nginx 反向代理,和ssl重定向。

参阅这篇

安装nignx1.14,并且打补丁,反向代理健康监控,ssl,解决自启动报pid错误

 

1.  安装nginx,

准备

yum install gcc-c++
yum install -y pcre pcre-devel                  //正则表达式支持
yum install -y zlib zlib-devel                      //压缩
yum install -y openssl openssl-devel

下载nginx压缩包,传至服务器

tar -zxvf nginx1.14.0.tar.gz            //解压

mv nginx-1.14.0 nginx                  //改名

cp -r nginx /usr/local/src      //将源码拷贝至src目录

进入src目录,编译

./configure  --prefix=/usr/nginx --with-http_ssl_module                  //prefix 为安装目录,后面的为ssl支持

make install

2. 配置nginx的ssl

将证书拷贝至nginx的安装目录下的conf目录下的cert 目录(新建)

vim nginx.conf

每行语句结束的必须有分号,否则报错。“;”

server {
        listen       443 ssl;
        server_name  www.yiwiki.com;
        ssl_certificate cert/5xxx6_www.yiwiki.com.pem;
        ssl_certificate_key cert/5xxx56_www.yiwiki.com.key;
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        location / {
          #  root   html;
          #  index  index.html index.htm;
        proxy_set_header HOST $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_pass http://www.yiwiki.com;
        }

然后编辑 server的80口端

 

server{
        listen 80;
    #   return 301 https://$host$request_uri;
        server_name www.yiwiki.com;
    #   return 301 https://$server_name$request_uri;
    ############以下为重定向,设置成功后,停止启动nginx服务器,不能reload,不起作用。
rewrite ^(.*)$ https://$host$1 permanent; location / { proxy_set_header HOST $host; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://www.yiwiki.com/; } }

3. 设置反向代理

#keepalive_timeout  0;
    keepalive_timeout  65;
    ####以下为关键代码,server为提前装好的tomcat,可以多个,进行轮询,可以编写权重,需要开启ip_hash,防止session跨域异常,后面设置权重,和健康检查,两次失败后自动剔除,30s无响应为确认失败
    upstream www.yiwiki.com{
        server 127.0.0.1:8080 weight=1 max_fails=2 fail_timeout=30s;
server 127.0.0.1:8090 weight=1 max_fails=2 fail_timeout=30s;
} #gzip on;

 ------------------------------------

打补丁看健康监控,另外一篇设置健康检测

https://www.cnblogs.com/wangxiaoqiangs/p/7793497.html

轮询时间为3秒,有2次成功为up,5次失败为down,超时时间为2秒。

空格和tab,是两个不同的键,注意,不要用tab产生的空格

 upstream www.yiwiki.com{
        server 127.0.0.1:8080;
    server 127.0.0.1:8090; check interval
=3000 rise=2 fall=5 timeout=2000 type=http; check_http_expect_alive http_2xx http_3xx; }
 server {
        listen       443 ssl;
        server_name  www.yiwiki.com;
        #rewrite ^(.*)$ https://$host$1;
        ssl_certificate cert/5089556_www.yiwiki.cn.pem;
        ssl_certificate_key cert/5089556_www.yiwiki.cn.key;
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
       #charset koi8-r;
        #access_log  logs/host.access.log  main;
        location / {
          #  root   html;
          #  index  index.html index.htm;
        proxy_set_header HOST $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://www.yiwiki.com;
        }
#######################加入这段后,可以通过浏览器 Https://www.yiwiki.com/status 查看页面,如果爆红,说明有问题
        location /status{
                check_status;
        }
#error_page
404 /404.html; # redirect server error pages to the static page /50x.html #

 

 

  这个的安装,有些复杂

首先安装git, yum install git ,然后,切换到/usr/nginx,得到clone的文件,里面有多个版本的patch

 git clone https://github.com/yaoweibin/nginx_upstream_check_module.git

 安装打补丁的patch程序

yum -y install patch

然后切换至nginx的源码目录,在src上层。
运行patch,注意版本和nginx的保持一致, 

  patch -p1 < /usr/nginx/nginx_upstream_check_module/check_1.14.0+.patch

 

然后运行nginx的configure文件,/nginx_xxx_module的目录是刚才下载的patch的目录。上一步补丁,只是说明编译时需要加的参数,后面add module是确切的文件。即下载的原始git文件夹

./configure --prefix=/usr/nginx --with-http_ssl_module --add-module=/usr/nginx/nginx_upstream_check_module

然后make,make install。

 

 

4. 重启nginx,重启nginx,

一定用ps -ef | grep nginx,查看占用情况。

root 3042 742 0 09:21 pts/0 00:00:00 grep --color=auto nginx    //grep 带 color的 为本条命令自身。

如果其他还有nginx进程,则会出现配置不起作用的情况。

cd /usr/nginx/sbin

./nginx -s stop                                  //停止

./nginx                                             //启动

./nginx  -s  reload                           // 重启,有时不好用,一定要用ps -ef | grep  nginx 查看

 

5.自启动

https://www.cnblogs.com/gimin/p/8893559.html,需修改官方文档中的ngnix和conf的目录。

https://www.nginx.com/resources/wiki/start/topics/examples/redhatnginxinit/

 

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;


    upstream yiwiki{
        server 127.0.0.1:8080;
        server 112.126.56.244:80;
check interval=3000 rise=2 fall=5 timeout=2000 type=http;
check_http_expect_alive http_2xx http_3xx; ip_hash; }
server { listen 80; server_name localhost; rewrite ^(.*)$ https://$host$1 permanent; } server { listen 443 ssl; server_name localhost; ssl_certificate cert/508556_www.yiwiki.cn.pem; ssl_certificate_key cert/508556_www.yiwiki.cn.key; ssl_session_timeout 5m; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; #charset koi8-r; #access_log logs/host.access.log main; location / { # root html; # index index.html index.htm; #proxy_set_header HOST $host; #proxy_set_header X-Forwarded-Proto $scheme; #proxy_set_header X-Real-IP $remote_addr; #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://yiwiki/; } location /status{ check_status; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } # proxy the PHP scripts to Apache listening on 127.0.0.1:80 # #location ~ \.php$ { # proxy_pass http://127.0.0.1; #} # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 # #location ~ \.php$ { # root html; # fastcgi_pass 127.0.0.1:9000; # fastcgi_index index.php; # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name; # include fastcgi_params; #} # deny access to .htaccess files, if Apache's document root # concurs with nginx's one # #location ~ /\.ht { # deny all; #} } # another virtual host using mix of IP-, name-, and port-based configuration # #server { # listen 8000; # listen somename:8080; # server_name somename alias another.alias; # location / { # root html; # index index.html index.htm; # } #} # HTTPS server # #server { # listen 443 ssl; # server_name localhost; # ssl_certificate cert.pem; # ssl_certificate_key cert.key; # ssl_session_cache shared:SSL:1m; # ssl_session_timeout 5m; # ssl_ciphers HIGH:!aNULL:!MD5; # ssl_prefer_server_ciphers on; # location / { # root html; # index index.html index.htm; # } #} }

 

 

posted @ 2021-01-20 09:25  琴声清幽  阅读(27)  评论(0编辑  收藏