-
Notifications
You must be signed in to change notification settings - Fork 149
/
Copy pathnginx.conf
293 lines (246 loc) · 9.91 KB
/
nginx.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
# For more information on configuration, see:
# * Official English Documentation: http://nginx.org/en/docs/
# * Official Russian Documentation: http://nginx.org/ru/docs/
# base on nginx 1.16.1
user nginx;
# worker_processes auto;
worker_processes 4;
error_log /var/log/nginx/error.log error;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
accept_mutex on;
use epoll;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for" "$server_name" $server_port';
# 日志不立即写入磁盘，提高性能
access_log /var/log/nginx/access.log main buffer=32k flush=1m;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 30;
types_hash_max_size 2048;
server_tokens off;
include /etc/nginx/mime.types;
default_type application/octet-stream;
gzip on;
gzip_min_length 2k;
gzip_comp_level 4;
gzip_types text/css text/xml image/gif image/jpeg application/javascript application/rss+xml text/plain image/png image/tiff image/x-icon image/x-ms-bmp image/svg+xml application/json;
gzip_vary on;
gzip_buffers 4 16k;
# gzip_http_version 1.0;
# 启用 Brotli 压缩，需要重新编译加入 Brotli 模块，可以与 gzip 共存，相对 gzip 压缩率更高，占用资源更少，不过只支持 https
brotli on;
brotli_static on; # 预压缩
brotli_min_length 2k;
brotli_comp_level 6; # 0-11
brotli_window 512k;
brotli_types text/css text/xml image/gif image/jpeg application/javascript application/rss+xml text/plain image/png image/tiff image/x-icon image/x-ms-bmp image/svg+xml application/json;
brotli_buffers 4 16k; # 最新版官方已经废弃忽略的选项
upstream wsgi-blogbackend {
ip_hash;
server 127.0.0.1:8002 max_fails=3 fail_timeout=0;
}
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name www.blog.com;
# add_header X-Frame-Options "DENY";
if ($host != $server_name) { # 禁止IP访问，只能使用域名访问
return 400;
}
# 封禁爬虫
if ($http_user_agent ~* "^$|Baiduspider|Bytespider|EasouSpider|EtaoSpider|dotbot|Sougou|Scrapy|YisouSpider|bingbot|360Spider|Sogou web spider")
{
return 500;
}
location ~* \.(php|asp||aspx|jsp)$ {
return 500;
}
location /static {
root /home/workspace/blogproject;
# expires 30d;
if ($request_filename ~* .*\.(css|js|gif|jpg|jpeg|png|bmp|swf|svg)$)
{
expires 7d;
}
}
location /media { # 防止目录穿越， location 和 alias 都不加 /
alias /home/workspace/blogproject/uploads;
# expires 30d;
if ($request_filename ~* .*\.(css|js|gif|jpg|jpeg|png|bmp|swf|svg)$)
{
expires 7d;
}
}
location / {
try_files $uri @proxy_to_app;
}
location @proxy_to_app {
proxy_pass http://wsgi-blogbackend;
proxy_http_version 1.1;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Host $server_name;
proxy_intercept_errors on;
}
location = /favicon.ico {
access_log off; #关闭正常访问日志
}
error_page 404 /404.html;
location = /404.html {
root /usr/share/nginx/html;
if ( $request_uri ~ ^/favicon\.ico$ ) { #关闭favicon.ico 404错误日志
access_log off;
}
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
}
server {
listen 80;
listen [::]:80;
server_name www.leffss.com;
add_header X-Frame-Options "DENY";
return 307 https://$host$request_uri;
}
upstream wsgi-backend {
ip_hash;
server 127.0.0.1:8000 max_fails=3 fail_timeout=0;
}
upstream asgi-backend {
ip_hash;
server 127.0.0.1:8001 max_fails=3 fail_timeout=0;
}
# Settings for a TLS enabled server.
server {
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
server_name www.leffss.com;
ssl_certificate "/etc/nginx/server.crt";
ssl_certificate_key "/etc/nginx/server.key";
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # nginx 支持 TLSv1.3 但是系统自带 openssl 版本太低不支持
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
#ssl_ciphers HIGH:!aNULL:!MD5;
#ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE;
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256::!MD5;
ssl_prefer_server_ciphers on;
client_max_body_size 30m;
# http2_push_preload on; # http2 主动推送
# HSTS 31536000 one year
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY";
# Load configuration files for the default server block.
# include /etc/nginx/default.d/*.conf;
# location /static/ {
# alias /home/workspace/devops/static/;
# expires 1h;
# }
# location /media/ {
# alias /home/workspace/devops/media/;
# expires 1h;
# }
# 【=】模式: location = path,此种模式优先级最高（但要全路径匹配）
# 【^~】模式:location ^~ path,此种模式优先级第二高于正则；
# 【~ or ~*】模式:location ~ path,正则模式，优先级第三，【~】正则匹配区分大小写，【~*】正则匹配不区分大小写；
# 【path】模式: location path,中间什么都不加，直接跟路径表达式；
# location = /uri = 开头表示精确匹配，只有完全匹配上才能生效。最高优先级。
# location ^~ /uri ^~ 开头对URL路径进行前缀匹配，并且在正则之前。
# location ~ pattern ~ 开头表示区分大小写的正则匹配。
# location ~* pattern ~* 开头表示不区分大小写的正则匹配。
# !~和!~* 分别为区分大小写不匹配及不区分大小写不匹配的正则
# location /uri 不带任何修饰符，也表示前缀匹配，但是在正则匹配之后。
# location / 通用匹配，任何未匹配到其它location的请求都会匹配到，相当于switch中的default。
#location ~* .*\.(css|js|gif|jpg|jpeg|png|bmp|swf|svg)$ {
# expires 30d;
#}
if ($host != $server_name) { # 禁止IP访问，只能使用域名访问
return 400;
}
# 封禁爬虫
if ($http_user_agent ~* "^$|Baiduspider|Bytespider|EasouSpider|EtaoSpider|dotbot|Sougou|Scrapy|YisouSpider|bingbot|360Spider|Sogou web spider")
{
return 500;
}
location ^~ /admin {
return 500;
}
location ~* \.(php|asp||aspx|jsp)$ {
return 500;
}
location ~* ^/(media|static) {
root /home/workspace/devops;
# expires 30d;
if ($request_filename ~* .*\.(css|js|gif|jpg|jpeg|png|bmp|swf|svg)$)
{
expires 7d;
}
}
location /ws {
try_files $uri @proxy_to_ws;
}
location @proxy_to_ws {
proxy_pass http://asgi-backend;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Host $server_name;
proxy_intercept_errors on; #获取后端错误码并处理
recursive_error_pages on;
}
location / {
try_files $uri @proxy_to_app;
}
location @proxy_to_app {
proxy_pass http://wsgi-backend;
proxy_http_version 1.1;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Host $server_name;
proxy_intercept_errors on;
recursive_error_pages on;
}
location = /favicon.ico {
access_log off; #关闭正常访问日志
}
error_page 404 /404.html;
location = /404.html {
root /usr/share/nginx/html;
if ( $request_uri ~ ^/favicon\.ico$ ) { #关闭favicon.ico 404错误日志
access_log off;
}
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
}
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
}