配置步骤
1、下载Nginx
1
| wget http://nginx.org/download/nginx.1.20.1.tar.gz
|
2、解压
1
| tar -zxvf nginx-1.20.1.tar.gz
|
3、进入解压目录编译
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
./configure \
--prefix=/usr/local/nginx \
--pid-path=/var/run/nginx.pid \
--lock-path=/var/lock/nginx.lock \
--error-log-path=/var/log/nginx/error.log \
--http-log-path=/var/log/nginx/access.log \
--with-http_gzip_static_module \
--http-client-body-temp-path=/var/temp/nginx/client \
--http-proxy-temp-path=/var/temp/nginx/proxy \
--http-fastcgi-temp-path=/var/temp/nginx/fastgi \
--http-uwsgi-temp-path=/var/temp/nginx/uwsgi \
--http-scgi-temp-path=/var/temp/nginx/scgi \
--with-http_stub_status_module \
--with-http_ssl_module \
--with-http_stub_status_module
|
1
| ./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module
|
4、编译安装
5、进入sbin目录启动nginx
1
| cd /usr/local/nginx/sbin
|
6、启动
1
2
3
4
5
6
| #执行启动
./nginx
#停止：
./nginx -s stop
#重新加载：
./nginx -s reload
|
7、 上传证书
1
| 随便上传到哪 示例上传到 /opt/cert/下的
|
8、配置HTTPS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| #user nobody;
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
server {
listen 80;
server_name thed.zxrmrf.com;
# HTTP 转HTTPS
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl;
server_name localhost;
ssl_certificate /opt/cert/123478517.pem;
ssl_certificate_key /opt/cert/123478517.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
proxy_pass http://localhost:9000;
}
}
}
|
http访问强制跳转到https
- 下面是将所有的http请求通过rewrite重写到https上。
例如将所有的dev.demodomain.com域名的http访问强制跳转到https。
下面配置均可以实现：
配置1：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
| server {
listen 80;
server_name dev.demodomain.com;
index index.html index.php index.htm;
access_log /usr/local/nginx/logs/8080-access.log main;
error_log /usr/local/nginx/logs/8080-error.log;
rewrite ^(.*)$ https://$host$1 permanent; //这是ngixn早前的写法，现在还可以使用。
location ~ / {
root /var/www/html/8080;
index index.html index.php index.htm;
}
}
|
1
2
3
4
5
6
7
8
9
| 上面的跳转配置rewrite ^(.*)$ https://$host$1 permanent;
也可以改为下面
rewrite ^/(.*)$ http://dev.demodomain.com/$1 permanent;
或者
rewrite ^ http://dev.demodomain.com$request_uri? permanent;
|
配置2：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
| server {
listen 80;
server_name dev.demodomain.com;
index index.html index.php index.htm;
access_log /usr/local/nginx/logs/8080-access.log main;
error_log /usr/local/nginx/logs/8080-error.log;
return 301 https://$server_name$request_uri; //这是nginx最新支持的写法
location ~ / {
root /var/www/html/8080;
index index.html index.php index.htm;
}
}
|
配置3：这种方式适用于多域名的时候，即访问demodomain.com的http也会强制跳转到https://dev.demodomain.com上面
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
| server {
listen 80;
server_name dev.demodomain.com demodomain.com *.demodomain.com;
index index.html index.php index.htm;
access_log /usr/local/nginx/logs/8080-access.log main;
error_log /usr/local/nginx/logs/8080-error.log;
if ($host ~* "^demodomain.com$") {
rewrite ^/(.*)$ https://dev.demodomain.com/ permanent;
}
location ~ / {
root /var/www/html/8080;
index index.html index.php index.htm;
}
}
|
配置4：下面是最简单的一种配置
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
| server {
listen 80;
server_name dev.demodomain.com;
index index.html index.php index.htm;
access_log /usr/local/nginx/logs/8080-access.log main;
error_log /usr/local/nginx/logs/8080-error.log;
if ($host = "dev.demodomain.com") {
rewrite ^/(.*)$ http://dev.demodomain.com permanent;
}
location ~ / {
root /var/www/html/8080;
index index.html index.php index.htm;
}
}
|
|
这里分享一个nginx反代tomcat，并且http强制跳转至https的配置示例
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
| server {
listen 80;
server_name zrx.demodomain.com;
index index.html index.php index.htm;
access_log logs/access.log;
error_log logs/error.log;
return 301 https:
location ~ / {
root /data/nginx/html;
index index.html index.php index.htm;
}
}
[root@BJLX_34_33_V vhosts]# cat ssl-zrx.conf
upstream tomcat8 {
server 172.29.34.33:8080 max_fails=3 fail_timeout=30s;
}
server {
listen 443;
server_name zrx.demodomain.com;
ssl on;
### SSL log files ###
access_log logs/ssl-access.log;
error_log logs/ssl-error.log;
### SSL cert files ###
ssl_certificate ssl/demodomain.cer;
ssl_certificate_key ssl/demodomain.key;
ssl_session_timeout 5m;
location / {
proxy_pass http:
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_redirect off;
}
}
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
#user nobody;
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
server {
listen 80;
server_name thed.zxrmrf.com;
# HTTP 转HTTPS
return 301 https:
}
server {
listen 443 ssl;
server_name localhost;
ssl_certificate /opt/software/cert/thed.zxrmrf.com.pem;
ssl_certificate_key /opt/software/cert/thed.zxrmrf.com.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
proxy_pass http:
}
}
}
|
