在CentOS中安装和使用nginx
概述
本文简单讲述一下,如何快速将一个内网的Web服务通过nginx提供给外网访问,并且启用HTTPS。例如我们部署了一个kubesphere
,地址为192.168.202.151:30880
,需要通过nginx来提供给外网访问,我们来看看在CentOS上如何进行快速部署。
安装
首先我们通过yum来安装nginx相关的服务
yum install -y nginx
安装完毕之后,我们启动nginx,并检查nginx状态
# 启动nginx
systemctl start nginx
# 查看nginx服务状态
systemctl status nginx
服务正常运行之后,接下来我们创建一个目录,将我们的证书文件放入其中,个人使用可以从阿里云或者腾讯云等云平台申请免费的证书
# 创建目录存放证书,将证书文件复制到里面,示例证书文件为:mstmdev.com_bundle.crt mstmdev.com.key
mkdir /etc/nginx/ssl_cert/
证书准备完毕之后,我们开始最后一步,编辑我们的nginx配置文件
vim /etc/nginx/nginx.conf
以下为修改后的配置文件,目的是将我们服务器上的http请求全部重定向到https上,并将https上的请求转发到内网服务192.168.202.151:30880
之中,让我们可以通过外网域名访问我们的服务。
# For more information on configuration, see:
# * Official English Documentation: http://nginx.org/en/docs/
# * Official Russian Documentation: http://nginx.org/ru/docs/
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 4096;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
upstream kubesphere{
server 192.168.202.151:30880;
}
# server {
# listen 80;
# listen [::]:80;
# server_name _;
# root /usr/share/nginx/html;
# # Load configuration files for the default server block.
# include /etc/nginx/default.d/*.conf;
# error_page 404 /404.html;
# location = /404.html {
# }
# error_page 500 502 503 504 /50x.html;
# location = /50x.html {
# }
# }
server {
listen 80;
server_name mstmdev.com;
access_log /var/log/nginx/mstmdev_com_access.log main;
# 将http请求重定向为https
rewrite ^(.*)$ https://$host$1 permanent;
}
# Settings for a TLS enabled server.
#
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name gors.cc;
# root /usr/share/nginx/html;
#
# 这里就是配置我们刚才存放的证书文件的路径
ssl_certificate "/etc/nginx/ssl_cert/mstmdev.com_bundle.crt";
ssl_certificate_key "/etc/nginx/ssl_cert/mstmdev.com.key";
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
#
# # Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
#
# error_page 404 /404.html;
# location = /40x.html {
# }
#
# error_page 500 502 503 504 /50x.html;
# location = /50x.html {
# }
access_log /var/log/nginx/https_mstmdev_com.log main;
# 将https请求转发到我们的内网服务192.168.202.151:30880中
location / {
proxy_pass http://kubesphere/;
}
}
}
配置文件修改完毕之后,重启nginx,使配置生效
systemctl restart nginx
此时我们将自己的域名的DNS解析到我们服务器的公网IP地址就可以在外网通过HTTPS地址访问kubesphere
后台了。
如果想要在服务器重启后自动启动nginx,可以将其设置为开机启动
systemctl enable nginx
如果不再需要开机启动,将其禁用即可
systemctl disable nginx
更多详细的配置可以参考官方的文档:https://nginx.org/en/docs/
作者: 陌上荼靡