一安装nginx
yum install nginx.x86_64
二配置 nginx conf
1.反向代理+负载均衡：
server {
listen 80 ;
server_name api.abc.com apc.aaa.com;
charset UTF-8;
location / {
proxy_pass http://api;#调用负载均衡upstream api
#proxy_pass http://127.0.0.1:8010 这个效果一样 只是反向代理
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
upstream api{
server 127.0.0.1:8010 weight=1 max_fails=2 fail_timeout=600s;
#server 10.121.121.5:8083 weight=1 max_fails=2 fail_timeout=600s;
}
2.静态网页转发
2.1简单 server {
listen 80 ;
server_name ancxx.com;
charset UTF-8;
root /website/abcxx;
location /{
index index.html;}
error_page 500 502 503 504 /50x.html;
location = /50x.html { root html; }
}
2.2 加点盐
server {
listen 80 ;
server_name admincy.abc.com;
charset UTF-8;
root /website/cy/admin/;
client_max_body_size 200m;
location / {
index index.html;
try_files $uri $uri/ /index.html;
}
location /api/admin/admin {
proxy_pass http://amanagerapi.abc.com/admin;
}
location /api/restaurant/admin {
proxy_pass http://amanagerapi.abc.com/restaurant;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {root html; }
}
3 https配置
3.1 简化
server{
listen 443
#开启 如果把ssl on；这行去掉，ssl写在443端口后面。这样http和https的链接都可以用
ssl on;
ssl_certificate cert/server.crt;#证书(公钥.发送到客户端的，在/etc/nginx/cert/下)
ssl_certificate_key cert/server.key;#私钥,
server_name www.daj.com;#下面是绑定域名
location / {
proxy_redirect off; #禁止跳转
proxy_pass https://www.tao.com/;#代理淘宝}
}
3.2 项目实例
server {
listen 443;
server_name qh.abc.com;
ssl on;
ssl_certificate cert/server.pem;
ssl_certificate_key cert/server.key;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
charset UTF-8;
location / {
proxy_pass http://qh;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
upstream qh{
server 127.0.0.1:8001 weight=1 max_fails=2 fail_timeout=600s;
#server 10.121.121.5:8083 weight=1 max_fails=2 fail_timeout=600s;
}
三 生成证书
注意：一般生成的目录,应该放在nginx/conf/ssl目录
1.创建服务器证书密钥文件 server.key：
openssl genrsa -des3 -out server.key 1024
输入密码，确认密码，自己随便定义，但是要记住，后面会用到。
2.创建服务器证书的申请文件 server.csr
openssl req -new -key server.key -out server.csr
输出内容为：
Enter pass phrase for root.key: ← 输入前面创建的密码
Country Name (2 letter code) [AU]:CN ← 国家代号，中国输入CN
State or Province Name (full name) [Some-State]:BeiJing ← 省的全名，拼音
Locality Name (eg, city) []:BeiJing ← 市的全名，拼音
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名
Organizational Unit Name (eg, section) []: ← 可以不输入
Common Name (eg, YOUR name) []: ← 此时不输入
Email Address []:admin@mycompany.com ← 电子邮箱，可随意填
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: ← 可以不输入
An optional company name []: ← 可以不输入
4.备份一份服务器密钥文件
cp server.key server.key.org
5.去除文件口令
openssl rsa -in server.key.org -out server.key
6.生成证书文件server.crt
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
#小程序不支持自签名的https！！
也可以通过第三方证书机构申请 key和pem
网友评论