nginx 最佳实践
nginx.conf
error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; load_module modules/ngx_http_image_filter_module.so; events { worker_connections 10240; } http { include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; sendfile on; #tcp_nopush on; keepalive_timeout 30; #gzip on; #置灰配置 #sub_filter '</head>' '<style type="text/css">html { filter:grayscale(100%); -webkit-filter: grayscale(100%); -moz-filter: grayscale(100%); -ms-filter: grayscale(100%); -o-filter: grayscale(100%); filter: progid:DXImageTransform.Microsoft.BasicImage(grayscale=1); filter: gray;}</style></head>'; #sub_filter_types *; #sub_filter_once off; include /etc/nginx/conf.d/*.conf; }
front-proxy.conf
server { listen 80; proxy_intercept_errors on; charset utf-8; server_name chain-front-tst.xxxtech.cn chain-tst-img.xxxtech.cn; client_max_body_size 200m; set $accessip false; if ( $http_x_forwarded_for ~ 124.127.104.130,.* ) {set $accessip true;} #rmkj-youxian if ( $http_x_forwarded_for ~ 124.127.104.130 ) {set $accessip true;} #rmkj-youxian if ( $http_x_forwarded_for ~ 180.212.253.41,.* ) {set $accessip true;} if ( $http_x_forwarded_for ~ 180.212.253.41 ) {set $accessip true;} if ( $http_x_forwarded_for ~ 10.50.8.32,.* ) {set $accessip true;} #vpn if ( $http_x_forwarded_for ~ 10.50.8.32 ) {set $accessip true;} #vpn if ( $accessip = 'false') {return 403;} if ($http_referer ~ "baidu.com") { rewrite ^/(.*)$ https://chain.xxxtech.cn/ permanent; } location ~ .*\.(css|js|swf)$ { add_header Cache-Control max-age=200; if_modified_since off; expires off; etag off; root /h5; } location / { add_header Cache-Control private; add_header Cache-Control "no-store"; add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS'; add_header Access-Control-Allow-Headers 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization'; if_modified_since off; expires off; etag off; root /h5; index index.html; try_files $uri $uri/ /index.html; } location /api/v2/ { proxy_pass http://nft-api; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location /media/uploads/ { add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Methods *; add_header Access-Control-Allow-Headers *; root /; #image_filter_buffer 200M; #image_filter_interlace on; #image_filter_jpeg_quality 80; #image_filter resize 100 80; } location /api/v3/ { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; #注意添加theone3 白名单 proxy_pass https://theone3-appapi.xxxtech.cn; #proxy_pass http://qa-theone3appapi.xxxtech.cn; } location /api/v3/certificate/c750X1805 { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://nft-compose-api; } location /MP_verify_pvvGnSyTQDwEiXuP.txt { root /etc/nginx/; } location /MP_verify_zaOvZJ2n3WL4t8Dd.txt { root /etc/nginx/; } location /MP_verify_5QHNYaCMHnTn7UNv.txt { root /etc/nginx/; } }
default.conf
#当请求的url不匹配其他的conf文件中servier_name 配置的域名时候,就会作用于default.conf 中的配置,如果想要对非本站的域名进行过滤并提示配置有问题,可以在此文件中做一些特殊提示
server { listen 80; listen [::]:80; server_name localhost; location / { default_type text/html; return 404 'request not found, please check your server name config'; } }