第 209 章:Nginx 入门与反向代理

学习目标

• 理解 Nginx 核心概念
• 掌握反向代理与负载均衡
• 学会静态资源服务
• 配置 HTTPS 与性能调优

一、Nginx 简介

Nginx 是高性能的 HTTP / 反向代理服务器,以高并发、低内存著称。

特点:

• 异步非阻塞
• 单机 5w+ 并发
• 配置简单
• 模块化

二、安装

# Ubuntu
sudo apt install nginx

# CentOS
sudo yum install nginx

# Docker
docker run -d -p 80:80 -v /myconf:/etc/nginx/conf.d nginx:alpine

# 服务管理
sudo systemctl start nginx
sudo systemctl enable nginx

三、配置文件结构

# /etc/nginx/nginx.conf

# 全局块
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# events 块
events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

# http 块(全局)
http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    sendfile on;
    keepalive_timeout 65;

    # 引入子配置
    include /etc/nginx/conf.d/*.conf;
}

# server 块(虚拟主机)
server {
    listen 80;
    server_name example.com;

    # location 块(URL 匹配)
    location / {
        root /var/www/html;
        index index.html;
    }
}

四、常用命令

nginx                  # 启动
nginx -t               # 测试配置
nginx -s reload        # 重载配置(热更新)
nginx -s stop          # 停止
nginx -s quit          # 优雅停止

五、静态资源服务

server {
    listen 80;
    server_name static.example.com;

    # 静态文件
    location / {
        root /data/static;
        index index.html;
        autoindex on;             # 列出文件
        autoindex_exact_size off; # 友好大小
    }

    # 缓存
    location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
        root /data/static;
        expires 7d;
        add_header Cache-Control "public";
    }

    # gzip 压缩
    gzip on;
    gzip_types text/plain application/javascript text/css application/json;
    gzip_min_length 1k;
}

六、反向代理

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;

        # 传 header
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 超时
        proxy_connect_timeout 5s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;

        # 缓冲
        proxy_buffering on;
        proxy_buffer_size 8k;
        proxy_buffers 8 8k;
    }
}

七、负载均衡

upstream backend {
    # 负载均衡策略
    least_conn;                  # 最少连接
    # ip_hash;                  # 同一 IP 到同一后端
    # random;                   # 随机
    # weight 权重

    server 192.168.1.1:3000 weight=3;
    server 192.168.1.2:3000 weight=2;
    server 192.168.1.3:3000 weight=1;

    # 健康检查(被动)
    keepalive 32;                 # 长连接池
    keepalive_timeout 60s;
}

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

7.1 负载均衡算法

算法	说明	场景
round-robin (默认)	轮询	服务器性能一致
weight	加权轮询	性能不同
least_conn	最少连接	长连接
ip_hash	按 IP hash	Session 保持
least_time	响应最快	性能差异大
random	随机	大规模

7.2 健康检查(主动)

需要 nginx-plus 或第三方模块如 nginx_upstream_check_module。

upstream backend {
    server 192.168.1.1:3000;
    server 192.168.1.2:3000;

    check interval=3000 rise=2 fall=5 timeout=1000 type=http;
    check_http_send "GET /health HTTP/1.0\r\n\r\n";
    check_http_expect_alive http_2xx http_3xx;
}

八、HTTPS

8.1 自签证书(测试)

mkdir ~/certs && cd ~/certs
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout privkey.pem -out fullchain.pem \
  -subj "/CN=example.com"

8.2 配置 HTTPS

server {
    listen 443 ssl http2;
    server_name api.example.com;

    ssl_certificate /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://backend;
    }
}

# HTTP 跳转 HTTPS
server {
    listen 80;
    server_name api.example.com;
    return 301 https://$host$request_uri;
}

8.3 Let's Encrypt 免费证书

# 安装 certbot
sudo apt install certbot python3-certbot-nginx

# 自动配置
sudo certbot --nginx -d example.com -d www.example.com

# 自动续期
sudo certbot renew --dry-run

九、限流

http {
    # 定义 zone
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

    server {
        listen 80;
        server_name api.example.com;

        location /api/ {
            limit_req zone=api_limit burst=20 nodelay;
            proxy_pass http://backend;
        }
    }
}

参数:

• rate=10r/s:每秒 10 个请求
• burst=20:允许突发 20 个
• nodelay:超出立即拒绝(默认排队延迟)

十、WebSocket 代理

location /ws/ {
    proxy_pass http://backend;
    proxy_http_version 1.1;

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    proxy_read_timeout 600s;   # 长连接
}

十一、缓存配置

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=10g inactive=60m;

server {
    location / {
        proxy_pass http://backend;
        proxy_cache my_cache;
        proxy_cache_key "$scheme$request_method$host$request_uri";
        proxy_cache_valid 200 5m;
        proxy_cache_valid 404 1m;

        add_header X-Cache-Status $upstream_cache_status;
    }
}

$upstream_cache_status:HIT / MISS / EXPIRED / BYPASS

十二、日志

log_format main '$remote_addr - $remote_user [$time_local] '
                '"$request" $status $body_bytes_sent '
                '"$http_referer" "$http_user_agent" '
                'rt=$request_time uct=$upstream_connect_time '
                'urt=$upstream_response_time';

access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log warn;

十三、性能调优

# worker 数量(一般 = CPU 核心数)
worker_processes auto;

# 每个 worker 最大连接
events {
    worker_connections 4096;
    multi_accept on;
    use epoll;
}

http {
    # 文件传输
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;

    # 长连接
    keepalive_timeout 30;
    keepalive_requests 100;

    # 压缩
    gzip on;
    gzip_min_length 1k;
    gzip_comp_level 6;
    gzip_types text/plain application/javascript application/json text/css;

    # 客户端 body 上限
    client_max_body_size 50M;

    # 缓冲区
    proxy_buffer_size 16k;
    proxy_buffers 4 32k;
}

十四、本章小结

模块	用途
http	全局配置
server	虚拟主机
location	URL 匹配
upstream	负载均衡
proxy_pass	反向代理

动手练习

1. 配置 Nginx 反向代理 Node 应用
2. 实现 3 节点负载均衡
3. 配置 HTTPS(自签证书)
4. 启用 gzip + 限流

推荐阅读

• 📖 Nginx 官方文档
• 📖 Nginx 配置详解

---

下一章:第 210 章:Nginx 进阶配置 →