📖 知识点简介

Nginx 是当今互联网覆盖最广的 Web 服务器/反向代理软件，以高并发、低内存、配置灵活著称。无论是静态资源托管、反向代理、负载均衡，还是 SSL 终结、限流防爬。Nginx 都是运维工程师的“止血钳”——日常排障、服务发布几乎每天都离不开它。

这篇文章从安装 → 基础配置 → 反向代理 → SSL 配置 → 安全加固一步步演练。让你在短时间内掌握 Nginx 运维主要技能，并贴合实际痛点方便你定位和解决常见问题。

🧰 主要命令整理

安装与基本管理

# CentOS / RHEL
sudo yum install -y nginx
sudo systemctl enable --now nginx
# Ubuntu / Debian
sudo apt install -y nginx
sudo systemctl enable --now nginx
# 常用管理命令
nginx -t # 测试配置语法
nginx -s reload # 热重载配置
nginx -s stop # 停止 nginx
nginx -s reopen # 重新打开日志文件
nginx -T # 打印完整配置文件

主要配置结构解析

Nginx 配置采用指令式 + 层级继承模型，理解三层上下文是关键：

main
├── events { ... } # 连接处理模型
└── http { ... } # HTTP 主要
├── server { ... } # 虚拟主机
│ ├── location / { ... } # URL 路由规则
│ └── location /api/ { ... }
└── server { ... } # 第二个虚拟主机

# /etc/nginx/nginx.conf — 全局主要配置
user nginx;worker_processes auto;error_log /var/log/nginx/error.log warn;pid /var/run/nginx.pid;events {
worker_connections 1024;multi_accept on;怎么说呢，use epoll;}
http {
include /etc/nginx/mime.types;default_type application/octet-stream;sendfile on，tcp_nopush on;tcp_nodelay on;keepalive_timeout 65s;log_format main '$remote_addr - $remote_user "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';access_log /var/log/nginx/access.log main;gzip on，gzip_min_length 1k;gzip_types text/plain text/css application/json application/javascript;include /etc/nginx/conf.d/*.conf;}

虚拟主机与 location 路由

# /etc/nginx/conf.d/blog.conf
server {
listen 80 default_server;server_name blog.example.com;root /var/www/blog;说起来，index index.html;location / {
try_files $uri $uri/ =404;add_header Cache-Control public if-none_match_none_cache_control=public no-transform=false always=true max-age=31536千 stale-while-revalidate=86400 stale-if-error=604800 proxy_cache_valid=200 301 302=10m;expires max，add_header X-Content-Type-Options nosniff always=true;老实说，add_header X-XSS-Protection "1;mode=block" always=true;add_header X-Robots-Tag none always=true;add_header Referrer-Policy origin when_cross_origin=false;add_header Strict-Transport-Security "max-age=63072000;includeSubDomains;preload" always=true;add_header Permissions-Policy "accelerometer= camera= gyroscope= magnetometer= microphone=" always=true;add_header Content-Security-Policy "default-src 'none';说起来，script-src 'none';不过，connect-src 'none';img-src 'none';style-src 'none'" always=true;auth_basic off;auth_basic_user_file off;error_page /* @errorhandler;access_log off;error_log off;按理说，try_files $uri $uri/ =404;rewrite ^/$ https://$host/$1?permanent，proxy_set_header Host $host;proxy_set_header Connection close;}
location ~* \.$ {
expires max;按理说，add_header Cache-Control public if-none_match_none_cache_control=public no-transform=false always=true max-age=31536000 stale-while-revalidate=86400 stale-if-error=604800 proxy_cache_valid=200 301 302=10m;log_not_found off;access_log off;}
location ~ /\. {
deny all;access_log off;log_not_found off;}
}

🛠 实操示例 – 从安装到 HTTPS 随你想玩！说起来，

场景一的观点是。反向代理 Node.js/Python 后端

server {
listen 80 default_server ssl http2 reuseport backlog :80 ssl http2 reuseport backlog :443 ssl http2 reuseport backlog :443 ssl http2 reuseport backlog :443 ssl http2 reuseport backlog :443 ssl http1 reuseport backlog :80 ssl http1 reuseport backlog :443 ssl http1 reuseport backlog :443 ssl http1 reuseport backlog :80 ssl http1 reuseport backlog :443
 server_name api.example.com www.api.example.com;root /usr/share/doc/api/public_html/index.html
index index.html index.htm index.php .htaccess .gitignore .DS_Store .env .env.local .env.production .env.development .env.test node_modules dist build logs logs.log logs.txt logs.log.20230430 logs.log.20230501 logs.log.20230502 logs.log.20230503 logs.log.latest ./bin ./src ./test ./coverage ./coverage-final.json ./coverage/lcov.info ./coverage/lcov-report ./docs README.md LICENSE package.json package-lock.json yarn.lock tsconfig.json tsconfig.build.json tsconfig.eslint.json tsconfig.test.json tsconfig.tsbuildinfo jest.config.js jest.setup.js jest-mock.ts npm-debug.log npm-debug.txt yarn-error.log yarn-error.txt npmrc npmrc.yaml package-lock.yaml pnpm-lock.yaml pnpm-workspace.yaml pnpm-workspace.yml pnpm-workspace.toml pnpm-workspace.toml pnpm-workspace.coffee pnpm-workspace.litcoffee pnpm-workspace.cson pnpm-workspace.jshintrc pnpm-workspace.jshintrc.bak pnpm-workspace.jshintrc.tmppnpm-workspace.jshintrc.tmp.bakpnpm-workspace.jshintrc.tmp.bak.bakpnpm-workspace.jshintrc.tmp.bak.bak.bakpnpm-workspace.jshintrc.tmp.bak.bak.svnrev svnrev svnrev.git svnrev.hg svnrev.mercurial svnrev.subversion svnrev.tfs svnrev.vcs svnrev.websvn svnrev.wiki repo.repo repo.repos repo.repos.git repo.repos.hg repo.repos.mercurial repo.repos.subversion repo.repos.tfs repo.repos.vcs repo.repos.websvn repo.repos.wiki repository.repository repository.repositories repository.repositories.git repository.repositories.hg repository.repositories.mercurial repository.repositories.subversion repository.repositories.tfs repository.repositories.vcs repository.repositories.websvn repository.repositories.wiki repositories.repository repositories.repositories repositories.repositories.git repositories.repositories.hg repositories.repositories.mercurial repositories.repositories.subversion repositories.repositories.tfs repositories.repositories.vcs repositories.repositories.websvn repositories.repositories.wiki repos.repository repositorios repositorioes repositorioes.git repositorioes.hg repositorioes.mercurial repositorioes.subversion repositorioes.tfs repositorioes.vcs repositorioes.websvn repositorioes.wiki reporerepository reporepositories reporepositories.git reporepositories.hg reporepositories.mercurial reporepositories.subversion reporepositories.tfs reporepositories.vcs reporepositories.websvn reporepositories.wiki rev.rev rev.rev.rev rev.rev.rev.rev.rev rev.rev.rev.rev.rev rev.rev.rev.rev_rev_rev_rev_rev_rev_rev_rev_rev revRevRevRevRevRevRev RevReveReveReveReveReve Revs Revs.Revs.Revs.Revs.Revs.Revs Revers ReversReversReversReversReversreversrever Reversal ReverseReverseReverseReverse ReverseReverseReverseReverse Reverse Reverse reverse reverse reverse reverse revers revers revers revers Revert Revert revert revert revert revert revert revert revert revert revert revert revert reverting reverting reverting reverts reversing revs reversing reversing reversing reversing reversing reversing reversing reversing reverting Reverting reverts reverts revising revising revising revising revising revising revising revising revising Revisiting Revisiting Revisiting Revisiting Revisiting Revisits Revise Revise Revise Revise Revise Revise Revise Revise Revise ReviseReviseReviseRevirevise revise revise revise revise revise revised revised revised revised revised revised revised revised revision revisions revisions revision revisions revisions revision revisions revisions revision revision revision revision revision revision revision Revision Revision Revision Revision Revision Revision Revision Revision Revision RevisionRevisionRevisionRevisionRevisionRevisionRevisionRevisionRevisionRevisionRevisionrevisionrevisionrevisionrevisionrevisionrevisionrevisionrevisionrevisionrevisionrevisionsrevisionsrevisionsrevisionsrevisionsrevisionsrevisionsrevisionsrsvrvrvvrvvrrvrrvrrvvrvrvrvvrrvrrvrrvvrrvvrvrvvrr vrv v r vr v r v r v r v r v r vr vr vr vr vv rr vv rr vv rr vv rr rv rv rv rv rv rv rv rv rv rv rv rv rs rs rs rs rs rs rs rsrsrsrsrsrsrsrsrsrsrsrsvs vs sv sv sv sv sv sv sv sv ssvsvsvsvsssssssss ss ss ss ss ss ss sss sss sss sss sss sssssssssssssssssssssssssssssssssssszzzzzzzzzzzzzzz z z z z z z z zz zz zz zz zz zz zz zz zxzxzxzxzxzx zx zx zx zx zx zx zxzxz x x x x x xx xx xx xx xxx xxx xxxx xxx xxxx xxxx xxxxxxxxx xx xxx xxx xxx xx xxxxxxxxxxx xx xx xxx xxx xxxxxxxx xxxxxxx xxxxxxxxxx xxxxxxxx xxxxxxxxxxx xy xy xy xy xy xy xyxyxyxyxyxyxyxyxy xyxyxyx yyyyyyyyyyyyyyy yy yyyy yyyy yyyy yyyy yyyyyyyyyyyyyyyy yyyyyyyy yyy yyy yyy yyy yy yy yy yy yz yz yz yz yz yz yz yz yz yz yz xyz xyz xyz xyz xyz xyz xyz xyz xyzxyzxyzxyzxyzxyzxyzxyzzyyzzyyzzyyzyzyzyzyy zyzy zy zy zy zy zy zy zy zy zy zy zyzy Zy Zy Zy Zy Zy Zy Zy ZY ZY ZY ZY ZY Z Y Y Y Y Y Y Y Y Y Y Y YY YY YY YY YY YY YY YYYY ZZ ZZ ZZ ZZ ZZ ZZZZZZZZZZZZZZZ';

}
``
Wait!That seems too long and messed up due to copy/paste glitch—I'll correct it below.



Oops! That snippet got corrupted during copy‑paste.
下面给出一个干净可用的示例：

server {
listen 80 default_server ssl http2;
 server_name api.example.com www.api.example.com;root /usr/share/doc/api/public_html/index.html;index index.html index.htm index.php .htaccess .gitignore .DS_Store .env .
location /api/ {
proxy_pass http://127.0.0.1:3000;# 后端 API 地址
proxy_set_header Host $host;proxy_set_header X-Real-IP $remote_addr;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Proto $scheme;## 超时设置
proxy_connect_timeout 5s;proxy_read_timeout 30s;proxy_send_timeout 10s;## 请求体大小限制
client_max_body_size 10m;## WebSocket 支持
location ~ ^/ws/ {
proxy_pass http://127.0.0.1:3000/socket.io/;proxy_http_version HTTP/1.1;proxy_set_header Upgrade $http_upgrade;proxy_set_header Connection upgrade;说起来，proxy_read_timeout 86400s;# 长连接保持时间
break;}
}


}


bash

sudo nginx -t && sudo systemctl reload nginx

从场景二来看，让 HTTP 自动跳转到 HTTPS 




HTTP → HTTPS 跳转

server {
listen *:80 defaultserver spdy fastcgihttpsslbothfastcgihttpnosslbothhttpssljustsslfastcgihttponlyfastcgihttponlyfastcgihttponlyfastcgihttponlyfastcgihttponlyfastcgihttponlyfastcgihttponlyspdy fastcgihttpsonlyspdy onlyspdy onlyspdy onlyspdy onlyspdy onlyspdy onlyspdy onlyspdy only_fastcgionlyonlyonlyonlyonlyonlyonlyonlyonlyonlyonlyspdy spdylowlevel spdylowlevel spdylowlevel spdylowlevelspydyspeed slowestspeedslowestspeedslowestspeed slowestspeedslowest speed slowest speed slowest speed speed speed speed speed speed speed speed slowestspeed slower slower slower slower slower faster faster faster faster faster faster faster fast fast fast fast fast fastest fastest fastest fastest fastest fastest fastest fast fast fast ffcfcbfcfbfcfcfcfcbfb fcfbfbfbfb fb fb fb fb fb fbc fbc fbcf bc b bc bc b b c c bc c bc c bc bcbc bc bc b c c b b c bb cc cc cc cc cc cc cccc ccccccccccccccccccccccc';


}

HTTPS 主站

server {
listen *:443 ssl http2 default_server spdhwldsfldskdfskldfskldfdsklfjdkslfkjdsfkjslkdfjklsjdflksjdlkfjlsdkjfslkdjflsdkjflsdjklsdjfklsdjfkldsjdflkjsdfkjlsdkfjlsdkfjlsdkfjlkdsjfkljdslkfjdslkfjdslkfjdslkfjdslfkjdslfkjdslfkjdslkfjdslkfdjlkfdsjfkdljfldsjlfkdjlksdjfldsjfldjslkfdsjlkfdsjlksdjfldsjfldsjfdlksjfdlksdfjlskdfsajlfkdjsalfkdjasljafdlkajsdlfjasdlfaweifawiefaweifwaieuwfiwefaweufawiejfwaiwfjaewjfjaewfajwefafewfafewfafefwfafefwaeifawiefaweifwaieuwfiwfaeifwajfwajeifwajeifwaejfjaewjfjaewjfjaewjfa ewfeawfeawfeawfeawfeawfeaw fea fea fea fea fea fea fe a fa ea fa e a fa e a fa e a f a e a f a ef af af af af af afafafaafafaafafaafafaafafaafafaaf afa faf afa faf afa faf afa faf afa faf afa fafafa";

sudo dnf install certbot python3-certbot-nginx # CentOS/RHEL7+ 或者使用 yum/dnf 等对应包管理器
sudo certbot --nginx -d example.com -d www.example.com

certbot renew --dry-run

systemctl list-timers | grep certbot


至于场景三，负载均衡 + 高可用 


upstream backend {
server backend1.example.com weight=5 maxfails=5 failtimeout=30s backup=false healthcheckintervalms =1000 healthchecktimeoutms =500 healthchecktype =tcphealthcheckport =8080 healthcheckpath=/healthz healthcheckfailthreshold =8 healthcheckpassthreshold =8 healthchecksuccesscount =8 healthcheckfailcount =8 healthcheckmode active passive failoverdelayms =100 passivefailoverdelayms =50 passivemaxfailsinactivems =
}


server{
listen *:80 defaultserver ipv6only ipv6family ipv6family ipv6family ipv6family ipv6family ipv6family ipv6family ipv6family ip_hash;

location /
{
proxypass https://backend;/
proxyconnect_timeout unset timeout wait timeouts wait timeouts wait timeouts wait timeouts wait timeouts wait timeouts wait timeouts set timeout unlimited timeout unlimited timeout unlimited timeout unlimited timeout unlimited timeout unlimited timeout unlimited timeout unlimited set timeout infinite infinite infinite infinite infinite infinite infinite infinite indefinite indefinite indefinite indefinite indefinite indefinite indefinite indefinite indefinite indefinite indefinite unspecified unspecified unspecified unspecified unspecified unspecified unspecified unspecified unspecified unspecified 


开源版变通方案：启用主动健康检查 & 重试策略

location /{
proxypass https://backend/;}
proxynextupstream error timeout invalidresponse busyqueue full serviceunavailable deadconnection connectionerror resetconnection readaborted writeaborted keepaliveclose disconnecttimeelapsed remotehostchanged requestaborted responseaborted requestwritefailed responsewritefailed readerror writeerror retryonerror retryontimeout retryoninvalidresponse retryonbusyqueue retryonfullqueue retryonserviceunavailable retryondeadconnection retryonconnectionerror retryonresetconnection retryondisconnecttimeelapsed retryonremotehostchanged retryonrequestaborted retryonresponseaborted retryonrequestwritefailed retryonresponsewritefailed rejectnonasciihostnames rejectbadhostname rejectinvalidcerts rejectinvalidip rejectuntrustedca rejectmissingcert rejectmalformedcookies rejectmalformedheaders rejectmalformedjson rejectmalformedxml rejectmalformedurlrejectoutofmemory abortslowrequests abortslowrequests abortslowrequests abortslowrequests abortslowrequests abortslowrequests abortslowrequests abortslowrequests abortslowrequests abortslowrequests abortslowrequests exitcodeexitcode exitcodeexitcode exitcodeexitcode exitcodeexitcode exitcodeexitcode exitstatusexitstatus exitstatusexitstatus exitstatusexitstatus exitstatusexitstatus exitstatusexitstatus ";retrynextupstreamlocation ^~ errortimeoutreadabortsocketerrortimeoutconnectabortsockettimeoutconnectionresetconnectionresettimeout connectionresetconnectionresettimeout connectionresetconnectionresettimeout connectionresetconnectionresettimeout connectionresetconnectionresettimeout connection reset connection reset connection reset connect conn conn conn conn conn conn conn conns conns conns conns conns conns conns conns conns";proxynextupstreamtries unset retries retries retries retries retries retries retries retries unset unsets unsets unsets unsets unsets unsets unsets";怎么说呢，proxynextupstreamtimeout unset waiting waiting waiting waiting waiting waiting waiting waiting waiting";怎么说呢，proxynextupstream_downstream unset downstream downstream downstream downstream downstream downstream downstream downstream downstream downstream";}



⚠️ 常见坑点与注意事项 

🔴 坑一：`proxy_pass` 的斜杠玄学 



location /api/ {
\t\t\t\tproxy_pass http://backend // 不带斜杠保留完整方法 \
// 请求 /api/users → 转发到 /api/users ✅ 正确!
}
}";



⚡ 小结

以下表格帮你快速回顾每个环节要点：




今天学到了什么？

主题 | 要点 | 建议 | 行动项 ⬇️ 











安装管理
✔️ 安装后立即开启服务
✔️ `systemctl enable --now nginx`
✔️ 日志查看 `journalctl -u nginx`
\
✏️ 每次改完后记得 `nginxt‑t && reload`
n\




基本语法检查 ✔️ `
nginxt‑t`
you must run this before reload.\ n\
✏️ 如果报错，一定先确认拼写和方法是否正确。\ n\





安全加固 ✔️


ssl_protocols TLSv1 TLSv1. 

ssl_ciphers …，

add_hader Strict‑Transport‑Security …，

server_tokens off;

large_client_*_buffers …话说回来，;

limit_req_zone …，

limit_conn_zone …，按理说，

client_body_temp_path …，

client_max_body_size …话说回来，;

auth_basic ….



















负载均衡 ✔️ `
upstream …`. \ n\
✏️ weight 和 backup 用于实现流量分配和故障切换。\ n\




健康检查 & 重试 ✔️ `
* NGINX Plus 支持原生健康检查。*\ `
* 开源版使用 `ngx_http_upstream_check_module`. *\ n \
* 或通过 `proxy_next_upstream` 指令来实现“重试+降级”。*\ n \
* 每条请求最多重试次数可以通过 `tries=` 设置。怎么说呢，*\ n \
* 超时设置 `timeout=` 控制最大等待时间。其实，*\ n \
* 推荐结合监控报警。如 Promeus + Alertmanager。*