【Nginx】配置参数和使用案例

【Nginx】配置参数和使用案例【一】反向代理和负载均衡参数【1】重点参数介绍【2】完整模板案例【3】upstream 负载均衡模块参数1核心参数2四种负载均衡调度算法【4】proxy 反向代理核心参数解析1listen 指令监听端口 / 地址 / 附加参数2server_name 指令虚拟主机域名匹配3透传客户端真实信息4超时时间防止卡死5缓冲区优化高并发必配6长连接优化配合 upstream keepalive7proxy_pass 转发地址规则8故障自动重试 proxy_next_upstream【5】模板案例【二】反向代理和负载均衡案例【1】反向代理转发请求到gateway案例【2】负载均衡datax集群案例【一】反向代理和负载均衡参数【1】重点参数介绍分为两大部分1http 块负载均衡上游服务器池 upstream2server 块反向代理、转发规则、健康检查、超时、缓存、重试控制listen监听的端口server_name监听的服务iplocation /indapi/过滤/indapi/的请求路径proxy_pass代理转发的服务池或者具体的ip端口路径【2】完整模板案例# nginx.conf 主配置文件worker_processes auto;worker_rlimit_nofile65535;events{worker_connections10240;use epoll;multi_accept on;}http{include mime.types;default_type application/octet-stream;# 日志格式log_format main$remote_addr - $remote_user [$time_local] $request $status $body_bytes_sent $http_referer $http_user_agent $http_x_forwarded_for;access_log logs/access.log main;sendfile on;tcp_nopush on;tcp_nodelay on;keepalive_timeout65;keepalive_requests1000;gzipon;gzip_min_length 1k;gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xmlrss text/javascript;# 负载均衡上游服务池 upstream backend_server{# 后端服务节点server127.0.0.1:8080weight1max_fails3fail_timeout30s;server127.0.0.1:8081weight1max_fails3fail_timeout30s;server192.168.1.100:8082 backup;server192.168.1.101:8083 down;# 负载均衡算法默认轮询# ip_hash; # 固定IP分发会话保持# least_conn; # 最少连接优先# hash $request_uri consistent; # url一致性哈希# 后端长连接复用提升性能keepalive64;}# 服务池名称damp.gateway代理转发到gateway服务upstream damp.gateway{server172.17.0.79:20110;}# 反向代理服务 server{listen80;server_name api.example.com;# 错误页面error_page500502503504/50x.html;location/50x.html{root html;}# 全局反向代理公共参数proxy_set_header Host$host;proxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Proto$scheme;# 转发超时控制proxy_connect_timeout 60s;proxy_read_timeout 120s;proxy_send_timeout 60s;# 缓冲区避免后端小包频繁写响应proxy_buffer_size 64k;proxy_buffers4128k;proxy_busy_buffers_size 256k;# 开启后端长连接配合 upstream keepaliveproxy_http_version1.1;proxy_set_header Connection;# 核心业务转发规则location /{proxy_pass http://backend_server;# 指向上面的负载均衡池proxy_next_upstream errortimeoutinvalid_header http_500 http_502 http_503 http_504;proxy_next_upstream_tries3;# 最多重试3台节点proxy_next_upstream_timeout 10s;# 重试总超时}# 静态资源单独缓存不走后端可选location ~*\.(jpg|png|css|js|ico)${proxy_pass http://backend_server;expires 1d;add_header Cache-Controlpublic;}}}【3】upstream 负载均衡模块参数upstream backend_server{server127.0.0.1:8080weight1max_fails3fail_timeout30s;server127.0.0.1:8081weight1max_fails3fail_timeout30s;server192.168.1.100:8082 backup;server192.168.1.101:8083 down;keepalive64;}1核心参数1server ip:port后端应用服务地址SpringBoot 服务地址。2weight 数字权重默认 1数值越大分配请求越多权重轮询算法。例weight2 接收两倍流量。3max_fails3最大失败次数3 次访问失败后标记节点故障。4fail_timeout30s节点故障后30 秒内不再转发流量到该节点30 秒后重试探测。5backup备用节点所有正常节点挂了才启用。6down永久下线节点流量不分配用于维护停机。7keepalive 64Nginx 与后端服务保持 64 个长连接减少 TCP 握手开销高并发优化。2四种负载均衡调度算法1默认轮询不配置任何算法请求依次分配给每台后端均匀分发。2ip_hash;根据客户端 IP 哈希固定分配同一台后端实现会话保持。缺点IP 分布不均时流量倾斜节点增减会哈希重分布。3least_conn;优先转发给当前活跃连接最少的后端适合后端处理耗时不一致场景。4hash 变量 consistent;一致性哈希常用 hash $request_uri consistent;按 URL 哈希相同接口固定打同一台服务节点扩容影响小适合缓存服务。【4】proxy 反向代理核心参数解析1listen 指令监听端口 / 地址 / 附加参数1基础语法listen address[:port][参数1][参数2]...;# 最简写法listen80;listen443ssl;listen127.0.0.1:8080;listen[::]:80;# 监听所有IPv6地址80端口2基础监听配置说明1-listen 80;监听本机所有网卡的 80 端口0.0.0.0:80外网、内网、本地均可访问。2-listen 192.168.1.10:80;只监听本机指定内网 IP 的 80 端口其他网卡 IP 无法访问该 server 块。3-listen [::]:443;兼容 IPv6同时监听所有 IPv6 地址 443 端口。4-listen 80 default_server;默认虚拟主机当请求域名不匹配任何 server_name 时全部交给这个 server 处理。一个端口只能有一个 default_server。2server_name 指令虚拟主机域名匹配作用同一端口下多个网站 / API 域名区分实现一台 Nginx 绑定多个域名分流。1基础语法server_name 域名1 域名2 泛域名;2精准域名匹配server_name api.example.com;server_name api.example.com admin.example.com;完全匹配请求 Header 里的 Host 字段仅访问对应域名才进入当前 server 块。3泛域名匹配前缀泛域名匹配所有二级域名a.example.com、admin.example.com、pay.example.com不匹配根域名 example.comserver_name *.example.com;后缀泛域名匹配 api.xxx.com、api.xxx.cn极少用。server_name api.*;3透传客户端真实信息proxy_set_header Host$host;proxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Proto$scheme;Host $host把原始请求域名传给后端后端可拿到访问域名X-Real-IP $remote_addr单代理场景直接拿到客户端真实 IPX-Forwarded-For多级代理时串联所有上游 IP后端通过这个取真实客户端 IPX-Forwarded-Proto传递 http/https 协议后端判断是否 HTTPS 访问4超时时间防止卡死proxy_connect_timeout 60s;# 与后端建立TCP连接超时proxy_read_timeout 120s;# 连接成功后读取后端响应超时长接口/文件上传调大proxy_send_timeout 60s;# 向后端发送请求数据超时5缓冲区优化高并发必配proxy_buffer_size 64k;# 响应头缓冲区proxy_buffers4128k;# 4块128k缓冲区存响应体proxy_busy_buffers_size 256k;# 忙时最大缓冲不配置会导致 Nginx 小块多次转发增加 IO 损耗。6长连接优化配合 upstream keepaliveproxy_http_version1.1;proxy_set_header Connection;HTTP1.0 默认短连接开启后复用 TCP 连接大幅提升 QPS。7proxy_pass 转发地址规则location /api/{proxy_pass http://backend_server;# 不带/保留location前缀转发# proxy_pass http://backend_server/; # 带/抹掉location匹配前缀}示例区分访问 /api/user1不带 /不会抹掉前缀/api/转发 http://xxx/api/user2带 /会抹掉前缀/api/转发 http://xxx/user8故障自动重试 proxy_next_upstreamproxy_next_upstream errortimeoutinvalid_header http_500 http_502 http_503 http_504;proxy_next_upstream_tries3;proxy_next_upstream_timeout 10s;遇到网络错误、超时、5xx 错误自动切换下一台健康节点重试tries单请求最多换 3 台机器timeout整个重试流程总超时 10 秒【5】模板案例http{upstream backend_server{server127.0.0.1:8080weight1max_fails3fail_timeout30s;server127.0.0.1:8081weight1max_fails3fail_timeout30s;keepalive64;}# HTTP 80 端口服务server{# listen完整参数示例listen80default_server reuseportbacklog65535;# 精准业务域名server_name api.example.com www.example.com;proxy_set_header Host$host;proxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;location /{proxy_pass http://backend_server;}}# HTTPS 443 端口服务server{listen443ssl http2 reuseportbacklog65535;server_name api.example.com www.example.com;ssl_certificate cert/api.pem;ssl_certificate_key cert/api.key;location /{proxy_pass http://backend_server;}}# 兜底非法域名拦截server{listen80;server_name _;return403;}}【二】反向代理和负载均衡案例【1】反向代理转发请求到gateway案例nignx 配置文件监听的 ip 为localhost端口为 20100现在系统管理服务、公共管理服务、指标平台服务都注册在 nacos统一通过 gateway 请求转发如果请求前缀为 /api/ 就转发到系统管理前缀为 /commapi/ 就转发到公共服务管理前缀为 /indapi/ 就转发到指标平台管理配置反向代理的案例1请求urlhttp://172.17.0.79:20100/indapi/v1/indtable/syncDimLevelByTableId/20588131207284531212nginx部署在前端服务器监听localhost的20100端口3因为有/indapi/前缀所以location匹配到proxy_pass转发http://gateway_cluster/damp-ind-api/末尾带/表示抹掉/indapi/前缀最终转发地址为http://gateway_cluster/damp-ind-api/v1/indtable/syncDimLevelByTableId/20588131207284531214gateway_cluster时upstream配置的服务池对应gateway网关服务5此时http://172.17.0.79:20100/indapi/v1/indtable/syncDimLevelByTableId/2058813120728453121被反向代理到gateway网关服务6gateway网关服务中配置路由根据/damp-ind-api路由到指标平台服务7指标平台服务中Controller(“/v1/indtable”)匹配到请求GetMapping(“/syncDimLevelByTableId”)匹配到接口完成本次请求worker_processes auto;worker_rlimit_nofile65535;events{worker_connections10240;use epoll;multi_accept on;}http{include mime.types;default_type application/octet-stream;log_format main$remote_addr - $remote_user [$time_local] $request $status $body_bytes_sent $http_referer $http_user_agent $http_x_forwarded_for;access_log logs/api_20100.log main;sendfile on;tcp_nopush on;tcp_nodelay on;keepalive_timeout65;gzipon;gzip_min_length 1k;gzip_types text/plain text/css application/json application/javascript text/xml;# 上游SpringCloud Gateway 网关集群网关注册nacos这里写网关部署地址upstream gateway_cluster{server172.17.0.79:20110weight1max_fails3fail_timeout30s;# 多网关实例可追加# server 127.0.0.1:8100 weight1 max_fails3 fail_timeout30s;keepalive64;}server{# 仅监听本机localhost 20100端口外部网络访问不到listen20100;server_name localhost;#文件最大值client_max_body_size 100m;# 透传客户端真实IP、协议、域名给网关后端微服务proxy_set_header Host$host;proxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Proto$scheme;# 超时配置proxy_connect_timeout 60s;proxy_read_timeout 120s;proxy_send_timeout 60s;# 缓冲区优化proxy_buffer_size 64k;proxy_buffers4128k;proxy_busy_buffers_size 256k;# 开启长连接提升网关转发性能proxy_http_version1.1;proxy_set_header Connection;# 故障自动切换网关节点proxy_next_upstream errortimeoutinvalid_header http_500 http_502 http_503 http_504;proxy_next_upstream_tries2;proxy_next_upstream_timeout 10s;# 1. /api/ 系统管理服务location /api/{proxy_pass http://gateway_cluster/damp-base-sys-api/;proxy_redirect off;}# 2. /commapi/ 公共管理服务location /commapi/{proxy_pass http://gateway_cluster/damp-base-common-api/;proxy_redirect off;}# 3. /indapi/ 指标平台服务location /indapi/{proxy_pass http://gateway_cluster/damp-ind-api/;proxy_redirect off;}# 未匹配前缀统一返回404location /{return404;}# 统一错误页面error_page500502503504/50x.html;location/50x.html{root html;}}}【2】负载均衡datax集群案例有 3 台 datax 服务器组成集群通过 nginx 路由转发默认轮询机制nginx 配置反向代理和负载均衡的案例worker_processes auto;worker_rlimit_nofile65535;events{worker_connections10240;use epoll;multi_accept on;}http{include mime.types;default_type application/octet-stream;# 访问日志log_format main$remote_addr - $remote_user [$time_local] $request $status $body_bytes_sent $http_referer $http_user_agent $http_x_forwarded_for;access_log logs/datax_proxy.log main;sendfile on;tcp_nopush on;tcp_nodelay on;keepalive_timeout60;gzipon;gzip_min_length 2k;gzip_types text/plain application/json text/css application/javascript;# DataX集群上游池默认轮询 upstream datax_cluster{server192.168.10.101:8088max_fails3fail_timeout30s;server192.168.10.102:8088max_fails3fail_timeout30s;server192.168.10.103:8088max_fails3fail_timeout30s;# 默认轮询无需额外配置算法# ip_hash; # 开启则会话保持注释掉使用轮询# least_conn; # 最少连接算法本次不用# Nginx与DataX服务复用长连接减少TCP握手开销keepalive128;}# 反向代理服务块 server{listen8090reuseportbacklog65535;server_name localhost datax-proxy;# 透传客户端真实IP、域名、协议给后端DataX服务proxy_set_header Host$host;proxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Proto$scheme;# DataX同步任务执行时间长调大读写超时proxy_connect_timeout 30s;proxy_read_timeout 600s;proxy_send_timeout 30s;# 响应缓冲区优化proxy_buffer_size 128k;proxy_buffers4256k;proxy_busy_buffers_size 512k;# 开启HTTP1.1长连接配合upstream keepaliveproxy_http_version1.1;proxy_set_header Connection;# 后端异常自动切换下一台节点重试proxy_next_upstream errortimeoutinvalid_header http_500 http_502 http_503 http_504;proxy_next_upstream_tries2;proxy_next_upstream_timeout 20s;# 全局路由全部转发至datax集群location /datax/{proxy_pass http://datax_cluster;}# 统一错误页面error_page500502503504/50x.html;location/50x.html{root html;}}}