nginx1.10.3一键安装/系统内核优化/配置文件优化/https/日志切割

Posted 2020-08-30

下面的是一键安装nginx 1.10.3 最新稳定版本，编译参数是官方推荐的。

yum groupinstall "Development Tools"   -y
yum  install wget   zlib-devel openssl-devel pcre-devel -y
cd /usr/local/src
wget http://nginx.org/download/nginx-1.10.3.tar.gz
tar zxvf nginx-1.10.3.tar.gz
cd nginx-1.10.3
groupadd -g 58 nginx
useradd -u 58 -g 58 -M nginx -s /sbin/nologin
mkdir -p /var/tmp/nginx/{client,proxy,fastcgi,uwsgi,scgi}
mkdir -p /var/cache/nginx/client_temp
./configure --user=nginx --group=nginx --prefix=/etc/nginx   --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-threads --with-stream --with-stream_ssl_module --with-http_slice_module --with-mail --with-mail_ssl_module --with-file-aio --with-http_v2_module --with-ipv6
make && make install
nginx -V
 
 
Centos7 启动方式

cat  >> /lib/systemd/system/nginx.service  <<EOF
[Unit]
Description=nginx - high performance web server
Documentation=http://nginx.org/en/docs/
After=network.target remote-fs.target nss-lookup.target
  
[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t -c /etc/nginx/nginx.conf
ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true
  
[Install]
WantedBy=multi-user.target
EOF



systemctl enable nginx.service
systemctl start  nginx.service
netstat -lntup  | grep 80

内核优化  

cat   >>  /etc/sysctl.conf << EOF
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rmem = 4096        87380   4194304
net.ipv4.tcp_wmem = 4096        16384   4194304
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 262144
net.core.somaxconn = 262144
net.ipv4.tcp_max_orphans = 3276800
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_fin_timeout = 1
net.ipv4.tcp_keepalive_time = 30
net.ipv4.ip_local_port_range = 1024    6500
EOF

sysctl -p
cd /etc/nginx/
mv ngingx.conf nginx.conf.bak

配置文件优化，启用HTTPS

cat >> nginx.conf << EOF
user  nginx nginx;
worker_processes  auto;
worker_rlimit_nofile 65535;

error_log  /var/log/nginx/error.log  info;
pid        /var/run/nginx.pid;

events {
    use epoll;
    worker_connections 10240;
    multi_accept on;
}

http
    {
    include       mime.types;
    default_type  application/octet-stream;

    charset  utf-8;

    log_format  main  ‘$remote_addr - $remote_user [$time_local] "$request" ‘
                      ‘$status $body_bytes_sent "$http_referer" ‘
                      ‘"$http_user_agent" "$http_x_forwarded_for"‘;

    access_log  /var/log/nginx/access.log  main;

    server_names_hash_bucket_size 128;
    client_header_buffer_size 16k;
    large_client_header_buffers 4 16k;
    client_max_body_size 50m;

    server_tokens off;
    autoindex off;

    sendfile on;
    tcp_nopush     on;

    keepalive_timeout 60;
    tcp_nodelay  on;
    client_header_timeout 15;
    reset_timedout_connection on;
    client_body_timeout 15;
    send_timeout 15;

  
    
    fastcgi_intercept_errors on;

    fastcgi_connect_timeout 300;
    fastcgi_send_timeout 300;
    fastcgi_read_timeout 300;
    fastcgi_buffer_size 16k;
    fastcgi_buffers 16 16k;
    fastcgi_busy_buffers_size 16k;
    fastcgi_temp_file_write_size 16k;

    fastcgi_cache_path /etc/nginx/fastcgi_cache levels=1:2
                    keys_zone=TEST:10m
                    inactive=5m;

    fastcgi_cache TEST;
    fastcgi_cache_valid 200 302 1h;
    fastcgi_cache_valid 301 1d;
    fastcgi_cache_valid any 1m;
    fastcgi_cache_min_uses 1;
    fastcgi_cache_use_stale error timeout invalid_header http_500;
    fastcgi_cache_key "$request_method://$host$request_uri";

    open_file_cache max=204800 inactive=20s;
    open_file_cache_min_uses 1;
    open_file_cache_valid 30s;

    gzip on;
    gzip_min_length  1k;
    gzip_buffers     4 16k;
    gzip_http_version 1.1;
    gzip_comp_level 5;
    gzip_types       text/css application/javascript  text/xml;
    gzip_vary on;
    gzip_disable "MSIE [1-6].(?!.*SV1)";


    server
        {
        listen       80;
        server_name  hequan.lol;
        index index.php index.html  index.htm;
        root html;

        return         301 https://$server_name$request_uri;

    }

    server {
        listen 443  ssl;
        server_name hequan.lol;
        index index.html index.htm index.php default.html default.htm default.php;

        root  html;

        ssl on;
        ssl_certificate      /etc/nginx/key/1_www.hequan.lol_bundle.crt;
        ssl_certificate_key  /etc/nginx/key/2_www.hequan.lol.key;

        ssl_ciphers "EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5";
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;

        location /status
            {
            stub_status on;
            access_log off;
            #allow 127.0.0.1;
            #deny all;
        }

        error_page  400 401 402 403 404  /40x.html;
        location = /40x.html {
                root  html;
                index  index.html index.htm;
        }

        error_page  500 501 502 503 504  /50x.html;
        location = /50x.html {
            root  html;
            index  index.html index.htm;
        }

        
        location ~ \.php$ {
            root           html;
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME  /etc/nginx/html$fastcgi_script_name;
            include        fastcgi_params;
        }

        location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
            {
            expires 30d;
        }

        location ~ .*\.(js|css)?$
            {
            expires 12h;
        }
    }
}

EOF


日志切割

cat >> log.sh <<EOF
#!/bin/bash
path=/var/log/nginx/backup
if [ ! -d  "#path"  ]; then
    mkdir -p $path
fi
cd  /var/log/nginx
mv access.log   backup/$(date +%F -d -1day).log
systemctl reload  nginx.service
EOF


crontab -e
00 00 * * * /var/log/nginx/log.sh  > /dev/null 2&1

---

关于证书  可以去

https://console.qcloud.com/ssl/apply  (有效期一年) 申请，非常简单。腾讯认证的。跟着流程走，几分钟就好。

ssl_certificate      /etc/nginx/key/1_www.hequan.lol_bundle.crt;   
ssl_certificate_key  /etc/nginx/key/2_www.hequan.lol.key;

上面一个是证书，一个是密钥。自定义目录。

---

以上设置仅供参考。欢迎提出有疑问的地方。

本文出自 “何全” 博客，请务必保留此出处http://hequan.blog.51cto.com/5701886/1895932