Nginx 配置案例

1、多域名绑定

1.1、场景

• 两个域名，映射到同一个 IP

• 根据域名转发请求

• 开启 SSL

1.2、配置

http {
    # 域名 xxxxx
    server {
       listen 443 ssl;
        # 填写绑定证书的域名
        server_name  xxxx.com;
        # 证书文件名称
        ssl_certificate  /usr/local/nginx/conf/xxxxx.com_nginx/xxxxx.com_bundle.crt;
        # 私钥文件名称
        ssl_certificate_key /usr/local/nginx/conf/xxxxx.com_nginx/xxxxx.com.key;
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        location / {
            # 映射 10.10.10.10
            proxy_pass http://10.10.10.10;
            index  index.html index.htm;
        }
    }
    # 域名 yyyyy
    server {
       listen 443 ssl;
        # 填写绑定证书的域名
        server_name  yyyyy.top;
        # 证书文件名称
        ssl_certificate  /usr/local/nginx/conf/yyyyy.top_nginx/yyyyy.top_bundle.crt;
        # 私钥文件名称
        ssl_certificate_key /usr/local/nginx/conf/yyyyy.top_nginx/yyyyy.top.key;
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        # 资源
        root  /opt/view/;
        location / {
            proxy_pass http://10.10.10.10;
            index  index.html index.htm index.php;
        }
    }
    server {
        listen 80;
        server_name localhost;
        # 把 http 的域名请求转成 https
        rewrite  ^/(.*)$  https:$host/$1  redirect;
    }
}

2、转发 PHP 文件请求

2.1、场景

• Nginx 无法解析 PHP 文件

• Nginx 将 PHP 文件请求转发到 php-fpm

• 开启 SSL

2.2、配置

# 与 php-fpm 的工作进程使用相同的用户，避免权限问题
user  fpm;

http {
    # 域名 yyyyy
    server {
       listen 443 ssl;
        # 填写绑定证书的域名
        server_name  yyyyy.top;
        # 证书文件名称
        ssl_certificate  /usr/local/nginx/conf/yyyyy.top_nginx/yyyyy.top_bundle.crt;
        # 私钥文件名称
        ssl_certificate_key /usr/local/nginx/conf/yyyyy.top_nginx/yyyyy.top.key;
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        # 资源
        root  /opt/view/;

       # 处理 php 文件请求
       location ~ .*\.php$ {
         fastcgi_pass 10.10.10.10:9000; # 根据你的 PHP-FPM 配置可能需要更改
         fastcgi_index index.php;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         # conf 目录要包含 fastcgi_params 文件
         include fastcgi_params;
        }

        location / {
            index  index.html index.htm index.php;
            # 防止 404
            try_files $uri $uri/ /index.php?$args;
        }
    }

    server {
        listen 80;
        # 填写绑定证书的域名
        server_name localhost;
        # 把 http 的域名请求转成 https
        rewrite  ^/(.*)$  https:$host/$1  redirect;
    }
}

3、负载均衡

3.1、场景

• 代理 /api 开头的请求

• 将请求转发到集群

3.2、配置

http {
    # 负载据均衡，默认轮询
    upstream my_servers {
        server  10.0.0.0:9527 weight=1 max_fails=1  fail_timeout=10s;
        server  10.0.0.0:9528 weight=1 max_fails=1  fail_timeout=10s;
    }
    server {
        listen    8888;
        # 请求转发
        location ^~ /api/ {
            proxy_next_upstream http_502 http_504 error timeout invalid_header;
            proxy_pass http://my_servers;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   Host             $host;
        }
    }
}

参考：

nginx配置多域名多个ssl证书