nginx 域名配置

上海老张 發表於 2022-3-17 15:38:00

<p></p><div class="toc"><div class="toc-container-header">目录</div><ul><li>nginx域名配置<ul><li>自签域名<ul><li>生成本地签名证书</li></ul></li><li>修改nginx配置域名模板</li><li>实例参考<ul><li>实例1</li><li>实例2</li><li>实例3</li></ul></li><li>参考文档</li></ul></li></ul></div><p></p>
<h2 id="nginx域名配置">nginx域名配置</h2>
<h3 id="自签域名">自签域名</h3>
<h4 id="生成本地签名证书">生成本地签名证书</h4>
<pre><code>//创建ssl证书存放路径并进入该路径
mkdir -p /etc/nginx/ssl/;cd /etc/nginx/ssl/

//生成CA的私钥
//创建服务器证书密钥文件 server.key
openssl genrsa -des3 -out server.key 2048

//创建服务器证书的申请文件 server.csr
//CA证书里面包含了CA的信息和CA的签名（使用CA私钥加密）
openssl req -new -key server.key -out server.csr
输出内容为：
Enter pass phrase for root.key: ← 输入前面创建的密码
Country Name (2 letter code) :CN ← 国家代号，中国输入CN
State or Province Name (full name) :BeiJing ← 省的全名，拼音
Locality Name (eg, city) []:BeiJing ← 市的全名，拼音
Organization Name (eg, company) :MyCompany Corp. ← 公司英文名
Organizational Unit Name (eg, section) []: ← 可以不输入
Common Name (eg, YOUR name) []: ← 输入域名，如：iot.conet.com
Email Address []:admin@mycompany.com ← 电子邮箱，可随意填
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: ← 可以不输入
An optional company name []: ← 可以不输入

//备份一份服务器密钥文件
cp server.key server.key.org

//去除文件口令
openssl rsa -in server.key.org -out server.key

//生成证书文件server.crt
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
</code></pre>
<h3 id="修改nginx配置域名模板">修改nginx配置域名模板</h3>
<pre><code>user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
worker_connections 1024;
}

http {
log_formatmain'$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_x_forwarded_for"';

access_log/var/log/nginx/access.logmain;

sendfile          on;
tcp_nopush       on;
tcp_nodelay       on;
keepalive_timeout 65;
types_hash_max_size 4096;

include          /etc/nginx/mime.types;
default_type    application/octet-stream;

include /etc/nginx/conf.d/*.conf;

server {
   listen    80;
   listen    [::]:80;
   listen    443 ssl http2;
   listen    [::]:443 ssl http2;
   server_name_;
   root       /usr/share/nginx/html;

ssl_certificate "/usr/share/nginx/html/ssl/server.crt";
ssl_certificate_key "/usr/share/nginx/html/ssl/server.key";
   ssl_session_cache shared:SSL:1m;
   ssl_session_timeout10m;
   ssl_ciphers HIGH:!aNULL:!MD5;
   ssl_prefer_server_ciphers on;

   # Load configuration files for the default server block.
   include /etc/nginx/default.d/*.conf;

   error_page 404 /404.html;
         location = /40x.html {
   }

   error_page 500 502 503 504 /50x.html;
         location = /50x.html {
   }
}

}
</code></pre>
<h3 id="实例参考">实例参考</h3>
<h4 id="实例1">实例1</h4>
<pre><code>cat /etc/nginx/conf/conf.d/ecs.conf

upstream consoleSvr {
server 172.16.0.11:8095max_fails=3fail_timeout=30s;
}

upstream ecsXxl {
server 172.16.0.11:8082 max_fails=3fail_timeout=30s;
}

upstream ecsSvr {
server 172.16.0.11:8096max_fails=3fail_timeout=30s;
}

server {
listen 80;
   listen 443 ssl; # managed by Certbot
server_name alex.com.cn;

   ssl_certificate /etc/nginx/cert/alex.com.cn.pem; # managed by Certbot
   ssl_certificate_key /etc/nginx/cert/alex.com.cn.key; # managed by Certbot
   access_log/var/log/nginx/access.logmain;
   error_log/var/log/nginx/error.loginfo;

location = / {
rewrite ^ /ecs-console/index.html permanent;
}

#xxl-job的配置需要放到前面
location ^~ /xxl-job-admin/ {
proxy_read_timeout 240s;
proxy_passhttp://ecsXxl;
}
location ^~ /(xxl-job-admin)/(.+)\.(css|js|html|map|gif|jpg|jpeg|png|ico|ttf|woff|apk|ipa)$ {
proxy_passhttp://ecsXxl;
}

location ~* \.(css|js|html|map|gif|jpg|jpeg|png|ico|mp4|svg|icon|ttf|woff|apk|ipa)$ {
root /usr/share/nginx/html;
}
location = /ecs/doc.html {
proxy_passhttp://consoleSvr;
}
location ^~ /ecs/webjars/ {
proxy_passhttp://consoleSvr;
}
location ~ /(console)/ {
rewrite ^/(console)?/(.*) /$2 break;
proxy_read_timeout 240s;
proxy_passhttp://consoleSvr;
}

location ~ /(designer|ecs|businessobject|datadictionary|distribution|filemanagement|flow|masterdata|rule|treemanager|platform)/ {
   rewrite ^/(designer|ecs|businessobject|datadictionary|distribution|filemanagement|flow|masterdata|rule|treemanager|platform)?/(.*) /$2 break;
   proxy_pass http://ecsSvr;
proxy_connect_timeout 240s;
proxy_read_timeout    240s;
proxy_send_timeout    240s;
}

location = /ecs-console/ {
index /ecs-console/index.html;
}
location / {
rewrite ^/console/(.*)$ /$2 break;
proxy_read_timeout 240s;
proxy_pass http://consoleSvr;
}
error_page 500 502 503 504/50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
}

</code></pre>
<h4 id="实例2">实例2</h4>
<pre><code>//代理前端
# HTTP server
server {
   listen    80;                               #http默认端口
   server_name***.com www.***.com;             #对应域名
   access_log /home/logs/nginx/***-access.log; #访问日志
   #rewrite    ^/(.*) https://***.com/$1 permanent;#配置此项则强行跳转到下面的https配置
   location / {       #配置此项则跳转到静态页面
            root       /home/***/web/user/;    #页面位置
            index    index.html index.htm;    #首页文件
            try_files $uri $uri/ /index.html; #url不可达时，逐个向后转发
   }
}
# HTTPS server
server {
   listen    443 ssl;                         #https默认端口
   server_name***.com www.***.com;             #对应域名
   root       html;
   index    index.html index.htm;

   client_max_body_size 1000M;
   access_log       /home/logs/nginx/***-https-access.log; #访问日志

   ssl_certificate    /usr/local/nginx/cert/******.com.pem;#你的证书
   ssl_certificate_key/usr/local/nginx/cert/******.com.key;#你的key
   ssl_session_timeout5m;
   ssl_ciphers       HIGH:!aNULL:!MD5;
   ssl_prefer_server_cipherson;
   ssl_protocols    TLSv1 TLSv1.1 TLSv1.2;
   location / {
            root       /home/***/web/user/;    #页面位置
            index    index.html index.htm;    #首页文件
            try_files $uri $uri/ /index.html; #url不可达时，逐个向后转发
   }
}
</code></pre>
<h4 id="实例3">实例3</h4>
<pre><code>//代理后端
# HTTP server
server {
   listen    80;
   server_nameapi.***.com www.api.***.com;;
   access_log /home/logs/nginx/***.api-access.log;
   #rewrite    ^/(.*) https://api.***.com/$1 permanent;
   location / {
            proxy_pass    http://127.0.0.1:8082;
   }
}
# HTTPS server
server {
   listen    443 ssl;
   server_nameapi.***.com www.api.***.com;;
   root       html;
   index    index.html index.htm;

   client_max_body_size 1000M;
   access_log /home/logs/nginx/***.api-https-access.log;

   ssl_certificate    /usr/local/nginx/cert/*****.com.pem;#你的证书
   ssl_certificate_key/usr/local/nginx/cert/*****.com.key;#你的key
   ssl_session_timeout5m;
   ssl_ciphersHIGH:!aNULL:!MD5;
   ssl_prefer_server_cipherson;
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
   location / {
            proxy_pass    http://127.0.0.1:8082;
   }
}
</code></pre>
<h3 id="参考文档">参考文档</h3>
<p>nginx配置，附https配置，前端（管理后台），后端（服务）</p>

</div>
<div id="MySignature" role="contentinfo">
<p>本文来自博客园，作者：liwenchao1995，转载请注明原文链接：https://www.cnblogs.com/liwenchao1995/p/16017517.html</p><br><br>
来源：https://www.cnblogs.com/liwenchao1995/p/16017517.html

頁: [1]

琼殿技术论坛's Archiver

nginx 域名配置