Nginx 域名监听配置小技巧

Nginx 域名监听配置

1. Nginx 配置文件结构

1.1 主配置文件

/etc/nginx/
├── nginx.conf              # 主配置文件
├── conf.d/                 # 子配置文件目录(推荐)
│   ├── default.conf
│   ├── your-domain.conf
│   └── api.conf
├── sites-available/        # 可用站点配置(Ubuntu/Debian)
│   └── your-site.conf
└── sites-enabled/          # 启用站点配置(软链接)
    └── your-site.conf -> ../sites-available/your-site.conf

1.2 Nginx 如何加载配置文件

nginx.conf 主配置文件中,通过 include 指令引入子配置:

http {
    # ... 其他配置 ...
  
    # 引入 conf.d 目录下所有 .conf 文件
    include /etc/nginx/conf.d/*.conf;
  
    # 或者引入 sites-enabled 目录
    include /etc/nginx/sites-enabled/*;
}

工作原理

  1. Nginx 启动时读取 nginx.conf
  2. 遇到 include 指令,加载指定路径的配置文件
  3. 将所有配置合并成完整配置
  4. 根据 server_namelisten 进行请求路由

2. 域名监听原理

2.1 监听机制

Nginx 通过以下两个指令实现域名监听:

server {
    listen 80;                      # 监听端口(IP:端口)
    server_name example.com;        # 匹配的域名
  
    # ... 其他配置
}

匹配流程

客户端请求 http://example.com
    ↓
1. DNS 解析:example.com → 服务器IP(如:192.168.1.100)
    ↓
2. 浏览器发起请求:GET / HTTP/1.1
   Host: example.com
    ↓
3. 请求到达服务器 192.168.1.100:80
    ↓
4. Nginx 检查所有监听 80 端口的 server 块
    ↓
5. 匹配 Host 头中的域名(example.com)
    ↓
6. 找到 server_name 为 example.com 的配置块
    ↓
7. 执行对应的处理逻辑

2.2 域名匹配优先级

# 1. 精确匹配(优先级最高)
server_name example.com;

# 2. 以 * 开头的通配符
server_name *.example.com;

# 3. 以 * 结尾的通配符
server_name www.example.*;

# 4. 正则表达式匹配
server_name ~^(?<subdomain>.+)\.example\.com$;

# 5. 默认服务器(优先级最低)
server_name _;

3. 在 conf.d 目录下配置 .conf 文件

3.1 基础域名配置

创建文件:/etc/nginx/conf.d/example.com.conf

# HTTP 服务器配置
server {
    listen 80;
    server_name example.com www.example.com;
  
    # 访问日志
    access_log /var/log/nginx/example.com.access.log;
    error_log /var/log/nginx/example.com.error.log;
  
    # 网站根目录
    root /var/www/example.com;
    index index.html index.htm index.php;
  
    # 静态文件处理
    location / {
        try_files $uri $uri/ =404;
    }
  
    # PHP 处理(如果需要)
    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

3.2 HTTPS (SSL) 配置

创建文件:/etc/nginx/conf.d/example.com.ssl.conf

# HTTP 重定向到 HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
  
    # 重定向到 HTTPS
    return 301 https://$server_name$request_uri;
}

# HTTPS 服务器
server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
  
    # SSL 证书配置
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
  
    # SSL 安全配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
  
    # 日志
    access_log /var/log/nginx/example.com.ssl.access.log;
    error_log /var/log/nginx/example.com.ssl.error.log;
  
    # 网站根目录
    root /var/www/example.com;
    index index.html;
  
    location / {
        try_files $uri $uri/ =404;
    }
}

3.3 反向代理配置(博主自己的demo项目)

创建文件:/etc/nginx/conf.d/ysyk.example.com.conf

# 上游服务器配置(负载均衡)
upstream ysyk_backend {
    # 负载均衡策略
    # ip_hash;          # 根据客户端IP分配
    # least_conn;       # 最少连接数
  
    server 127.0.0.1:8080 weight=1 max_fails=3 fail_timeout=30s;
    server 127.0.0.1:8081 weight=1 max_fails=3 fail_timeout=30s;
  
    # 备用服务器
    server 127.0.0.1:8082 backup;
  
    # 保持连接
    keepalive 32;
}

# HTTP 服务
server {
    listen 80;
    server_name ysyk.example.com;
  
    # 强制 HTTPS(可选)
    return 301 https://$server_name$request_uri;
}

# HTTPS 服务
server {
    listen 443 ssl http2;
    server_name ysyk.example.com;
  
    # SSL 证书
    ssl_certificate /etc/nginx/ssl/ysyk.example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/ysyk.example.com.key;
  
    # SSL 配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
    ssl_prefer_server_ciphers on;
  
    # 日志
    access_log /var/log/nginx/ysyk.access.log main;
    error_log /var/log/nginx/ysyk.error.log warn;
  
    # 客户端上传大小限制
    client_max_body_size 100M;
    client_body_buffer_size 10M;
  
    # 超时设置
    proxy_connect_timeout 300s;
    proxy_send_timeout 300s;
    proxy_read_timeout 300s;
  
    # 静态资源
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
        root /var/www/ysyk/static;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }
  
    # API 接口
    location /api/ {
        proxy_pass http://ysyk_backend/api/;
      
        # 代理头设置
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
      
        # WebSocket 支持
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
      
        # 不缓存动态内容
        proxy_buffering off;
    }
  
    # 文件上传接口(特殊处理)
    location /api/upload/ {
        proxy_pass http://ysyk_backend/api/upload/;
      
        # 上传配置
        client_max_body_size 500M;
        client_body_timeout 300s;
      
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      
        # 超时时间
        proxy_connect_timeout 300s;
        proxy_send_timeout 300s;
        proxy_read_timeout 300s;
    }
  
    # 健康检查
    location /health {
        access_log off;
        return 200 "healthy\n";
        add_header Content-Type text/plain;
    }
  
    # 默认路由
    location / {
        proxy_pass http://ysyk_backend/;
      
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

3.4 多个子域名配置

创建文件:/etc/nginx/conf.d/subdomains.conf

# 主站
server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/main;
    index index.html;
}

# API 子域名
server {
    listen 80;
    server_name api.example.com;
  
    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

# 后台管理子域名
server {
    listen 80;
    server_name admin.example.com;
  
    # 访问控制(白名单)
    allow 192.168.1.0/24;
    deny all;
  
    root /var/www/admin;
    index index.html;
}

# 静态资源 CDN 子域名
server {
    listen 80;
    server_name static.example.com cdn.example.com;
  
    root /var/www/static;
  
    # 缓存配置
    location / {
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }
}

4. 配置步骤详解

4.1 创建配置文件

# 1. 进入 conf.d 目录
cd /etc/nginx/conf.d/

# 2. 创建配置文件
sudo nano your-domain.conf

# 3. 编写配置(参考上面的示例)

# 4. 保存文件
# Ctrl + O (保存)
# Ctrl + X (退出)

4.2 测试配置

# 测试 Nginx 配置语法是否正确
sudo nginx -t

# 如果显示以下信息,说明配置正确:
# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
# nginx: configuration file /etc/nginx/nginx.conf test is successful

4.3 重载配置

# 方法一:平滑重载(推荐,不中断服务)
sudo nginx -s reload

# 方法二:重启服务
sudo systemctl restart nginx

# 方法三:使用 service 命令
sudo service nginx reload

4.4 验证配置生效

# 1. 检查 Nginx 是否运行
sudo systemctl status nginx

# 2. 查看监听的端口
sudo netstat -tuln | grep :80
sudo netstat -tuln | grep :443

# 3. 查看当前加载的配置
sudo nginx -T

# 4. 测试域名访问
curl -I http://your-domain.com
curl -I https://your-domain.com

5. 完整配置示例(针对您的项目)

文件:/etc/nginx/conf.d/ysyk-production.conf

# 日志格式定义
log_format ysyk_log '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent" '
                    '$request_time $upstream_response_time';

# 上游服务器 - Web 服务
upstream ysyk_web_servers {
    server 127.0.0.1:8080 max_fails=3 fail_timeout=30s;
    server 127.0.0.1:8081 max_fails=3 fail_timeout=30s;
    keepalive 32;
}

# 上游服务器 - Worker 服务(如果需要暴露管理接口)
upstream ysyk_worker_servers {
    server 127.0.0.1:8090 max_fails=3 fail_timeout=30s;
    keepalive 16;
}

# 限流配置
limit_req_zone $binary_remote_addr zone=ysyk_upload:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=ysyk_api:10m rate=100r/s;

# HTTP 转 HTTPS
server {
    listen 80;
    server_name ysyk.yourdomain.com;
  
    # Let's Encrypt 证书验证
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
        default_type text/plain;
    }
  
    # 其他请求重定向到 HTTPS
    location / {
        return 301 https://$server_name$request_uri;
    }
}

# HTTPS 主服务
server {
    listen 443 ssl http2;
    server_name ysyk.yourdomain.com;
  
    # ========== SSL 配置 ==========
    ssl_certificate /etc/nginx/ssl/ysyk.crt;
    ssl_certificate_key /etc/nginx/ssl/ysyk.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;
  
    # HSTS(可选)
    add_header Strict-Transport-Security "max-age=63072000" always;
  
    # ========== 安全头 ==========
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
  
    # ========== 日志 ==========
    access_log /var/log/nginx/ysyk.access.log ysyk_log;
    error_log /var/log/nginx/ysyk.error.log warn;
  
    # ========== 基础配置 ==========
    charset utf-8;
    client_max_body_size 100M;
    client_body_buffer_size 10M;
  
    # ========== Gzip 压缩 ==========
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript 
               application/json application/javascript application/xml+rss;
  
    # ========== 静态资源 ==========
    location ~* \.(jpg|jpeg|png|gif|ico|svg|webp)$ {
        root /var/www/ysyk/static/images;
        expires 30d;
        add_header Cache-Control "public, immutable";
        access_log off;
    }
  
    location ~* \.(css|js)$ {
        root /var/www/ysyk/static;
        expires 7d;
        add_header Cache-Control "public, must-revalidate";
    }
  
    location ~* \.(woff|woff2|ttf|eot)$ {
        root /var/www/ysyk/static/fonts;
        expires 1y;
        add_header Cache-Control "public, immutable";
        add_header Access-Control-Allow-Origin *;
        access_log off;
    }
  
    # ========== 业务接口 ==========
  
    # API 接口(限流)
    location /api/ {
        limit_req zone=ysyk_api burst=20 nodelay;
      
        proxy_pass http://ysyk_web_servers;
        proxy_http_version 1.1;
      
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Connection "";
      
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
      
        proxy_buffer_size 4k;
        proxy_buffers 8 4k;
        proxy_busy_buffers_size 8k;
    }
  
    # 文件上传接口(特殊处理 + 限流)
    location /api/upload {
        limit_req zone=ysyk_upload burst=5 nodelay;
      
        client_max_body_size 500M;
        client_body_timeout 600s;
      
        proxy_pass http://ysyk_web_servers;
        proxy_http_version 1.1;
      
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      
        proxy_connect_timeout 600s;
        proxy_send_timeout 600s;
        proxy_read_timeout 600s;
      
        # 关闭代理缓冲,实时传输
        proxy_buffering off;
        proxy_request_buffering off;
    }
  
    # Worker 管理接口(需要认证)
    location /worker/ {
        # IP 白名单
        allow 192.168.1.0/24;
        allow 10.0.0.0/8;
        deny all;
      
        proxy_pass http://ysyk_worker_servers/;
      
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
  
    # 健康检查
    location /health {
        access_log off;
        return 200 "healthy\n";
        add_header Content-Type text/plain;
    }
  
    # 前端页面
    location / {
        root /var/www/ysyk/html;
        index index.html index.htm;
        try_files $uri $uri/ /index.html;
    }
  
    # 错误页面
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;
  
    location = /50x.html {
        root /usr/share/nginx/html;
    }
}

# Worker 管理后台(独立子域名)
server {
    listen 443 ssl http2;
    server_name worker-admin.yourdomain.com;
  
    ssl_certificate /etc/nginx/ssl/worker-admin.crt;
    ssl_certificate_key /etc/nginx/ssl/worker-admin.key;
  
    # IP 白名单
    allow 192.168.1.0/24;
    deny all;
  
    access_log /var/log/nginx/worker-admin.access.log;
    error_log /var/log/nginx/worker-admin.error.log;
  
    location / {
        proxy_pass http://ysyk_worker_servers;
      
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

6. 常见问题排查

6.1 配置不生效

# 1. 检查配置文件是否被 include
sudo nginx -T | grep "your-domain.conf"

# 2. 检查配置语法
sudo nginx -t

# 3. 重载配置
sudo nginx -s reload

# 4. 查看错误日志
sudo tail -f /var/log/nginx/error.log

6.2 域名无法访问

# 1. 检查 DNS 解析
nslookup your-domain.com
dig your-domain.com

# 2. 检查端口是否监听
sudo netstat -tuln | grep :80

# 3. 检查防火墙
sudo firewall-cmd --list-all
sudo iptables -L -n

# 4. 测试本地访问
curl -H "Host: your-domain.com" http://127.0.0.1/

6.3 502 Bad Gateway

# 1. 检查后端服务是否运行
sudo systemctl status your-backend-service

# 2. 检查后端端口
netstat -tuln | grep :8080

# 3. 测试后端连通性
curl http://127.0.0.1:8080

# 4. 查看 Nginx 错误日志
sudo tail -f /var/log/nginx/error.log

7. 最佳实践

7.1 配置文件命名规范

# 推荐命名方式:
域名.conf          # example.com.conf
域名-用途.conf     # api.example.com.conf
项目-环境.conf     # ysyk-production.conf

7.2 配置文件管理

# 版本控制
cd /etc/nginx
sudo git init
sudo git add conf.d/*
sudo git commit -m "Initial nginx config"

# 备份配置
sudo cp -r /etc/nginx/conf.d /etc/nginx/conf.d.backup.$(date +%Y%m%d)

# 回滚配置
sudo cp -r /etc/nginx/conf.d.backup.20251028/* /etc/nginx/conf.d/
sudo nginx -t && sudo nginx -s reload

7.3 安全建议

# 隐藏 Nginx 版本
http {
    server_tokens off;
}

# 限制请求方法
if ($request_method !~ ^(GET|POST|PUT|DELETE|OPTIONS)$ ) {
    return 405;
}

# 防止目录遍历
location / {
    autoindex off;
}

# 禁止访问隐藏文件
location ~ /\. {
    deny all;
}

8. 总结

Nginx 监听域名的核心步骤:

  1. DNS 解析:域名解析到服务器 IP
  2. 端口监听listen 80listen 443
  3. 域名匹配server_name your-domain.com
  4. 请求路由:根据 location 规则处理请求

配置文件生效流程:

创建 .conf 文件 → 测试语法 → 重载配置 → 验证访问

记住这个命令序列:

sudo nano /etc/nginx/conf.d/your-domain.conf
sudo nginx -t
sudo nginx -s reload
curl -I http://your-domain.com
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值