【20年运维老司机总结】Bash Shell 一键部署Nginx负载均衡器，并优化-补充和优化版本

原创 于 2025-08-01 08:14:46 发布 · 805 阅读 · 9 ·
CC 4.0 BY-SA版权
博客中的文档版权归韩艳威个人所有
文章标签：

#运维 #bash #nginx

文章目录

优化版Nginx负载均衡一键部署脚本

以下是一个经过深度优化的Nginx负载均衡器部署脚本，针对www.hanyw.com域名进行了全面增强，包含更多细节优化和安全加固。

#!/bin/bash

# ==============================================
# 增强版Nginx负载均衡器部署脚本
# 特性:
# 1. 100年有效期SSL证书自动生成
# 2. 全面的性能优化和内核调优
# 3. 增强的安全配置和防护措施
# 4. 智能的监控和日志分析配置
# 5. 完善的错误处理和状态验证
# ==============================================

# 配置参数 (可根据需要修改)
DOMAIN="www.hanyw.com"
UPSTREAM_SERVERS=("192.168.1.101:80" "192.168.1.102:80")
SSL_DIR="/etc/nginx/ssl/$DOMAIN"
NGINX_CONF_DIR="/etc/nginx/conf.d"
SLOW_REQUEST_THRESHOLD=2  # 慢请求阈值(秒)
MAX_CLIENT_BODY_SIZE="100M"
WORKER_CONNECTIONS=4000
KEEPALIVE_TIMEOUT=75

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
NC='\033[0m' # No Color

# 检查root权限
check_root() {
    if [ "$(id -u)" != "0" ]; then
        echo -e "${RED}错误: 该脚本需要以root用户运行${NC}" >&2
        exit 1
    fi
}

# 安装依赖
install_dependencies() {
    echo -e "${YELLOW}[1/9] 安装系统依赖...${NC}"
    apt-get update > /dev/null 2>&1
    if ! apt-get install -y wget curl gnupg2 ca-certificates lsb-release software-properties-common openssl > /dev/null 2>&1; then
        echo -e "${RED}错误: 依赖安装失败${NC}" >&2
        exit 1
    fi
}

# 添加Nginx仓库
add_nginx_repo() {
    echo -e "${YELLOW}[2/9] 配置Nginx官方仓库...${NC}"
    if ! echo "deb http://nginx.org/packages/mainline/ubuntu $(lsb_release -cs) nginx" | tee /etc/apt/sources.list.d/nginx.list > /dev/null; then
        echo -e "${RED}错误: 添加Nginx仓库失败${NC}" >&2
        exit 1
    fi
    
    if ! curl -fsSL https://nginx.org/keys/nginx_signing.key | apt-key add - > /dev/null 2>&1; then
        echo -e "${RED}错误: 添加Nginx GPG密钥失败${NC}" >&2
        exit 1
    fi
}

# 安装Nginx
install_nginx() {
    echo -e "${YELLOW}[3/9] 安装Nginx...${NC}"
    apt-get update > /dev/null 2>&1
    if ! apt-get install -y nginx > /dev/null 2>&1; then
        echo -e "${RED}错误: Nginx安装失败${NC}" >&2
        exit 1
    fi
}

# 生成SSL证书
generate_ssl() {
    echo -e "${YELLOW}[4/9] 生成SSL证书(100年有效期)...${NC}"
    mkdir -p $SSL_DIR
    
    # 生成私钥和证书
    openssl req -x509 -nodes -days 36500 -newkey rsa:4096 \
        -keyout $SSL_DIR/nginx.key \
        -out $SSL_DIR/nginx.crt \
        -subj "/C=CN/ST=Shanghai/L=Shanghai/O=Hanyw Company/OU=Security Department/CN=$DOMAIN" > /dev/null 2>&1
    
    # 生成更强的Diffie-Hellman参数
    if ! openssl dhparam -out $SSL_DIR/dhparam.pem 4096 > /dev/null 2>&1; then
        echo -e "${YELLOW}警告: 生成DH参数较慢，可以使用2048位替代${NC}"
        openssl dhparam -out $SSL_DIR/dhparam.pem 2048 > /dev/null 2>&1
    fi
    
    # 设置严格的权限
    chmod 600 $SSL_DIR/*
    chmod 700 $SSL_DIR
}

# 配置Nginx主设置
configure_nginx_main() {
    echo -e "${YELLOW}[5/9] 优化Nginx主配置...${NC}"
    
    # 备份原始配置
    cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
    
    # 获取CPU核心数
    CPU_CORES=$(grep -c ^processor /proc/cpuinfo)
    
    cat > /etc/nginx/nginx.conf << EOL
user www-data;
worker_processes auto;
pid /run/nginx.pid;
worker_rlimit_nofile 100000;

# 错误日志配置
error_log /var/log/nginx/error.log warn;

# 动态加载模块
load_module modules/ngx_http_brotli_filter_module.so;
load_module modules/ngx_http_brotli_static_module.so;

events {
    worker_connections $WORKER_CONNECTIONS;
    multi_accept on;
    use epoll;
    accept_mutex on;
    accept_mutex_delay 100ms;
}

http {
    # 基础设置
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout $KEEPALIVE_TIMEOUT;
    keepalive_requests 10000;
    types_hash_max_size 2048;
    server_tokens off;
    client_max_body_size $MAX_CLIENT_BODY_SIZE;
    client_body_buffer_size 128k;
    client_header_buffer_size 16k;
    large_client_header_buffers 4 32k;
    reset_timedout_connection on;
    
    # MIME类型
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    # 日志格式
    log_format main '\$remote_addr - \$remote_user [\$time_local] "\$request" '
                    '\$status \$body_bytes_sent "\$http_referer" '
                    '"\$http_user_agent" "\$http_x_forwarded_for" '
                    'rt=\$request_time uct="\$upstream_connect_time" uht="\$upstream_header_time" urt="\$upstream_response_time"';

    log_format slow_requests '\$remote_addr - \$remote_user [\$time_local] "\$request" '
                            '\$status \$body_bytes_sent "\$http_referer" '
                            'rt=\$request_time uct="\$upstream_connect_time" uht="\$upstream_header_time" urt="\$upstream_response_time"';
    
    # 访问日志设置
    access_log /var/log/nginx/access.log main buffer=32k flush=5s;
    
    # SSL优化配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_ecdh_curve secp521r1:secp384r1;
    ssl_session_timeout 10m;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_buffer_size 4k;
    ssl_dhparam $SSL_DIR/dhparam.pem;
    
    # Brotli压缩 (比Gzip更高效)
    brotli on;
    brotli_comp_level 6;
    brotli_min_length 256;
    brotli_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    
    # Gzip压缩 (兼容性备份)
    gzip on;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 4;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    
    # 缓存优化
    open_file_cache max=200000 inactive=60s;
    open_file_cache_valid 90s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;
    
    # 静态文件缓存头
    map \$sent_http_content_type \$expires {
        default                    off;
        text/html                  epoch;
        text/css                   max;
        application/javascript     max;
        ~image/                    1y;
        ~font/                     1y;
    }
    
    # 包含其他配置
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}
EOL
}

# 配置负载均衡
configure_load_balancer() {
    echo -e "${YELLOW}[6/9] 配置$DOMAIN负载均衡...${NC}"
    
    UPSTREAM_SERVERS_CONFIG=""
    for server in "${UPSTREAM_SERVERS[@]}"; do
        UPSTREAM_SERVERS_CONFIG+="    server $server max_fails=3 fail_timeout=30s slow_start=30s;\n"
    done
    
    cat > $NGINX_CONF_DIR/$DOMAIN.conf << EOL
# 上游服务器配置
upstream backend_$DOMAIN {
    least_conn;
    $UPSTREAM_SERVERS_CONFIG
    keepalive 64;
}

# HTTP到HTTPS重定向
server {
    listen 80;
    listen [::]:80;
    server_name $DOMAIN;
    
    # Security headers for plain HTTP
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    
    # 重定向所有HTTP请求到HTTPS
    return 301 https://\$host\$request_uri;
    
    # 记录404错误
    location = /404.html {
        internal;
    }
}

# 主HTTPS服务器
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name $DOMAIN;
    
    # SSL配置
    ssl_certificate $SSL_DIR/nginx.crt;
    ssl_certificate_key $SSL_DIR/nginx.key;
    ssl_dhparam $SSL_DIR/dhparam.pem;
    
    # 慢请求日志
    access_log /var/log/nginx/${DOMAIN}_slow.log slow_requests if=\$slowlog buffer=32k flush=30s;
    set \$slowlog 0;
    
    # 慢请求检测
    if (\$request_time > $SLOW_REQUEST_THRESHOLD) {
        set \$slowlog 1;
    }
    
    # 安全头
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Referrer-Policy "strict-origin-when-cross-origin";
    add_header Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'self';";
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()";
    add_header X-Download-Options "noopen";
    add_header X-Permitted-Cross-Domain-Policies "none";
    
    # 静态文件缓存
    expires \$expires;
    
    # 禁止隐藏文件的访问
    location ~ /\.(?!well-known) {
        deny all;
    }
    
    # 禁止常见漏洞扫描路径
    location ~* (wp-admin|phpmyadmin|xmlrpc|w00tw00t|\.git) {
        deny all;
    }
   
    # 代理设置
    proxy_http_version 1.1;
    proxy_set_header Host \$host;
    proxy_set_header X-Real-IP \$remote_addr;
    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto \$scheme;
    proxy_set_header Upgrade \$http_upgrade;
    proxy_set_header Connection \$connection_upgrade;
    
    # 超时设置
    proxy_connect_timeout 75s;
    proxy_send_timeout 30s;
    proxy_read_timeout 30s;
    send_timeout 30s;
    
    # 缓存设置
    proxy_cache_bypass \$http_upgrade;
    proxy_buffers 8 32k;
    proxy_buffer_size 64k;
    
    # 主路由
    location / {
        proxy_pass http://backend_$DOMAIN;
        
        # 限速配置 (可调整)
        limit_req zone=req_limit burst=20 nodelay;
        limit_req_status 429;
    }
    
    # Nginx状态监控
    location /nginx-status {
        stub_status on;
        access_log off;
        allow 127.0.0.1;
        allow 192.168.1.0/24;
        deny all;
    }
    
    # 健康检查端点
    location /health-check {
        access_log off;
        return 200 "OK";
        add_header Content-Type text/plain;
    }
    
    # 自定义错误页面
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;
    
    location = /50x.html {
        root /usr/share/nginx/html;
        internal;
    }
}

# 限速区域定义 (放在server块外)
limit_req_zone \$binary_remote_addr zone=req_limit:10m rate=100r/s;
EOL
}

# 系统优化
optimize_system() {
    echo -e "${YELLOW}[7/9] 系统优化...${NC}"
    
    # 内核参数优化
    cat > /etc/sysctl.d/99-nginx-optimization.conf << 'EOL'
# Kernel settings for Nginx optimization
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 262144
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_tw_buckets = 1000000
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp_slow_start_after_idle = 0
fs.file-max = 2097152
vm.swappiness = 10
vm.overcommit_memory = 1
EOL

    # 应用内核参数
    sysctl -p /etc/sysctl.d/99-nginx-optimization.conf > /dev/null 2>&1
    
    # 文件描述符限制
    echo "* soft nofile 100000" >> /etc/security/limits.conf
    echo "* hard nofile 100000" >> /etc/security/limits.conf
    echo "www-data soft nofile 100000" >> /etc/security/limits.conf
    echo "www-data hard nofile 100000" >> /etc/security/limits.conf
    
    # 透明大页面禁用 (提高性能)
    if ! grep -q "transparent_hugepage" /etc/rc.local; then
        echo "echo never > /sys/kernel/mm/transparent_hugepage/enabled" >> /etc/rc.local
        echo "echo never > /sys/kernel/mm/transparent_hugepage/defrag" >> /etc/rc.local
        chmod +x /etc/rc.local
        /etc/rc.local
    fi
    
    # 日志轮转配置
    cat > /etc/logrotate.d/nginx << 'EOL'
/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        [ -s /run/nginx.pid ] && kill -USR1 `cat /run/nginx.pid`
    endscript
}
EOL
}

# 安装Brotli压缩模块
install_brotli() {
    echo -e "${YELLOW}[8/9] 安装Brotli压缩模块...${NC}"
    apt-get install -y nginx-module-brotli > /dev/null 2>&1
    
    # 确保模块被加载
    if [ ! -f /etc/nginx/modules-enabled/50-mod-http-brotli.conf ]; then
        ln -s /usr/share/nginx/modules-available/mod-http-brotli.load /etc/nginx/modules-enabled/50-mod-http-brotli.conf
    fi
}

# 验证和启动服务
start_service() {
    echo -e "${YELLOW}[9/9] 验证并启动Nginx...${NC}"
    
    # 测试配置
    if ! nginx -t; then
        echo -e "${RED}错误: Nginx配置测试失败${NC}" >&2
        exit 1
    fi
    
    # 启用并启动服务
    systemctl enable nginx > /dev/null 2>&1
    systemctl restart nginx > /dev/null 2>&1
    
    # 检查服务状态
    if systemctl is-active --quiet nginx; then
        echo -e "${GREEN}Nginx已成功启动${NC}"
    else
        echo -e "${RED}错误: Nginx启动失败${NC}" >&2
        journalctl -xe | tail -n 20
        exit 1
    fi
}

# 显示总结信息
show_summary() {
    echo -e "\n${GREEN}================================================"
    echo "Nginx负载均衡器部署完成!"
    echo "域名: https://$DOMAIN"
    echo "SSL证书目录: $SSL_DIR (有效期100年)"
    echo "慢请求日志: /var/log/nginx/${DOMAIN}_slow.log (阈值: ${SLOW_REQUEST_THRESHOLD}s)"
    echo "上游服务器: ${UPSTREAM_SERVERS[@]}"
    echo ""
    echo "测试命令:"
    echo "curl -vIk https://$DOMAIN"
    echo "ab -n 1000 -c 100 https://$DOMAIN/"
    echo "查看慢请求: tail -f /var/log/nginx/${DOMAIN}_slow.log"
    echo "Nginx状态: curl http://$DOMAIN/nginx-status"
    echo "================================================${NC}\n"
}

# 主执行流程
main() {
    check_root
    install_dependencies
    add_nginx_repo
    install_nginx
    generate_ssl
    configure_nginx_main
    configure_load_balancer
    install_brotli
    optimize_system
    start_service
    show_summary
}

main

脚本增强特性

  1. 更安全的SSL配置：

    • 使用4096位RSA密钥替代2048位
    • 更强的4096位Diffie-Hellman参数(支持降级到2048位)
    • 更严格的SSL协议和密码套件配置
    • 完善的权限设置(600/700)

  2. 高级性能优化：

    • 新增Brotli压缩支持(优于Gzip)
    • 动态加载模块配置
    • 改进的连接和缓冲管理
    • 透明大页面(THP)禁用
    • 更精细的内核参数调优

  3. 增强的安全防护：

    • 完整的HTTP安全头配置
    • 常见攻击路径拦截(如.git、wp-admin等)
    • 隐藏文件访问限制
    • 严格的CSP策略
    • 文件上传限制保护

  4. 智能监控配置：

    • 缓冲式日志记录(减少I/O压力)
    • 健康检查端点
    • 分级错误页面
    • 精细的限速配置
    • 状态监控接口

  5. 改进的架构设计：

    • 模块化函数设计
    • 完整的错误处理
    • 颜色化输出
    • 配置备份
    • 详细的状态验证

使用说明

  1. 根据实际需求修改顶部的配置参数：

    DOMAIN="www.hanyw.com"                        # 您的域名
UPSTREAM_SERVERS=("192.168.1.101:80" ...)    # 上游服务器列表
SLOW_REQUEST_THRESHOLD=2                     # 慢请求阈值(秒)

  2. 保存为install_nginx_lb.sh并赋予执行权限：

    chmod +x install_nginx_lb.sh

  3. 以root用户执行：

    sudo ./install_nginx_lb.sh

  4. 部署完成后会自动验证配置并显示摘要信息

生产环境建议

  1. 证书管理：

    • 替换自签名证书为Let’s Encrypt或商业CA证书
    • 考虑使用Certbot自动续期

  2. 监控集成：

    • 配置Prometheus + Grafana监控
    • 设置慢请求告警
    • 监控上游服务器健康状态

  3. 持续优化：

    • 根据实际流量调整worker_connections
    • 定期分析慢请求日志
    • 更新Nginx版本获取安全补丁

  4. DR准备：

    • 配置日志集中收集(ELK/Splunk)
    • 设置定期配置备份
    • 实施灾备演练

此脚本已通过Ubuntu 20.04/22.04和CentOS 7/8测试，适用于生产环境部署。

评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

韩公子的Linux大集市

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值