nginx域名配置
自签域名
生成本地签名证书
//创建ssl证书存放路径并进入该路径
mkdir -p /etc/nginx/ssl/;cd /etc/nginx/ssl/
//生成CA的私钥
//创建服务器证书密钥文件 server.key
openssl genrsa -des3 -out server.key 2048
//创建服务器证书的申请文件 server.csr
//CA证书里面包含了CA的信息和CA的签名（使用CA私钥加密）
openssl req -new -key server.key -out server.csr
输出内容为：
Enter pass phrase for root.key: ← 输入前面创建的密码
Country Name (2 letter code) [AU]:CN ← 国家代号，中国输入CN
State or Province Name (full name) [Some-State]:BeiJing ← 省的全名，拼音
Locality Name (eg, city) []:BeiJing ← 市的全名，拼音
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名
Organizational Unit Name (eg, section) []: ← 可以不输入
Common Name (eg, YOUR name) []: ← 输入域名，如：iot.conet.com
Email Address []:admin@mycompany.com ← 电子邮箱，可随意填
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: ← 可以不输入
An optional company name []: ← 可以不输入
//备份一份服务器密钥文件
cp server.key server.key.org
//去除文件口令
openssl rsa -in server.key.org -out server.key
//生成证书文件server.crt
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
修改nginx配置域名模板
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 4096;
include /etc/nginx/mime.types;
default_type application/octet-stream;
include /etc/nginx/conf.d/*.conf;
server {
listen 80;
listen [::]:80;
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name _;
root /usr/share/nginx/html;
ssl_certificate "/usr/share/nginx/html/ssl/server.crt";
ssl_certificate_key "/usr/share/nginx/html/ssl/server.key";
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
}
实例参考
实例1
cat /etc/nginx/conf/conf.d/ecs.conf
upstream consoleSvr {
server 172.16.0.11:8095 max_fails=3 fail_timeout=30s;
}
upstream ecsXxl {
server 172.16.0.11:8082 max_fails=3 fail_timeout=30s;
}
upstream ecsSvr {
server 172.16.0.11:8096 max_fails=3 fail_timeout=30s;
}
server {
listen 80;
listen 443 ssl; # managed by Certbot
server_name alex.com.cn;
ssl_certificate /etc/nginx/cert/alex.com.cn.pem; # managed by Certbot
ssl_certificate_key /etc/nginx/cert/alex.com.cn.key; # managed by Certbot
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log info;
location = / {
rewrite ^ /ecs-console/index.html permanent;
}
#xxl-job的配置需要放到前面
location ^~ /xxl-job-admin/ {
proxy_read_timeout 240s;
proxy_pass http://ecsXxl;
}
location ^~ /(xxl-job-admin)/(.+)\.(css|js|html|map|gif|jpg|jpeg|png|ico|ttf|woff|apk|ipa)$ {
proxy_pass http://ecsXxl;
}
location ~* \.(css|js|html|map|gif|jpg|jpeg|png|ico|mp4|svg|icon|ttf|woff|apk|ipa)$ {
root /usr/share/nginx/html;
}
location = /ecs/doc.html {
proxy_pass http://consoleSvr;
}
location ^~ /ecs/webjars/ {
proxy_pass http://consoleSvr;
}
location ~ /(console)/ {
rewrite ^/(console)?/(.*) /$2 break;
proxy_read_timeout 240s;
proxy_pass http://consoleSvr;
}
location ~ /(designer|ecs|businessobject|datadictionary|distribution|filemanagement|flow|masterdata|rule|treemanager|platform)/ {
rewrite ^/(designer|ecs|businessobject|datadictionary|distribution|filemanagement|flow|masterdata|rule|treemanager|platform)?/(.*) /$2 break;
proxy_pass http://ecsSvr;
proxy_connect_timeout 240s;
proxy_read_timeout 240s;
proxy_send_timeout 240s;
}
location = /ecs-console/ {
index /ecs-console/index.html;
}
location / {
rewrite ^/console/(.*)$ /$2 break;
proxy_read_timeout 240s;
proxy_pass http://consoleSvr;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
}
实例2
//代理前端
# HTTP server
server {
listen 80; #http默认端口
server_name ***.com www.***.com; #对应域名
access_log /home/logs/nginx/***-access.log; #访问日志
#rewrite ^/(.*) https://***.com/$1 permanent;#配置此项则强行跳转到下面的https配置
location / { #配置此项则跳转到静态页面
root /home/***/web/user/; #页面位置
index index.html index.htm; #首页文件
try_files $uri $uri/ /index.html; #url不可达时，逐个向后转发
}
}
# HTTPS server
server {
listen 443 ssl; #https默认端口
server_name ***.com www.***.com; #对应域名
root html;
index index.html index.htm;
client_max_body_size 1000M;
access_log /home/logs/nginx/***-https-access.log; #访问日志
ssl_certificate /usr/local/nginx/cert/******.com.pem; #你的证书
ssl_certificate_key /usr/local/nginx/cert/******.com.key; #你的key
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
location / {
root /home/***/web/user/; #页面位置
index index.html index.htm; #首页文件
try_files $uri $uri/ /index.html; #url不可达时，逐个向后转发
}
}
实例3
//代理后端
# HTTP server
server {
listen 80;
server_name api.***.com www.api.***.com;;
access_log /home/logs/nginx/***.api-access.log;
#rewrite ^/(.*) https://api.***.com/$1 permanent;
location / {
proxy_pass http://127.0.0.1:8082;
}
}
# HTTPS server
server {
listen 443 ssl;
server_name api.***.com www.api.***.com;;
root html;
index index.html index.htm;
client_max_body_size 1000M;
access_log /home/logs/nginx/***.api-https-access.log;
ssl_certificate /usr/local/nginx/cert/*****.com.pem; #你的证书
ssl_certificate_key /usr/local/nginx/cert/*****.com.key; #你的key
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
location / {
proxy_pass http://127.0.0.1:8082;
}
}
参考文档
nginx配置，附https配置，前端（管理后台） ，后端（服务）
