nginx案例

运维

nginx案例

案例一:仅托管静态资源

适合纯静态的网站

本案例展示如何配置 Nginx 作为静态文件服务器。同时监听 HTTP（80）和 HTTPS（443）端口，为前端项目提供直接访问。root 指令指定静态文件的根目录，index index.html 指定默认首页。location ^~ /.well-known/acme-challenge/ 用于 Let's Encrypt 证书自动续签的验证路径。SSL 部分配置了证书路径、会话缓存、加密套件和协议版本，确保 HTTPS 安全访问。

server {
    listen       80;
    listen  [::]:80;
    server_name  cos.display.anyi.space;
    client_max_body_size 1024m;

    location ^~ /.well-known/acme-challenge/ {
	root /home/nginx/www/;
    }

    location / {
        root /home/nginx/www/cos/dist/;
        index index.html;
    }


    # redirect server error pages to the static page /50x.html
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   html;
    }
}

 server{
     listen 443 ssl;
     server_name cos.display.anyi.space;
    
     ssl_certificate /etc/letsencrypt/live/cos.display.anyi.space/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/cos.display.anyi.space/privkey.pem;
    
     ssl_session_cache shared:SSL:1m;
     ssl_session_timeout 5m;
    
     ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
     ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;

     ssl_prefer_server_ciphers on;

     location / {
         root /home/nginx/www/cos/dist/;
         index index.html;
     }

 }

案例二:前后端分离项目

适合常规的项目

案例演示了前后端分离架构下的 Nginx 配置。前端静态资源由 Nginx 直接托管（location / 下的 root 和 try_files），后端 API 请求通过反向代理转发给运行在 127.0.0.1:8001 的服务。upstream 定义后端服务器组，location /api/ 中使用 proxy_pass 将 /api/ 前缀的请求转发给后端，并设置了超时和文件大小限制。注意注释掉的 rewrite 可用于去除 /prod-api 前缀。SSL 配置同样提供了 HTTPS 支持。

upstream gditLibraryServer{
        server 127.0.0.1:8001;
    }

server {
    listen       80;
    listen  [::]:80;
    server_name  gditlibrary.display.anyi.space;
    client_max_body_size 1024m;

    location ^~ /.well-known/acme-challenge/ {
        root /home/nginx/www/;
    }

    location /api/ {
                proxy_pass http://gditLibraryServer/;
                proxy_set_header HOST $host;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Server $host;
		proxy_connect_timeout    10;
                proxy_send_timeout        30;
                proxy_read_timeout        30;
                client_max_body_size    100m;
            #	rewrite ^/prod-api(.*) $1 break;

            }

	    
    location / {
        root /home/nginx/www/gdit_library;
	try_files $uri $uri/ /index.html;
        index index.html;
    }


    # redirect server error pages to the static page /50x.html
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   html;
    }
}

 server{
     listen 443 ssl;
     server_name gditlibrary.display.anyi.space;
    
     ssl_certificate /etc/letsencrypt/live/gditlibrary.display.anyi.space/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/gditlibrary.display.anyi.space/privkey.pem;
    
     ssl_session_cache shared:SSL:1m;
     ssl_session_timeout 5m;
    
     ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
     ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;

     ssl_prefer_server_ciphers on;

     location /api/ {
                 proxy_pass http://gditLibraryServer/;
                 proxy_set_header HOST $host;
                 proxy_set_header X-Forwarded-Proto $scheme;
                 proxy_set_header X-Real-IP $remote_addr;
                 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Server $host;
		proxy_connect_timeout    10;
                proxy_send_timeout        30;
                proxy_read_timeout        30;
                client_max_body_size    100m;
            #	rewrite ^/prod-api(.*) $1 break;
             }

    location / {
        root /home/nginx/www/gdit_library;
	try_files $uri $uri/ /index.html;
        index index.html;
     }

 }

案例三:多级nginx反向代理

需要流量中转的场景，例如服务器在国外，国内访问比较慢，在香港搭建一个nginx用于中转流量能够提高用户的体验

该案例展示了两层 Nginx 的链式代理。外层 Nginx（接近用户）监听 blog.anyi.space，并将所有请求通过 proxy_pass https://halo2Server 转发给内层 Nginx。注意 proxy_set_header HOST halo.service.anyi.space 强制设置 Host 头为内层服务的域名，确保内层能正确匹配 server_name。SSL 部分配置了证书，并且为长连接设置了较长的超时（proxy_read_timeout 300s）。

graph LR
    User[用户] -->|访问 blog.aTBnyi.space| Nginx1[外层 Nginx\nblog.anyi.space]
    Nginx1 -->|反向代理\nhttps://halo.service.anyi.space:443| Nginx2[内层 Nginx\nhalo.service.anyi.space]
    Nginx2 -->|反向代理\nhttp://127.0.0.1:8090| Backend[后端服务\nHalo]

外层的nginx（最接近用户）

upstream halo2Server{
        server halo.service.anyi.space:443;
    }

server {
    listen       80;
    listen  [::]:80;
    server_name  blog.anyi.space;
    client_max_body_size 1024m;

    location ^~ /.well-known/acme-challenge/ {
        root /home/nginx/www/;
    }

    location / {
        proxy_pass https://halo2Server;
        proxy_set_header HOST halo.service.anyi.space;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }


    # redirect server error pages to the static page /50x.html
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   html;
    }

}


server{
    listen 443 ssl;
    server_name blog.anyi.space;
    client_max_body_size 1024m;
    
    ssl_certificate /etc/letsencrypt/live/blog.anyi.space/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/blog.anyi.space/privkey.pem;
    
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout 5m;
    
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;

    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass https://halo2Server;
        # add_header Access-Control-Allow-Origin * always;
        proxy_set_header HOST halo.service.anyi.space;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 300s;  # 设为1小时或更长
        proxy_send_timeout 300s;
    }

}

内层的nginx（直接反向代理到服务）

upstream haloServer{
        server 127.0.0.1:8090;
    }

server {
    listen       80;
    listen  [::]:80;
    server_name  halo.service.anyi.space;
    client_max_body_size 1024m;
	
    #allow 38.76.189.190;

    location ^~ /.well-known/acme-challenge/ {
        root /home/nginx/www/;
    }


    location / {
        proxy_pass http://haloServer;
        proxy_set_header HOST $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }


    # redirect server error pages to the static page /50x.html
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   html;
    }
}

server{
    listen 443 ssl;
    server_name halo.service.anyi.space;
    
    #allow 38.76.189.190;
    
    ssl_certificate /etc/letsencrypt/live/halo.service.anyi.space/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/halo.service.anyi.space/privkey.pem;
    
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout 5m;
    
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;

    ssl_prefer_server_ciphers on;


    location / {
        proxy_pass http://haloServer;
        proxy_set_header HOST $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

If you find the article useful, feel free to appreciate

原创

nginx案例

https://blog.anyi.space/archives/019e8cf4-9c0a-7397-8194-a04057213481

Author

杨逸

Published on

2026-09-02

Updated on

2026-06-03

License

CC BY 4.0

nginx案例

nginx案例

案例一:仅托管静态资源

案例二:前后端分离项目

案例三:多级nginx反向代理

Author

Published on

Updated on

License

Comments