Nginx 配置速查

worker_processes auto;

events {
    worker_connections 1024;
}

include /etc/nginx/mime.types;
default_type application/octet-stream;

sendfile on;
tcp_nopush on;
tcp_nodelay on;

keepalive_timeout 65;

client_max_body_size 100M;

server_tokens off;

server {
    listen 80;
    server_name example.com;
    root /var/www/html;
    index index.html;
}

server_name example.com www.example.com;

server_name *.example.com;

listen 80 default_server;

listen [::]:80;

root /var/www/html;
# 或使用 alias
alias /var/www/files/;

location = /path {
    # 精确匹配
}

location /api/ {
    # 前缀匹配
}

location ~ \.php$ {
    # 正则匹配（区分大小写）
}

location ~* \.(jpg|jpeg|png|gif)$ {
    # 正则匹配（不区分大小写）
}

location ^~ /images/ {
    # 优先前缀匹配
}

location / {
    try_files $uri $uri/ /index.html;
}

location /internal/ {
    internal;
}

location /api/ {
    proxy_pass http://backend:3000/;
}

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

location /ws/ {
    proxy_pass http://backend:3000/;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

upstream backend {
    server 127.0.0.1:3000;
    server 127.0.0.1:3001;
    keepalive 32;
}

upstream backend {
    least_conn;  # 或 ip_hash;
    server 127.0.0.1:3000;
    server 127.0.0.1:3001;
}

proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;

proxy_buffering on;
proxy_buffer_size 4k;
proxy_buffers 8 4k;

server {
    listen 443 ssl http2;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
}

ssl_protocols TLSv1.2 TLSv1.3;

ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;

server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;

location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2)$ {
    expires 30d;
    add_header Cache-Control "public, immutable";
}

location /api/ {
    add_header Cache-Control "no-store, no-cache, must-revalidate";
}

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=1g;

location / {
    proxy_cache my_cache;
    proxy_cache_valid 200 1d;
}

etag on;

if_modified_since before;

gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_comp_level 6;

gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml;

gzip_proxied any;

gzip_static on;

add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,Content-Type";

add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;

add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'";

limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;

location /api/ {
    limit_req zone=one burst=20 nodelay;
}

location ~ /\. {
    deny all;
}

location /admin/ {
    allow 192.168.1.0/24;
    deny all;
}

access_log /var/log/nginx/access.log;

error_log /var/log/nginx/error.log warn;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" '
                '"$http_user_agent" "$http_x_forwarded_for"';

log_format json escape=json '{"time":"$time_iso8601","ip":"$remote_addr","method":"$request_method","uri":"$uri","status":$status}';

access_log off;

map $status $loggable {
    ~^[23] 0;
    default 1;
}
access_log /var/log/nginx/access.log combined if=$loggable;

open_file_cache max=1000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;

events {
    multi_accept on;
    use epoll;
}

fastcgi_cache_path /var/cache/nginx/fastcgi levels=1:2 keys_zone=fastcgi:10m;

location ~ \.php$ {
    fastcgi_cache fastcgi;
    fastcgi_cache_valid 200 1h;
}

limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 100;

client_body_timeout 12;
client_header_timeout 12;
send_timeout 10;