127.0.0.1;
            deny all;
            proxy_cache_purge api_cache $host$request_uri$args;
        }
    }
}

! Configuration File for keepalived
global_defs {
    router_id nginx_master
}
# Nginx狀態(tài)檢測(cè)腳本
vrrp_script chk_nginx {
    script "/etc/keepalived/nginx_check.sh"
    interval 2
    weight -20
}
vrrp_instance VI_1 {
    state MASTER
    interface ens33
    virtual_router_id 120
    priority 100
    advert_int 1
    nopreempt
    authentication {
        auth_type PASS
        auth_pass 123456
    }
    track_script {
        chk_nginx
    }
    virtual_ipaddress {
        192.168.66.99/24
    }
}

#!/bin/bash
# 統(tǒng)計(jì)Nginx進(jìn)程數(shù)
NGINX_NUM=$(ps -C nginx --no-header | wc -l)
# 無(wú)進(jìn)程則重啟Nginx
if [ $NGINX_NUM -eq 0 ];then
    /usr/local/nginx/sbin/nginx
    sleep 2
    # 重啟失敗則關(guān)閉keepalived，觸發(fā)VIP漂移
    if [ $(ps -C nginx --no-header | wc -l) -eq 0 ];then
        systemctl stop keepalived
    fi
fi

# 創(chuàng)建證書統(tǒng)一存放目錄
mkdir -p /usr/local/nginx/conf/ssl
# 上傳證書文件（示例：域名demo.com）
# 上傳后目錄包含：demo.com.pem（公鑰）、demo.com.key（私鑰）
# 授權(quán)證書目錄權(quán)限，防止權(quán)限過高報(bào)錯(cuò)
chmod 600 /usr/local/nginx/conf/ssl/*
chown nginx:nginx /usr/local/nginx/conf/ssl/*

# 80端口強(qiáng)制跳轉(zhuǎn)HTTPS
server {
    listen 80;
    server_name www.demo.com demo.com;
    # 301永久重定向，SEO友好
    return 301 https://$host$request_uri;
}
# 443 HTTPS核心配置
server {
    listen 443 ssl;
    server_name www.demo.com demo.com;
    root /usr/local/nginx/html/demo;
    index index.html index.htm;
    # 配置證書公鑰、私鑰路徑
    ssl_certificate /usr/local/nginx/conf/ssl/demo.com.pem;
    ssl_certificate_key /usr/local/nginx/conf/ssl/demo.com.key;
    # SSL性能與安全優(yōu)化參數(shù)（生產(chǎn)必配）
    ssl_protocols TLSv1.2 TLSv1.3; # 禁用老舊不安全協(xié)議
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on; # 優(yōu)先使用服務(wù)器加密套件
    ssl_session_cache shared:SSL:10m; # 開啟SSL會(huì)話緩存
    ssl_session_timeout 10m; # 會(huì)話緩存過期時(shí)間
    ssl_buffer_size 4k; # 優(yōu)化傳輸緩沖區(qū)大小
    # 瀏覽器HTTPS安全強(qiáng)化
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options DENY; # 防止頁(yè)面被嵌套劫持
    add_header X-Content-Type-Options nosniff;
    # 日志配置
    access_log /usr/local/nginx/logs/https-demo-access.log main;
    error_log /usr/local/nginx/logs/https-demo-error.log error;
    # 靜態(tài)資源緩存、反向代理等業(yè)務(wù)配置沿用原有規(guī)則
    location ~ \.(jpg|png|gif|js|css)$ {
        expires 10d;
    }
}

# 站點(diǎn)1：www.frontend.com
server {
    listen 80;
    server_name www.frontend.com;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl;
    server_name www.frontend.com;
    ssl_certificate /usr/local/nginx/conf/ssl/frontend.com.pem;
    ssl_certificate_key /usr/local/nginx/conf/ssl/frontend.com.key;
    # 通用SSL優(yōu)化參數(shù)省略，同上
}
# 站點(diǎn)2：www.backend.com
server {
    listen 80;
    server_name www.backend.com;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl;
    server_name www.backend.com;
    ssl_certificate /usr/local/nginx/conf/ssl/backend.com.pem;
    ssl_certificate_key /usr/local/nginx/conf/ssl/backend.com.key;
    # 通用SSL優(yōu)化參數(shù)省略，同上
}

# 1. 安裝續(xù)期工具
yum install -y certbot
# 2. 手動(dòng)續(xù)期測(cè)試
certbot renew --dry-run
# 3. 配置定時(shí)任務(wù)，每日凌晨2點(diǎn)自動(dòng)檢測(cè)續(xù)期
crontab -e
# 寫入以下內(nèi)容
0 2 * * * /usr/bin/certbot renew && /usr/local/nginx/sbin/nginx -s reload

mkdir -p /var/temp/nginx/{client,proxy,fastcgi,uwsgi,scgi}
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload

# 查看80端口占用進(jìn)程
netstat -tulpn | grep 80
# 強(qiáng)制終止占用進(jìn)程
kill -9 進(jìn)程ID
# 關(guān)閉沖突服務(wù)
systemctl stop httpd && systemctl disable httpd
# 重啟Nginx
/usr/local/nginx/sbin/nginx

useradd -s /sbin/nologin nginx
/usr/local/nginx/sbin/nginx -s reload

# 核對(duì)證書文件是否存在
ls /usr/local/nginx/conf/ssl/
# 修正目錄與文件權(quán)限
chmod 600 /usr/local/nginx/conf/ssl/*
chown nginx:nginx /usr/local/nginx/conf/ssl/*
# 重載配置
nginx -s reload

# 同步系統(tǒng)時(shí)間
ntpdate time.aliyun.com

# 1. 關(guān)閉SELinux（永久生效）
sed -i 's/^SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config && setenforce 0
# 2. 修正站點(diǎn)目錄權(quán)限
chmod -R 755 /usr/local/nginx/html
chown -R nginx:nginx /usr/local/nginx/html
# 3. 檢查是否存在index.html默認(rèn)文件
#