LNMP架构二

LNMP架构二

nginx默认虚拟主机

修改主配置文件nginx.conf ,在结束符号 } 上面加入一行配置

[root[@www](https://my.oschina.net/licomernwater) conf]# cat nginx.conf | tail -n5

    gzip_types text/plain application/x-javascript text/css text/htm 

   application/xml;

    include vhost/*.conf;

}

[root[@www](https://my.oschina.net/licomernwater) conf]# 

 include vhost/*.conf;   这一行就是你需要加入的配置,意思为所有/usr/local/nginx/conf/vhost/下的所有以.conf结尾的文件都会加载。这样就可以直接把虚拟主机配置文件放入vhost目录里

新建vhost文件夹并配置虚拟主机文件

[root[@www](https://my.oschina.net/licomernwater) conf]# mkdir vhost

[root[@www](https://my.oschina.net/licomernwater) conf]# cd vhost

[root[@www](https://my.oschina.net/licomernwater) vhost]# vim default.conf

[root@www vhost]# cat default.conf

server

{

	listen 80 default_server;

	server_name aaa.com;

	index index.html index.htm index.php;

	root /data/nginx/default;

}

[root@www vhost]# 

检测语法错误

[root@www vhost]# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

[root@www vhost]# /usr/local/nginx/sbin/nginx -s reload

创建索引页

[root@www default]# cat index.html 

lantern.com

[root@www default]# curl -x127.0.0.1:80 aaa.com          测试连接aaa.com

lantern.com

[root@www default]# curl -x127.0.0.1:80 1212.com        访问一个没有定义的域名,也会访问到aaa.com

lantern.com 

[root@www default]# 

用户认证

创建一个新的虚拟主机来测试并为期配合内容

[root@www default]# cd /usr/local/nginx/conf/vhost/

[root@www vhost]# vim test.conf

[root@www vhost]# cat !$

cat test.conf

server

{

	listen 80;

	server_name test.com;

	index index.html index.htm index.php;

	root /data/nginx/test;

		location  /

		{

			auth_basic		"Auth";             打开认证

			auth_basic_user_file	/usr/local/nginx/conf/htpasswd;     指定用户密码文件

		}

}

[root@www vhost]# 

生成用户密码工具需要借助httpd的htpasswd,nginx不会自带这个工具。

创建nginx用户并生成密码

[root@www vhost]# htpasswd -c /usr/local/nginx/conf/htpasswd nginx

New password: 

Re-type new password: 

Adding password for user nginx

[root@www vhost]# 

检测语法错误

[root@www vhost]# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

[root@www vhost]# /usr/local/nginx/sbin/nginx -s reload

[root@www vhost]# 

测试

[root@www vhost]# curl -x127.0.0.1:80 test.com -I

HTTP/1.1 401 Unauthorized

Server: nginx/1.8.0

Date: Mon, 02 Jul 2018 19:56:06 GMT

Content-Type: text/html

Content-Length: 194

Connection: keep-alive

WWW-Authenticate: Basic realm="Auth"

[root@www vhost]# 

401状态码即为,该网站需要验证。

可以去浏览器上输入网址测试,输入用户名和密码即可访问。

如果需要针对某个目录做用户认证,需要修改location 后面的路径:

location  /  改为  location  /admin/

域名重定向

以 test.conf 作为测试 修改配置文件为以下内容

[root@www vhost]# vim test.conf 
[root@www vhost]# cat !$
cat test.conf
server
{
	listen 80;
	server_name test.com test1.com test2.com;
	index index.html index.htm index.php;
	root /data/nginx/test;
	
	if ($host != 'test.com' ){
		rewrite ^/(.*)$ http://test.com/$1 permanent;
	}

	#location  /
	#{
	#	auth_basic		"Auth";
	#	auth_basic_user_file	/usr/local/nginx/conf/htpasswd;
	#}
}
[root@www vhost]# 
server_name后可以跟随多个域名,permanent为永久重定向,相当于httpd的R=301

检测语法错误

[root@www vhost]# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

[root@www vhost]# /usr/local/nginx/sbin/nginx -s reload

[root@www vhost]# 

测试

[root@www vhost]# curl -x127.0.0.1:80 test1.com/123.txt -I

HTTP/1.1 301 Moved Permanently

Server: nginx/1.8.0

Date: Mon, 02 Jul 2018 20:20:22 GMT

Content-Type: text/html

Content-Length: 184

Connection: keep-alive

Location: http://test.com/123.txt

[root@www vhost]# 

nginx访问日志

查看nginx日志格式

[root@www vhost]# grep -A2 log_format /usr/local/nginx/conf/nginx.conf

    log_format combined_realip 'remote_addr http_x_forwarded_for [$time_local]'

    ' host "request_uri" $status'

    ' "http_referer" "http_user_agent"';

[root@www vhost]# 

和httpd类似,同样是在主配置文件中定义日志格式

combined_realip为日志格式的名称,可调用。

修改配置文件

[root@www vhost]# vim test.conf 
[root@www vhost]# cat !$
cat test.conf
server
{
	listen 80;
	server_name test.com test1.com test2.com;
	index index.html index.htm index.php;
	root /data/nginx/test;
	
	if ($host != 'test.com' ){
		rewrite ^/(.*)$ http://test.com/$1 permanent;
	}
	access_log /root/1.log combined_realip;
	#location  /
	#{
	#	auth_basic		"Auth";
	#	auth_basic_user_file	/usr/local/nginx/conf/htpasswd;
	#}
}
[root@www vhost]# 

检测语法错误

[root@www vhost]# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

[root@www vhost]# /usr/local/nginx/sbin/nginx -s reload

生成错误日志并查看

[root@www vhost]# curl -x127.0.0.1:80 test.com/111

<html>

<head><title>404 Not Found</title></head>

<body bgcolor="white">

<center><h1>404 Not Found</h1></center>

<hr><center>nginx/1.8.0</center>

</body>

</html>

[root@www vhost]# cat /root/1.log

127.0.0.1 - [03/Jul/2018:04:31:17 +0800] test.com "/111" 404 "-" "curl/7.29.0"

[root@www vhost]# 

日志切割

nginx日志比较简单。不像httpd还有自带的切割工具,想要切割nginx脚本就需要借助系统的切割工具或者自定义脚本。

自定义shell 脚本

[root@www vhost]# vim  /usr/local/sbin/nginx_log_rotate.sh
[root@www vhost]# cat !$
cat /usr/local/sbin/nginx_log_rotate.sh
#!# /bin/bash

d=`date -d "-1 day" +%Y+%m+%d`
logdir="/data/logs"
nginx_pid="/usr/local/nginx/logs/nginx.pid"
	cd $logdir
for log in `ls *.log`
do
	mv $log $log-$d
done
/bin/kill -HUP `cat $nginx_pid`
[root@www vhost]# 

到此为止,这个日志切割脚本内容配置完成,也可以新增一个任务计划

0 0 * * * /bin/bash /usr/local/sbin/nginx_log_rotate.sh

配置静态文件不记录日志和添加过期时间

修改配置文件为如下:

[root@www vhost]# vim test.conf 
[root@www vhost]# cat !$
cat test.conf
server
{
	listen 80;
	server_name test.com test1.com test2.com;
	index index.html index.htm index.php;
	root /data/nginx/test;
	
	if ($host != 'test.com' ){
		rewrite ^/(.*)$ http://test.com/$1 permanent;
	}
	location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
	{
		expires	7d;
		access_log off;
	}
	location ~ .*\.(js|css)$
	{
		expires	12h;
		access_log off;
	}
	access_log /root/1.log combined_realip;
	#location  /
	#{
	#	auth_basic		"Auth";
	#	auth_basic_user_file	/usr/local/nginx/conf/htpasswd;
	#}
}
[root@www vhost]# 
location ~ 可以指定对应的静态文件,expires配置过期时间,access_log 配置为0ff就可以不访问日志了。

测试语法并新建文件

[root@www vhost]# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

[root@www vhost]# echo '11111' > /data/nginx/test/1.js

[root@www vhost]# echo '11111' > /data/nginx/test/2.jpg

[root@www vhost]# touch /data/nginx/test/1.jss

测试

[root@www vhost]# curl -x127.0.0.1:80 test.com/1.js -I

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Mon, 02 Jul 2018 21:49:58 GMT

Content-Type: application/javascript

Content-Length: 6

Last-Modified: Mon, 02 Jul 2018 21:27:14 GMT

Connection: keep-alive

ETag: "5b3a98b2-6"

Expires: Tue, 03 Jul 2018 09:49:58 GMT

Cache-Control: max-age=43200

Accept-Ranges: bytes

[root@www vhost]# curl -x127.0.0.1:80 test.com/2.jpg -I

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Mon, 02 Jul 2018 21:55:56 GMT

Content-Type: image/jpeg

Content-Length: 6

Last-Modified: Mon, 02 Jul 2018 21:27:22 GMT

Connection: keep-alive

ETag: "5b3a98ba-6"

Expires: Mon, 09 Jul 2018 21:55:56 GMT

Cache-Control: max-age=604800

Accept-Ranges: bytes

[root@www vhost]# curl -x127.0.0.1:80 test.com/1.jss -I

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Mon, 02 Jul 2018 21:56:06 GMT

Content-Type: application/octet-stream

Content-Length: 0

Last-Modified: Mon, 02 Jul 2018 21:27:52 GMT

Connection: keep-alive

ETag: "5b3a98d8-0"

Accept-Ranges: bytes

[root@www vhost]#

Cache-Control 代表 对应时间大小,单位是秒

访问日志

[root@www vhost]# cat /root/1.log 

127.0.0.1 - [03/Jul/2018:05:01:17 +0800] test.com "/111" 404 "-" "curl/7.29.0"

127.0.0.1 - [03/Jul/2018:05:56:06 +0800] test.com "/1.jss" 200 "-" "curl/7.29.0"

[root@www vhost]# 

访问了js.jpg jss 但访问日志里只留下了jss

nginx防盗链

修改配置文件如下:

[root@www vhost]# cat test.conf
server
{
	listen 80;
	server_name test.com test1.com test2.com;
	index index.html index.htm index.php;
	root /data/nginx/test;
	
	if ($host != 'test.com' ){
		rewrite ^/(.*)$ http://test.com/$1 permanent;
	}
	location ~* ^.+\.(gif|jpg|jpeg|png|bmp|swf|flv|rar|zip|doc|pdf|gz|bz2|jpeg|xls)$
	{
		expires	7d;
		valid_referers none blocked server_names *.test.com ;
		if ($invalid_referer){
			return 403;
		}
		access_log off;
	}
	access_log /root/1.log combined_realip;
	#location  /
	#{
	#	auth_basic		"Auth";
	#	auth_basic_user_file	/usr/local/nginx/conf/htpasswd;
	#}
}
[root@www vhost]# 
由于和过期时间,不记录日志有部分重合,把两部分合并在一起

测试语法

[root@www vhost]# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

[root@www vhost]# /usr/local/nginx/sbin/nginx -s reload

[root@www vhost]# 

测试

[root@www vhost]# curl -x127.0.0.1:80 -I -e "http://aaa.com/1.txt" test.com/2.jpg

HTTP/1.1 403 Forbidden

Server: nginx/1.8.0

Date: Mon, 02 Jul 2018 22:09:34 GMT

Content-Type: text/html

Content-Length: 168

Connection: keep-alive

[root@www vhost]# curl -x127.0.0.1:80 -I -e "http://test.com/1.txt" test.com/2.jpg

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Mon, 02 Jul 2018 22:09:47 GMT

Content-Type: image/jpeg

Content-Length: 6

Last-Modified: Mon, 02 Jul 2018 21:27:22 GMT

Connection: keep-alive

ETag: "5b3a98ba-6"

Expires: Mon, 09 Jul 2018 22:09:47 GMT

Cache-Control: max-age=604800

Accept-Ranges: bytes

[root@www vhost]# 

防盗链功能已生效

访问控制

修改配置文件如下

[root@www vhost]# vim test.conf 
[root@www vhost]# cat !$
cat test.conf
server
{
	listen 80;
	server_name test.com test1.com test2.com;
	index index.html index.htm index.php;
	root /data/nginx/test;
	
	if ($host != 'test.com' ){
		rewrite ^/(.*)$ http://test.com/$1 permanent;
	}
	location /admin/
	{
		allow 192.168.1.180;
		allow 127.0.0.1;
		deny all;
	}
指定admin目录请求只允许设置的IP访问
nginx匹配规则是  从上往下逐一匹配

测试

[root@www vhost]# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

[root@www vhost]# /usr/local/nginx/sbin/nginx -s reload

[root@www vhost]# mkdir /data/nginx/test/admin/

[root@www vhost]# echo '123' > /data/nginx/test/admin/1.html

[root@www vhost]# curl -x127.0.0.1:80 test.com/admin/1.html

123

[root@www vhost]# curl -x192.168.1.180:80 test.com/admin/1.html

123

这就是目前设置的可以访问IP

[root@www vhost]# curl -x192.168.18.126:80 test.com/admin/1.html

<html>

<head><title>403 Forbidden</title></head>

<body bgcolor="write">

<center><h1>403 Forbidden </h1></center>

<hr><center>nginx/1.8.0</center>

</body>

</html>

nginx 解析php

在LNMP中,php是以一个服务形式存在的,首先要启动php-fpm服务,然后nginx再和php-fpm通信

配置php相关的内容

    location ~ \.php$
    {
            include fastcgi_params;
            fastcgi_pass unix:/tmp/php-fcgi.sock;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME /data/nginx/test$fastcgi_script_name;
    }

fastcgi_pass 指定php-fpm的地址,如果监听的地址是tcp:port的地址,那么在这里也需要修改为fastcgi_pass 127.0.0.1:9000  这个地址要与pfp-fpm的地址相匹配,否则会包502错误

fastcgi_param SCRIPT_FILENAME  后面跟的路径为该站点的根目录,和前面定义的root那个路径保存一致,否则访问php界面会出现404错误

nginx代理

一家公司有很多台服务器,为了节省成本,不能为所有服务器都分配公网IP,而如果一个没有公网ip的服务器要提供web服务,就可以通过代理来实现。

新建一个配置文件,在内输入nginx代理所需要设置的内容

[root@www vhost]# cat proxy.conf 
server
{
	listen 80;
	server_name ask.apelearn.com;

	location /
	{
		proxy_pass http://223.94.95.10/;
		proxy_set_header Host	$host;
	}
}
[root@www vhost]# 
proxy_pass指定要代理的域名所在的服务器IP  如果不知道IP 可以直接ping 域名得到IP。
proxy_set_header  定义发往后端web服务器的请求头,表示后端web服务器的域名和当前配置文件的server_name保存一致。

检测语法错误

[root@www vhost]# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

[root@www vhost]# /usr/local/nginx/sbin/nginx -s reload

测试

[root@www vhost]# curl -x127.0.0.1:80 ask.apelearn.com -I

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Mon, 02 Jul 2018 23:06:42 GMT

Content-Type: text/html; charset=UTF-8

Connection: keep-alive

X-Powered-By: PHP/5.3.3

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Set-Cookie: ape__Session=49u6oflcbcl2oi17ceopo95na3; path=/; domain=.apelearn.com

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

myheader: web1

[root@www vhost]# curl apelearn.com -I

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 05 Jul 2018 17:40:19 GMT

Content-Type: text/html; charset=UTF-8

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.6.10

[root@www vhost]# 

[root@www vhost]# curl ask.apelearn.com/robots.txt 
#
# robots.txt for MiWen
#

User-agent: *

Disallow: /?/admin/
Disallow: /?/people/
Disallow: /?/question/
Disallow: /account/
Disallow: /app/
Disallow: /cache/
Disallow: /install/
Disallow: /models/
Disallow: /crond/run/
Disallow: /search/
Disallow: /static/
Disallow: /setting/
Disallow: /system/
Disallow: /tmp/
Disallow: /themes/
Disallow: /uploads/
Disallow: /url-*
Disallow: /views/
Disallow: /*/ajax/
[root@www vhost]# curl -x127.0.0.1:80 ask.apelearn.com/robots.txt 
#
# robots.txt for MiWen
#

User-agent: *

Disallow: /?/admin/
Disallow: /?/people/
Disallow: /?/question/
Disallow: /account/
Disallow: /app/
Disallow: /cache/
Disallow: /install/
Disallow: /models/
Disallow: /crond/run/
Disallow: /search/
Disallow: /static/
Disallow: /setting/
Disallow: /system/
Disallow: /tmp/
Disallow: /themes/
Disallow: /uploads/
Disallow: /url-*
Disallow: /views/
Disallow: /*/ajax/[root@www vhost]# 

以上都可见没有问题,代理功能已实现

扩展

nginx.conf 配置详解 http://www.ha97.com/5194.html

http://my.oschina.net/duxuefeng/blog/34880

nginx rewrite四种flag http://www.netingcn.com/nginx-rewrite-flag.html

http://unixman.blog.51cto.com/10163040/1711943

502问题汇总 http://ask.apelearn.com/question/9109

location优先级 http://blog.lishiming.net/?p=100

转载于:https://my.oschina.net/u/3851489/blog/1841145

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值