Nginx 从入门到实践：部署、配置、反向代理与负载均衡全解

一、Nginx 核心特点事件驱动模型epoll/kqueue异步非阻塞 I/O单进程可处理万级并发内存占用极低。轻量CPU/内存消耗小配置简洁。多角色Web 服务器、反向代理、负载均衡、HTTP 缓存、SSL 终端、限流/防盗链/gzip、虚拟主机等。架构Master-Worker 多进程。Masterroot 运行读取配置、管理 worker、接收信号启动/停止/reload。Worker业务处理单线程异步非阻塞worker_processes auto自动等于 CPU 核心数互相独立。热重载流程master 校验新配置 → 启动新 worker加载新配置→ 旧 worker 处理完现有连接后退出 → 服务不中断。二、安装与基础部署节点规划示例节点IP角色nginx-server10.1.8.10/24Nginx 服务端nginx-client10.1.8.11/24客户端测试安装步骤CentOS 7bash# 添加 EPEL 源wget-O/etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo yum-yinstallnginx systemctlenablenginx--now# 准备测试页echoHello World From Nginx/usr/share/nginx/html/index.html# 防火墙放行 httpfirewall-cmd --add-servicehttp--permanentfirewall-cmd--reload测试修改客户端 hosts添加10.1.8.10 www.laogao.cloud然后curl http://www.laogao.cloud验证。三、配置文件结构层级嵌套text全局块 → events块 → http块 → server块 → location块全局块user,worker_processes,error_log,pid,include等。events 块网络连接参数如worker_connections 1024; use epoll;。http 块HTTP 服务公共配置可包含多个server。server 块虚拟主机配置监听端口、域名、根目录等。location 块URI 路径匹配规则。四、Location 匹配规则优先级从高到低规则示例说明精确匹配location /login最高优先级完全一致^~前缀匹配location ^~ /static/匹配开头跳过正则~大小写敏感正则location ~ .(jpgpng)$~*大小写不敏感正则location ~* .(jpgpng)$普通前缀location /api/最长前缀优先/兜底location /最低优先级五、核心功能详解1. 静态 Web 服务器nginxserver { listen 80; server_name static.test.com; root /data/static; index index.html; }利用sendfile零拷贝高性能。2. 反向代理Proxy正向代理代理客户端翻墙。反向代理代理服务端客户端无感知。核心指令proxy_pass http://后端地址;常用代理头传递客户端真实信息nginxlocation /api/ { proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; }proxy_pass 末尾带/与不带/的区别带/剔除匹配路径前缀拼接剩余部分。例location /api/ { proxy_pass http://backend/; }→ 请求/api/user→ 后端接收/user。不带/保留匹配路径前缀直接拼接。例location /api/ { proxy_pass http://backend; }→ 请求/api/user→ 后端接收/api/user。3. 负载均衡upstream定义后端服务器组结合proxy_pass使用。nginxupstream backend_pool { server 192.168.1.10:8080 weight3; server 192.168.1.11:8080 weight2; server 192.168.1.12:8080 backup; # 备份 server 192.168.1.13:8080 down; # 下线 }常见调度算法算法配置说明轮询默认无依次分发权重weightweightN按比例分配性能高者多承担IP 哈希ip_haship_hash;同一客户端 IP 固定到同一后端解决 session通用哈希hashhash $变量;自定义键如 cookie/url做哈希consistent可减少抖动最少连接least_connleast_conn;分给活跃连接数最少的后端支持 weight最少时间least_timeleast_time header;商业版根据响应时间调度4. HTTPS/SSL 终端nginxserver { listen 443 ssl http2; server_name www.test.com; ssl_certificate /etc/nginx/cert/fullchain.pem; ssl_certificate_key /etc/nginx/cert/privkey.key; ssl_protocols TLSv1.2 TLSv1.3; # ... root, location 等 } # HTTP 强制跳转 HTTPS server { listen 80; server_name www.test.com; return 301 https://$host$request_uri; }生成自签名证书bashopenssl genrsa-outwww.key2048openssl req-new-keywww.key-outwww.csr-subj/CCN/STJS/LNJ/OLG/OUDEV/CNwww.laogao.cloudopenssl x509-req-days3650-inwww.csr-signkeywww.key-outwww.crt5. 其他实用功能gzip 压缩减少传输带宽。nginxgzip on; gzip_types text/plain text/css application/json application/javascript;访问控制IP 黑白名单nginxlocation /admin { allow 192.168.1.0/24; deny all; }限流limit_req、防盗链valid_referers、缓存proxy_cache、重写rewrite。六、虚拟主机配置同一服务器提供多个站点支持基于域名server_name基于端口listen基于 IP不常用示例基于域名nginxserver { server_name web1.laogao.cloud; root /usr/share/nginx/web1; } server { server_name web2.laogao.cloud; root /usr/share/nginx/web2; }测试时修改客户端 hosts 解析域名。七、基本认证HTTP Basic Authnginxlocation /auth-basic/ { auth_basic Basic Auth; auth_basic_user_file /etc/nginx/.htpasswd; }创建用户bashhtpasswd-bc/etc/nginx/.htpasswd laogao123456八、PHP 站点配置PHP-FPM安装php php-fpm并启动。nginxlocation ~ \.php$ { try_files $uri 404; fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; }九、反向代理综合示例nginxupstream backend_main { server 192.168.1.200:8080; } upstream backend_api { server 192.168.1.201:9090; } upstream backend_static { server 192.168.1.202:80; } server { listen 80; server_name localhost; location /login { proxy_pass http://backend_login; proxy_set_header Host $host; } location ^~ /static/ { proxy_pass http://backend_static/; } location ~* \.(jpg|png|gif)$ { proxy_pass http://backend_static; } location /api/ { proxy_pass http://backend_api/; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } location / { proxy_pass http://backend_main; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } }匹配流程示例请求 URL命中 location转发后端 URL/login精确http://backend_login/login/static/css/main.css^~ /static/http://backend_static/css/main.css/api/user/info/api/http://backend_api/user/info/index.html/兜底http://backend_main/index.html十、常用命令与日志命令bashnginx# 启动nginx-sstop# 快速停止nginx-squit# 优雅停止nginx-sreload# 重载配置热更新nginx-t# 检查配置文件语法日志access.log记录每次请求格式可自定义log_format。error.log记录错误排查 502/504/403 等。常见错误502 Bad Gateway后端服务不可达端口/防火墙/服务宕机。504 Gateway Timeout后端响应超时。499客户端主动断开。403权限/目录/索引文件问题。十一、生产调优小贴士worker_processes auto;自动匹配 CPU 核心数。worker_connections适当调大系统ulimit -n也要调高。开启sendfile on; tcp_nopush on; tcp_nodelay on;优化网络传输。使用keepalive_timeout控制长连接超时。合理利用location匹配顺序避免冗余规则。