服务器怎么配置Nginx

sudo apt update && sudo apt install -y nginx
sudo systemctl enable --now nginx
nginx -v                 # 查看版本
nginx -T                 # 打印最终生效的完整配置（排错神器）
sudo nginx -t            # 语法检查，改配置后必做
sudo systemctl reload nginx   # 平滑重载，不中断连接

user  www-data;
worker_processes  auto;              # 自动设为 CPU 核心数
worker_rlimit_nofile 65535;          # 单进程可打开的最大文件数
error_log  /var/log/nginx/error.log warn;
pid        /run/nginx.pid;

events {
    use epoll;                       # Linux 下性能最好的事件模型
    worker_connections 10240;        # 每个 worker 的最大并发连接
    multi_accept on;                 # 一次尽可能多地接受新连接
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for" '
                    'rt=$request_time uct="$upstream_connect_time" urt="$upstream_response_time"';
    access_log /var/log/nginx/access.log main;

    sendfile        on;              # 零拷贝发送静态文件
    tcp_nopush      on;              # 配合 sendfile，减少报文数量
    tcp_nodelay     on;              # 小包立即发送，降低延迟
    server_tokens   off;             # 隐藏版本号，降低被针对性攻击的风险

    keepalive_timeout   65;          # 长连接超时（秒）
    keepalive_requests  1000;        # 单条长连接最多处理的请求数
    client_max_body_size 64m;        # 请求体上限，影响上传大小
    client_body_timeout  30s;
    reset_timedout_connection on;

    # ---- gzip 压缩 ----
    gzip on;
    gzip_vary on;
    gzip_comp_level 6;
    gzip_min_length 1024;            # 小于 1KB 不压缩，避免得不偿失
    gzip_proxied any;
    gzip_types text/plain text/css application/json application/javascript
               application/x-javascript text/xml application/xml application/xml+rss
               text/javascript image/svg+xml font/woff2;

    # ---- 文件描述符缓存 ----
    open_file_cache max=10000 inactive=30s;
    open_file_cache_valid 60s;
    open_file_cache_min_uses 2;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;      # 全站跳转 HTTPS
}

server {
    listen 443 ssl;
    http2 on;                                   # Nginx 1.25.1+ 写法；老版本用 listen 443 ssl http2
    server_name example.com www.example.com;

    root /var/www/example.com;
    index index.html index.php;

    access_log /var/log/nginx/example.access.log main;
    error_log  /var/log/nginx/example.error.log warn;

    # 静态资源强缓存 + 关闭日志，减少磁盘写
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    # PHP 交给 PHP-FPM
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_read_timeout 300s;
    }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
}

location = / {
    # 只匹配首页
}

location ^~ /static/ {
    alias /data/static/;          # alias 会替换掉 location 前缀，root 则是拼接
    expires 7d;
}

location ~* \.(gif|jpg|jpeg|png|webp)$ {
    expires 30d;
    add_header Cache-Control "public";
}

location /api/ {
    proxy_pass http://backend/;   # 注意末尾的 / 会把 /api/ 前缀去掉
}

location / {
    try_files $uri $uri/ =404;
}

upstream backend {
    least_conn;                          # 最少连接调度
    server 127.0.0.1:8080 weight=5 max_fails=3 fail_timeout=15s;
    server 127.0.0.1:8081 weight=5 max_fails=3 fail_timeout=15s;
    keepalive 64;                        # 与后端保持的长连接数
}

server {
    listen 80;
    server_name app.example.com;

    location / {
        proxy_pass http://backend;

        proxy_http_version 1.1;
        proxy_set_header Connection "";           # 配合 keepalive，必须清空
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 5s;
        proxy_send_timeout    60s;
        proxy_read_timeout    60s;

        proxy_buffering on;
        proxy_buffer_size 8k;
        proxy_buffers 16 8k;
    }

    # WebSocket 支持
    location /ws/ {
        proxy_pass http://backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
    }
}

server {
    listen 443 ssl;
    http2 on;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305;

    ssl_session_cache shared:SSL:20m;     # 约可缓存 8 万个会话
    ssl_session_timeout 1d;
    ssl_session_tickets off;              # 关闭 ticket 更安全

    ssl_stapling on;                      # OCSP Stapling，减少客户端验证耗时
    ssl_stapling_verify on;
    resolver 8.8.8.8 1.1.1.1 valid=300s;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
}

sudo nginx -t && sudo systemctl reload nginx
curl -I https://example.com
ss -lntp | grep nginx
tail -f /var/log/nginx/error.log