CentOS 7 Nginx 使用示例

容器云技术

1. 使用yum安装Nginx

1
2
3
yum install -y epel-release
yum makecache fast
yum install -y nginx

2. 配置Nginx，这里仅提供一个七层HTTP代理的示例，实际中请根据需要修改

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
# （1）HTTP代理
# 新建配置文件 /etc/nginx/conf.d/remote_xxx.conf

upstream remote-xxx {
    server x.x.x.x:43747;
}

server {
    listen 43747;
    server_name 111.206.120.158;
    access_log  /var/log/nginx/remote-xxx-access.log  main;
    error_log /var/log/nginx/remote-xxx-error.log;
    add_header Cache-Control no-cache;

    location / {
        proxy_pass http://remote-xxx/;
        proxy_http_version 1.1;
        proxy_connect_timeout 30m;
        proxy_send_timeout 30m;
        proxy_read_timeout 30m;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_buffering off;
    }
}

# （2）HTTPS代理
# 在 /etc/nginx/nginx.conf 中配置SSL证书
。。。。。。
http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;
    ssl_certificate /data/demo/ssl/3838460__xesv5.com.pem;  # 指定证书的位置，绝对路径
    ssl_certificate_key /data/demo/ssl/3838460__xesv5.com.key;  # 绝对路径，同上
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #按照这个协议配置
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;#按照这个套件配置
    ssl_prefer_server_ciphers on;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;
。。。。。。


# 新建配置文件 /etc/nginx/conf.d/xxx_xx_ssl.conf
upstream xxx-xx {
    server x.x.x.x:6088;
}

server {
    listen 0.0.0.0:9606 ssl;
    server_name xxx-xx;
    access_log  /var/log/nginx/xxx-xx-access.log  main;
    error_log /var/log/nginx/xxx-xx-error.log;

    location / {
        proxy_pass http://xxx-xx/;
        proxy_http_version 1.1;
        proxy_connect_timeout 30m;
        proxy_send_timeout 30m;
        proxy_read_timeout 30m;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
    }
}

# （3）TCP代理
# 在 /etc/nginx/nginx.conf 配置同时可以使用http和stream
。。。。。。
http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;
    ssl_certificate /data/demo/ssl/3838460__xesv5.com.pem;  # 指定证书的位置，绝对路径
    ssl_certificate_key /data/demo/ssl/3838460__xesv5.com.key;  # 绝对路径，同上
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #按照这个协议配置
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;#按照这个套件配置
    ssl_prefer_server_ciphers on;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/http_*.conf;
。。。。。。

stream {
    include /etc/nginx/conf.d/stream_*.conf;
}

# 新建配置文件 /etc/nginx/conf.d/stream_prom_snmp.conf
upstream backend1 {
    server 192.168.112.130:41782 max_fails=3 fail_timeout=30s;
}

server {
    listen 41782;
    proxy_connect_timeout 1s;
    proxy_timeout 3s;
    proxy_pass backend1;
}

# （4）UDP代理
# 在 /etc/nginx/nginx.conf 配置同时可以使用http和stream
。。。。。。
http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;
    ssl_certificate /data/demo/ssl/3838460__xesv5.com.pem;  # 指定证书的位置，绝对路径
    ssl_certificate_key /data/demo/ssl/3838460__xesv5.com.key;  # 绝对路径，同上
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #按照这个协议配置
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;#按照这个套件配置
    ssl_prefer_server_ciphers on;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/http_*.conf;
。。。。。。

stream {
    include /etc/nginx/conf.d/stream_*.conf;
}

# 新建配置文件 /etc/nginx/conf.d/stream_core_dns.conf
upstream backend2 {
    server 192.168.112.130:31857 max_fails=3 fail_timeout=30s;
}

server {
    listen 53 udp;
    proxy_connect_timeout 1s;
    proxy_timeout 3s;
    proxy_pass backend2;
}

4. 启动Nginx

1
2
systemctl start nginx.service
systemctl status nginx.service

5. 参考资料

https://blog.csdn.net/weixin_44723434/article/details/97809824
http://nginx.org/en/docs/stream/ngx_stream_core_module.html
http://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_connect_timeout