Nginx 域名监听配置
1. Nginx 配置文件结构
1.1 主配置文件
/etc/nginx/
├── nginx.conf # 主配置文件
├── conf.d/ # 子配置文件目录(推荐)
│ ├── default.conf
│ ├── your-domain.conf
│ └── api.conf
├── sites-available/ # 可用站点配置(Ubuntu/Debian)
│ └── your-site.conf
└── sites-enabled/ # 启用站点配置(软链接)
└── your-site.conf -> ../sites-available/your-site.conf
1.2 Nginx 如何加载配置文件
在 nginx.conf 主配置文件中,通过 include 指令引入子配置:
http {
# ... 其他配置 ...
# 引入 conf.d 目录下所有 .conf 文件
include /etc/nginx/conf.d/*.conf;
# 或者引入 sites-enabled 目录
include /etc/nginx/sites-enabled/*;
}
工作原理:
- Nginx 启动时读取
nginx.conf - 遇到
include指令,加载指定路径的配置文件 - 将所有配置合并成完整配置
- 根据
server_name和listen进行请求路由
2. 域名监听原理
2.1 监听机制
Nginx 通过以下两个指令实现域名监听:
server {
listen 80; # 监听端口(IP:端口)
server_name example.com; # 匹配的域名
# ... 其他配置
}
匹配流程:
客户端请求 http://example.com
↓
1. DNS 解析:example.com → 服务器IP(如:192.168.1.100)
↓
2. 浏览器发起请求:GET / HTTP/1.1
Host: example.com
↓
3. 请求到达服务器 192.168.1.100:80
↓
4. Nginx 检查所有监听 80 端口的 server 块
↓
5. 匹配 Host 头中的域名(example.com)
↓
6. 找到 server_name 为 example.com 的配置块
↓
7. 执行对应的处理逻辑
2.2 域名匹配优先级
# 1. 精确匹配(优先级最高)
server_name example.com;
# 2. 以 * 开头的通配符
server_name *.example.com;
# 3. 以 * 结尾的通配符
server_name www.example.*;
# 4. 正则表达式匹配
server_name ~^(?<subdomain>.+)\.example\.com$;
# 5. 默认服务器(优先级最低)
server_name _;
3. 在 conf.d 目录下配置 .conf 文件
3.1 基础域名配置
创建文件:/etc/nginx/conf.d/example.com.conf
# HTTP 服务器配置
server {
listen 80;
server_name example.com www.example.com;
# 访问日志
access_log /var/log/nginx/example.com.access.log;
error_log /var/log/nginx/example.com.error.log;
# 网站根目录
root /var/www/example.com;
index index.html index.htm index.php;
# 静态文件处理
location / {
try_files $uri $uri/ =404;
}
# PHP 处理(如果需要)
location ~ \.php$ {
fastcgi_pass unix:/var/run/php-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
3.2 HTTPS (SSL) 配置
创建文件:/etc/nginx/conf.d/example.com.ssl.conf
# HTTP 重定向到 HTTPS
server {
listen 80;
server_name example.com www.example.com;
# 重定向到 HTTPS
return 301 https://$server_name$request_uri;
}
# HTTPS 服务器
server {
listen 443 ssl http2;
server_name example.com www.example.com;
# SSL 证书配置
ssl_certificate /etc/nginx/ssl/example.com.crt;
ssl_certificate_key /etc/nginx/ssl/example.com.key;
# SSL 安全配置
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
# 日志
access_log /var/log/nginx/example.com.ssl.access.log;
error_log /var/log/nginx/example.com.ssl.error.log;
# 网站根目录
root /var/www/example.com;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}
3.3 反向代理配置(博主自己的demo项目)
创建文件:/etc/nginx/conf.d/ysyk.example.com.conf
# 上游服务器配置(负载均衡)
upstream ysyk_backend {
# 负载均衡策略
# ip_hash; # 根据客户端IP分配
# least_conn; # 最少连接数
server 127.0.0.1:8080 weight=1 max_fails=3 fail_timeout=30s;
server 127.0.0.1:8081 weight=1 max_fails=3 fail_timeout=30s;
# 备用服务器
server 127.0.0.1:8082 backup;
# 保持连接
keepalive 32;
}
# HTTP 服务
server {
listen 80;
server_name ysyk.example.com;
# 强制 HTTPS(可选)
return 301 https://$server_name$request_uri;
}
# HTTPS 服务
server {
listen 443 ssl http2;
server_name ysyk.example.com;
# SSL 证书
ssl_certificate /etc/nginx/ssl/ysyk.example.com.crt;
ssl_certificate_key /etc/nginx/ssl/ysyk.example.com.key;
# SSL 配置
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers on;
# 日志
access_log /var/log/nginx/ysyk.access.log main;
error_log /var/log/nginx/ysyk.error.log warn;
# 客户端上传大小限制
client_max_body_size 100M;
client_body_buffer_size 10M;
# 超时设置
proxy_connect_timeout 300s;
proxy_send_timeout 300s;
proxy_read_timeout 300s;
# 静态资源
location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
root /var/www/ysyk/static;
expires 30d;
add_header Cache-Control "public, immutable";
}
# API 接口
location /api/ {
proxy_pass http://ysyk_backend/api/;
# 代理头设置
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# WebSocket 支持
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# 不缓存动态内容
proxy_buffering off;
}
# 文件上传接口(特殊处理)
location /api/upload/ {
proxy_pass http://ysyk_backend/api/upload/;
# 上传配置
client_max_body_size 500M;
client_body_timeout 300s;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# 超时时间
proxy_connect_timeout 300s;
proxy_send_timeout 300s;
proxy_read_timeout 300s;
}
# 健康检查
location /health {
access_log off;
return 200 "healthy\n";
add_header Content-Type text/plain;
}
# 默认路由
location / {
proxy_pass http://ysyk_backend/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
3.4 多个子域名配置
创建文件:/etc/nginx/conf.d/subdomains.conf
# 主站
server {
listen 80;
server_name example.com www.example.com;
root /var/www/main;
index index.html;
}
# API 子域名
server {
listen 80;
server_name api.example.com;
location / {
proxy_pass http://localhost:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}
# 后台管理子域名
server {
listen 80;
server_name admin.example.com;
# 访问控制(白名单)
allow 192.168.1.0/24;
deny all;
root /var/www/admin;
index index.html;
}
# 静态资源 CDN 子域名
server {
listen 80;
server_name static.example.com cdn.example.com;
root /var/www/static;
# 缓存配置
location / {
expires 1y;
add_header Cache-Control "public, immutable";
access_log off;
}
}
4. 配置步骤详解
4.1 创建配置文件
# 1. 进入 conf.d 目录
cd /etc/nginx/conf.d/
# 2. 创建配置文件
sudo nano your-domain.conf
# 3. 编写配置(参考上面的示例)
# 4. 保存文件
# Ctrl + O (保存)
# Ctrl + X (退出)
4.2 测试配置
# 测试 Nginx 配置语法是否正确
sudo nginx -t
# 如果显示以下信息,说明配置正确:
# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
# nginx: configuration file /etc/nginx/nginx.conf test is successful
4.3 重载配置
# 方法一:平滑重载(推荐,不中断服务)
sudo nginx -s reload
# 方法二:重启服务
sudo systemctl restart nginx
# 方法三:使用 service 命令
sudo service nginx reload
4.4 验证配置生效
# 1. 检查 Nginx 是否运行
sudo systemctl status nginx
# 2. 查看监听的端口
sudo netstat -tuln | grep :80
sudo netstat -tuln | grep :443
# 3. 查看当前加载的配置
sudo nginx -T
# 4. 测试域名访问
curl -I http://your-domain.com
curl -I https://your-domain.com
5. 完整配置示例(针对您的项目)
文件:/etc/nginx/conf.d/ysyk-production.conf
# 日志格式定义
log_format ysyk_log '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" '
'$request_time $upstream_response_time';
# 上游服务器 - Web 服务
upstream ysyk_web_servers {
server 127.0.0.1:8080 max_fails=3 fail_timeout=30s;
server 127.0.0.1:8081 max_fails=3 fail_timeout=30s;
keepalive 32;
}
# 上游服务器 - Worker 服务(如果需要暴露管理接口)
upstream ysyk_worker_servers {
server 127.0.0.1:8090 max_fails=3 fail_timeout=30s;
keepalive 16;
}
# 限流配置
limit_req_zone $binary_remote_addr zone=ysyk_upload:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=ysyk_api:10m rate=100r/s;
# HTTP 转 HTTPS
server {
listen 80;
server_name ysyk.yourdomain.com;
# Let's Encrypt 证书验证
location ^~ /.well-known/acme-challenge/ {
root /var/www/letsencrypt;
default_type text/plain;
}
# 其他请求重定向到 HTTPS
location / {
return 301 https://$server_name$request_uri;
}
}
# HTTPS 主服务
server {
listen 443 ssl http2;
server_name ysyk.yourdomain.com;
# ========== SSL 配置 ==========
ssl_certificate /etc/nginx/ssl/ysyk.crt;
ssl_certificate_key /etc/nginx/ssl/ysyk.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
# HSTS(可选)
add_header Strict-Transport-Security "max-age=63072000" always;
# ========== 安全头 ==========
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
# ========== 日志 ==========
access_log /var/log/nginx/ysyk.access.log ysyk_log;
error_log /var/log/nginx/ysyk.error.log warn;
# ========== 基础配置 ==========
charset utf-8;
client_max_body_size 100M;
client_body_buffer_size 10M;
# ========== Gzip 压缩 ==========
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css text/xml text/javascript
application/json application/javascript application/xml+rss;
# ========== 静态资源 ==========
location ~* \.(jpg|jpeg|png|gif|ico|svg|webp)$ {
root /var/www/ysyk/static/images;
expires 30d;
add_header Cache-Control "public, immutable";
access_log off;
}
location ~* \.(css|js)$ {
root /var/www/ysyk/static;
expires 7d;
add_header Cache-Control "public, must-revalidate";
}
location ~* \.(woff|woff2|ttf|eot)$ {
root /var/www/ysyk/static/fonts;
expires 1y;
add_header Cache-Control "public, immutable";
add_header Access-Control-Allow-Origin *;
access_log off;
}
# ========== 业务接口 ==========
# API 接口(限流)
location /api/ {
limit_req zone=ysyk_api burst=20 nodelay;
proxy_pass http://ysyk_web_servers;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Connection "";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
proxy_buffer_size 4k;
proxy_buffers 8 4k;
proxy_busy_buffers_size 8k;
}
# 文件上传接口(特殊处理 + 限流)
location /api/upload {
limit_req zone=ysyk_upload burst=5 nodelay;
client_max_body_size 500M;
client_body_timeout 600s;
proxy_pass http://ysyk_web_servers;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_connect_timeout 600s;
proxy_send_timeout 600s;
proxy_read_timeout 600s;
# 关闭代理缓冲,实时传输
proxy_buffering off;
proxy_request_buffering off;
}
# Worker 管理接口(需要认证)
location /worker/ {
# IP 白名单
allow 192.168.1.0/24;
allow 10.0.0.0/8;
deny all;
proxy_pass http://ysyk_worker_servers/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
# 健康检查
location /health {
access_log off;
return 200 "healthy\n";
add_header Content-Type text/plain;
}
# 前端页面
location / {
root /var/www/ysyk/html;
index index.html index.htm;
try_files $uri $uri/ /index.html;
}
# 错误页面
error_page 404 /404.html;
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
}
# Worker 管理后台(独立子域名)
server {
listen 443 ssl http2;
server_name worker-admin.yourdomain.com;
ssl_certificate /etc/nginx/ssl/worker-admin.crt;
ssl_certificate_key /etc/nginx/ssl/worker-admin.key;
# IP 白名单
allow 192.168.1.0/24;
deny all;
access_log /var/log/nginx/worker-admin.access.log;
error_log /var/log/nginx/worker-admin.error.log;
location / {
proxy_pass http://ysyk_worker_servers;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
6. 常见问题排查
6.1 配置不生效
# 1. 检查配置文件是否被 include
sudo nginx -T | grep "your-domain.conf"
# 2. 检查配置语法
sudo nginx -t
# 3. 重载配置
sudo nginx -s reload
# 4. 查看错误日志
sudo tail -f /var/log/nginx/error.log
6.2 域名无法访问
# 1. 检查 DNS 解析
nslookup your-domain.com
dig your-domain.com
# 2. 检查端口是否监听
sudo netstat -tuln | grep :80
# 3. 检查防火墙
sudo firewall-cmd --list-all
sudo iptables -L -n
# 4. 测试本地访问
curl -H "Host: your-domain.com" http://127.0.0.1/
6.3 502 Bad Gateway
# 1. 检查后端服务是否运行
sudo systemctl status your-backend-service
# 2. 检查后端端口
netstat -tuln | grep :8080
# 3. 测试后端连通性
curl http://127.0.0.1:8080
# 4. 查看 Nginx 错误日志
sudo tail -f /var/log/nginx/error.log
7. 最佳实践
7.1 配置文件命名规范
# 推荐命名方式:
域名.conf # example.com.conf
域名-用途.conf # api.example.com.conf
项目-环境.conf # ysyk-production.conf
7.2 配置文件管理
# 版本控制
cd /etc/nginx
sudo git init
sudo git add conf.d/*
sudo git commit -m "Initial nginx config"
# 备份配置
sudo cp -r /etc/nginx/conf.d /etc/nginx/conf.d.backup.$(date +%Y%m%d)
# 回滚配置
sudo cp -r /etc/nginx/conf.d.backup.20251028/* /etc/nginx/conf.d/
sudo nginx -t && sudo nginx -s reload
7.3 安全建议
# 隐藏 Nginx 版本
http {
server_tokens off;
}
# 限制请求方法
if ($request_method !~ ^(GET|POST|PUT|DELETE|OPTIONS)$ ) {
return 405;
}
# 防止目录遍历
location / {
autoindex off;
}
# 禁止访问隐藏文件
location ~ /\. {
deny all;
}
8. 总结
Nginx 监听域名的核心步骤:
- DNS 解析:域名解析到服务器 IP
- 端口监听:
listen 80或listen 443 - 域名匹配:
server_name your-domain.com - 请求路由:根据
location规则处理请求
配置文件生效流程:
创建 .conf 文件 → 测试语法 → 重载配置 → 验证访问
记住这个命令序列:
sudo nano /etc/nginx/conf.d/your-domain.conf
sudo nginx -t
sudo nginx -s reload
curl -I http://your-domain.com
1979

被折叠的 条评论
为什么被折叠?



