# 添加Nginx官方仓库
# cat > /etc/yum.repos.d/nginx.repo << EOF [nginx-stable] name=nginx stable repo baseurl=http://nginx.org/packages/centos/\$releasever/\$basearch/ gpgcheck=1 enabled=1 gpgkey=https://nginx.org/keys/nginx_signing.key module_hotfixes=true [nginx-mainline] name=nginx mainline repo baseurl=http://nginx.org/packages/mainline/centos/\$releasever/\$basearch/ gpgcheck=1 enabled=0 gpgkey=https://nginx.org/keys/nginx_signing.key module_hotfixes=true EOF # 安装Nginx # yum install -y nginx # 输出示例如下： nginx-stable | 2.9 kB 00:00:00 nginx-stable/7/x86_64/primary_db | 87 kB 00:00:01 Resolving Dependencies --> Running transaction check
—> Package nginx.x86_64 1:1.28.1-1.el7.ngx will be installed
–> Finished Dependency Resolution

Dependencies Resolved
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
nginx x86_64 1:1.28.1-1.el7.ngx nginx-stable 818 k

Transaction Summary
================================================================================
Install 1 Package

Total download size: 818 k
Installed size: 2.8 M
Downloading packages:
nginx-1.28.1-1.el7.ngx.x86_64.rpm | 818 kB 00:00:02
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : 1:nginx-1.28.1-1.el7.ngx.x86_64 1/1
———————————————————————-

Thanks for using nginx!

Please find the official documentation for nginx here:
* https://nginx.org/en/docs/

Commercial subscriptions for nginx are available on:
* https://nginx.com/products/

———————————————————————-
Verifying : 1:nginx-1.28.1-1.el7.ngx.x86_64 1/1

Installed:
nginx.x86_64 1:1.28.1-1.el7.ngx

Complete!

# 启动Nginx服务
# systemctl start nginx
# systemctl enable nginx

# 输出示例如下：
Created symlink from /etc/systemd/system/multi-user.target.wants/nginx.service to /usr/lib/systemd/system/nginx.service.

# 查看版本
# nginx -v

# 输出示例如下：
nginx version: nginx/1.28.1

源码编译安装

# 安装编译依赖
# yum install -y gcc pcre-devel zlib-devel openssl-devel

# 输出示例如下：
Package gcc-4.8.5-44.el7.x86_64 already installed and latest version
Package pcre-devel-8.32-17.el7.x86_64 already installed and latest version
Package zlib-devel-1.2.7-20.el7_9.x86_64 already installed and latest version
Package openssl-devel-1.0.2k-26.el7_9.x86_64 already installed and latest version
Nothing to do

# 解压并进入目录
$ tar -xzf nginx-1.28.1.tar.gz
$ cd nginx-1.28.1

# 配置编译选项
$ ./configure \
–prefix=/fgeudb/nginx \
–user=nginx \
–group=nginx \
–with-http_ssl_module \
–with-http_v2_module \
–with-http_realip_module \
–with-http_gzip_static_module \
–with-http_stub_status_module \
–with-stream \
–with-stream_ssl_module

# 输出示例如下：
checking for OS
+ Linux 3.10.0-1160.el7.x86_64 x86_64
checking for C compiler … found
+ using GNU C compiler
+ gcc version: 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC)
checking for gcc -pipe switch … found
checking for -Wl,-E switch … found
checking for gcc builtin atomic operations … found
checking for C99 variadic macros … found
checking for gcc variadic macros … found
checking for unistd.h … found
checking for inttypes.h … found
checking for limits.h … found
checking for sys/filio.h … not found
checking for sys/param.h … found
checking for sys/mount.h … found
checking for sys/statvfs.h … found
checking for crypt.h … found
checking for Linux specific features
checking for epoll … found
checking for EPOLLRDHUP … found
checking for EPOLLEXCLUSIVE … found
checking for O_PATH … found
checking for sendfile() … found
checking for sendfile64() … found
checking for sys/prctl.h … found
…
creating objs/Makefile

Configuration summary
+ using system PCRE library
+ using system OpenSSL library
+ using system zlib library

nginx path prefix: “/fgeudb/nginx”
nginx binary file: “/fgeudb/nginx/sbin/nginx”
nginx modules path: “/fgeudb/nginx/modules”
nginx configuration prefix: “/fgeudb/nginx/conf”
nginx configuration file: “/fgeudb/nginx/conf/nginx.conf”
nginx pid file: “/fgeudb/nginx/logs/nginx.pid”
nginx error log file: “/fgeudb/nginx/logs/error.log”
nginx http access log file: “/fgeudb/nginx/logs/access.log”
nginx http client request body temporary files: “client_body_temp”
nginx http proxy temporary files: “proxy_temp”
nginx http fastcgi temporary files: “fastcgi_temp”
nginx http uwsgi temporary files: “uwsgi_temp”
nginx http scgi temporary files: “scgi_temp”

# 编译安装
$ make
# make install

# 输出示例如下：
make -f objs/Makefile
make[1]: Entering directory `/root/nginx-1.28.1′
cc -c -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules -I src/stream \
-o objs/src/core/nginx.o \
src/core/nginx.c
…
test -d ‘/fgeudb/nginx/logs’ || mkdir -p ‘/fgeudb/nginx/logs’
test -d ‘/fgeudb/nginx/html’ || cp -R html ‘/fgeudb/nginx’
test -d ‘/fgeudb/nginx/logs’ || mkdir -p ‘/fgeudb/nginx/logs’

# 编辑配置文件
# vi /etc/nginx/nginx.conf

# 基本配置示例
user nginx;
worker_processes auto;
worker_rlimit_nofile 65535;

error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;

events {
worker_connections 10240;
use epoll;
multi_accept on;
}

http {
include /etc/nginx/mime.types;
default_type application/octet-stream;

log_format main ‘$remote_addr – $remote_user [$time_local] “$request” ‘
‘$status $body_bytes_sent “$http_referer” ‘
‘”$http_user_agent” “$http_x_forwarded_for”‘;

access_log /var/log/nginx/access.log main;

sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;

gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

include /etc/nginx/conf.d/*.conf;
}

# 测试配置
# nginx -t

# 输出示例如下：
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

# 重载配置
# nginx -s reload

# 输出示例如下：
# 查看进程
# ps aux | grep nginx

# 输出示例如下：
root 12345 0.0 0.1 123456 5678 ? Ss 10:30 0:00 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
nginx 12346 0.0 0.2 123456 8901 ? S 10:30 0:00 nginx: worker process
nginx 12347 0.0 0.2 123456 8901 ? S 10:30 0:00 nginx: worker process

虚拟主机配置

# 创建虚拟主机配置
# vi /etc/nginx/conf.d/fgedu.conf

server {
listen 80;
server_name fgedu.net.cn www.fgedu.net.cn;
root /fgeudb/www/fgedu;
index index.html index.htm;

access_log /var/log/nginx/fgedu.access.log main;
error_log /var/log/nginx/fgedu.error.log;

location / {
try_files $uri $uri/ =404;
}

location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}

location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
expires 30d;
add_header Cache-Control “public, immutable”;
}

error_page 404 /404.html;
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
}

# 测试并重载配置
# nginx -t && nginx -s reload

# 输出示例如下：
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

# 内核参数优化
# vi /etc/sysctl.conf

net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_max_syn_backlog = 8192
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 32768
net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 2

# 使配置生效
# sysctl -p

# 输出示例如下：
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
…

# 文件描述符限制
# vi /etc/security/limits.conf

nginx soft nofile 65535
nginx hard nofile 65535

SSL/TLS配置

# HTTPS配置
server {
listen 443 ssl http2;
server_name fgedu.net.cn;

ssl_certificate /etc/nginx/ssl/fgedu.net.cn.crt;
ssl_certificate_key /etc/nginx/ssl/fgedu.net.cn.key;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security “max-age=31536000; includeSubdomains” always;

location / {
proxy_pass http://192.168.1.51:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}

# HTTP重定向到HTTPS
server {
listen 80;
server_name fgedu.net.cn;
return 301 https://$server_name$request_uri;
}