# 创建虚拟主机配置
# vi /etc/nginx/conf.d/fgedu.conf

server {
listen 80;
server_name www.fgedu.net.cn fgedu.net.cn;
root /data/nginx/html/fgedu;
index index.html index.htm;

access_log /var/log/nginx/fgedu_access.log main;
error_log /var/log/nginx/fgedu_error.log;

location / {
try_files $uri $uri/ =404;
}

location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}

error_page 404 /404.html;
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
}

# 创建网站目录
# mkdir -p /data/nginx/html/fgedu
# echo “Welcome to www.fgedu.net.cn” > /data/nginx/html/fgedu/index.html

# 检查并重载配置
# nginx -t && nginx -s reload

# 创建基于端口的虚拟主机
# vi /etc/nginx/conf.d/port8080.conf

server {
listen 8080;
server_name localhost;
root /data/nginx/html/8080;
index index.html index.htm;

access_log /var/log/nginx/port8080_access.log main;

location / {
try_files $uri $uri/ =404;
}
}

# 创建网站目录
# mkdir -p /data/nginx/html/8080
# echo “Welcome to port 8080” > /data/nginx/html/8080/index.html

# 重载配置
# nginx -s reload

# 测试访问
$ curl http://192.168.1.51:8080
Welcome to port 8080

# 生成SSL证书
# mkdir -p /data/nginx/ssl
# openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout /data/nginx/ssl/fgedu.key \
-out /data/nginx/ssl/fgedu.crt \
-subj “/C=CN/ST=BJ/L=BJ/O=FGedu/OU=IT/CN=www.fgedu.net.cn”

# 输出示例：
Generating a RSA private key
writing new private key to ‘/data/nginx/ssl/fgedu.key’

# 创建HTTPS虚拟主机
# vi /etc/nginx/conf.d/fgedu-ssl.conf

server {
listen 443 ssl http2;
server_name www.fgedu.net.cn fgedu.net.cn;
root /data/nginx/html/fgedu;
index index.html index.htm;

ssl_certificate /data/nginx/ssl/fgedu.crt;
ssl_certificate_key /data/nginx/ssl/fgedu.key;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

access_log /var/log/nginx/fgedu_ssl_access.log main;

location / {
try_files $uri $uri/ =404;
}
}

# HTTP重定向到HTTPS
# vi /etc/nginx/conf.d/fgedu-redirect.conf

server {
listen 80;
server_name www.fgedu.net.cn fgedu.net.cn;
return 301 https://$server_name$request_uri;
}

# 重载配置
# nginx -s reload

# 测试HTTPS
$ curl -k https://www.fgedu.net.cn
Welcome to www.fgedu.net.cn

# 创建反向代理配置
# vi /etc/nginx/conf.d/proxy.conf

upstream backend_servers {
server 192.168.1.51:8080 weight=3;
server 192.168.1.52:8080 weight=2;
server 192.168.1.53:8080 weight=1;
keepalive 32;
}

server {
listen 80;
server_name api.fgedu.net.cn;

access_log /var/log/nginx/proxy_access.log main;

location / {
proxy_pass http://backend_servers;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Connection “”;

proxy_connect_timeout 30s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;

proxy_buffering on;
proxy_buffer_size 4k;
proxy_buffers 8 32k;
proxy_busy_buffers_size 64k;
}
}

# 重载配置
# nginx -s reload

# 负载均衡配置
# vi /etc/nginx/conf.d/lb.conf

upstream fgedu_backend {
# 轮询（默认）
# server 192.168.1.51:8080;
# server 192.168.1.52:8080;
# server 192.168.1.53:8080;

# 加权轮询
server 192.168.1.51:8080 weight=3;
server 192.168.1.52:8080 weight=2;
server 192.168.1.53:8080 weight=1;

# IP哈希
# ip_hash;
# server 192.168.1.51:8080;
# server 192.168.1.52:8080;

# 最少连接
# least_conn;
# server 192.168.1.51:8080;
# server 192.168.1.52:8080;

# 健康检查
server 192.168.1.51:8080 max_fails=3 fail_timeout=30s;
server 192.168.1.52:8080 max_fails=3 fail_timeout=30s;
server 192.168.1.53:8080 max_fails=3 fail_timeout=30s backup;

keepalive 32;
}

server {
listen 80;
server_name lb.fgedu.net.cn;

location / {
proxy_pass http://fgedu_backend;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Connection “”;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
}
}

# 重载配置
# nginx -s reload

# 配置代理缓存
# vi /etc/nginx/nginx.conf

http {
# 缓存配置
proxy_cache_path /data/nginx/cache levels=1:2 keys_zone=proxy_cache:100m
max_size=10g inactive=60m use_temp_path=off;

# 其他配置…
}

# 使用缓存
# vi /etc/nginx/conf.d/cache.conf

server {
listen 80;
server_name cache.fgedu.net.cn;

location / {
proxy_pass http://backend_servers;
proxy_cache proxy_cache;
proxy_cache_valid 200 302 10m;
proxy_cache_valid 404 1m;
proxy_cache_key $host$uri$is_args$args;
proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
add_header X-Cache-Status $upstream_cache_status;
}
}

# 创建缓存目录
# mkdir -p /data/nginx/cache
# chown nginx:nginx /data/nginx/cache

# 重载配置
# nginx -s reload