Linux: 企业级高性能 WEB 服务 Nginx

http://baijiahao.baidu.com/s?id=1643187950686234006&wfr=spider&for=pc #用户体验的重要性
http://www.sohu.com/a/218426004_573333

#内存1G
[root@centos8 ~]#free -h
[root@centos8 ~]#cat /proc/sys/fs/file-max
92953

#内存2G
[root@centos8 ~]#free -h
[root@centos8 ~]#cat /proc/sys/fs/file-max
195920

[root@centos8 ~]#grep -R FD_SETSIZE linux-5.8/*
linux-5.8/Documentation/userspace-api/media/v4l/func-select.rst:
 ``FD_SETSIZE``.
linux-5.8/include/uapi/linux/posix_types.h:#undef __FD_SETSIZE
linux-5.8/include/uapi/linux/posix_types.h:#define __FD_SETSIZE 1024 #单个进程能
够监视的文件描述符的文件最大数量

[root@centos8 ~]#whatis epoll
epoll (7)       - I/O event notification facility
[root@centos8 ~]#whatis select
select (2)      - synchronous I/O multiplexing
select (3)      - synchronous I/O multiplexing
select (3p)      - synchronous I/O multiplexing
[root@centos8 ~]#whatis poll
poll (2)       - wait for some event on a file descriptor
poll (3p)       - input/output multiplexing
[root@centos8 ~]#man 2 select
SELECT(2)                        Linux Programmer's
Manual                        SELECT(2)
NAME
   select, pselect, FD_CLR, FD_ISSET, FD_SET, FD_ZERO - synchronous I/O
multiplexing
[root@centos8 ~]#man 2 poll
POLL(2)                         Linux Programmer's
Manual                         POLL(2)
NAME
   poll, ppoll - wait for some event on a file descriptor

[root@Centos7 ~]#vim /etc/yum.repos.d/nginx.repo
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

#列出所有版本
[root@centos8 ~]#yum list nginx --showduplicates

[root@Centos7 ~]# yum install -y nginx
[root@Centos7 ~]# rpm -ql nginx
/etc/logrotate.d/nginx
/etc/nginx/fastcgi.conf
/etc/nginx/fastcgi.conf.default
/etc/nginx/fastcgi_params
/etc/nginx/fastcgi_params.default
/etc/nginx/koi-utf
/etc/nginx/koi-win
/etc/nginx/mime.types
/etc/nginx/mime.types.default
/etc/nginx/nginx.conf
/etc/nginx/nginx.conf.default
/etc/nginx/scgi_params
/etc/nginx/scgi_params.default
/etc/nginx/uwsgi_params
/etc/nginx/uwsgi_params.default
/etc/nginx/win-utf
/usr/bin/nginx-upgrade
/usr/lib/systemd/system/nginx.service
/usr/lib64/nginx/modules
/usr/sbin/nginx
/usr/share/doc/nginx-1.18.0
.................
/var/lib/nginx
/var/lib/nginx/tmp
/var/log/nginx

[root@Centos7 ~]# which nginx
/usr/sbin/nginx

[root@centos8 ~]#yum -y install gcc pcre-devel openssl-devel zlib-devel
[root@centos8 ~]#useradd -s /sbin/nologin nginx

[root@centos8 ~]#cd /usr/local/src/
[root@centos8 src]#wget http://nginx.org/download/nginx-1.18.0.tar.gz
[root@centos8 src]#tar xf nginx-1.18.0.tar.gz
[root@centos8 src]#cd nginx-1.18.0/
[root@centos8 nginx-1.18.0]#./configure --prefix=/apps/nginx \
--user=nginx \
--group=nginx \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_realip_module \
--with-http_stub_status_module \
--with-http_gzip_static_module \
--with-pcre \
--with-stream \
--with-stream_ssl_module \
--with-stream_realip_module

[root@centos8 nginx-1.18.0]#make && make install

#修改权限
[root@centos8 nginx-1.18.0]#chown -R nginx.nginx /apps/nginx

#生成目录
[root@centos8 nginx-1.18.0]#ll /apps/nginx/
total 0
drwxr-xr-x 2 root root 333 Sep 22 12:49 conf
drwxr-xr-x 2 root root  40 Sep 22 12:49 html
drwxr-xr-x 2 root root  6 Sep 22 12:49 logs
drwxr-xr-x 2 root root  19 Sep 22 12:49 sbin

[root@centos8 ~]#cat /apps/nginx/html/test.php
<?php
phpinfo();
?>

[root@centos7 ~]#curl 10.0.0.8/test.php -I
HTTP/1.1 200 OK
Server: nginx/1.18.0
Date: Thu, 24 Sep 2020 13:54:39 GMT
Content-Type: application/octet-stream
Content-Length: 20
Last-Modified: Thu, 24 Sep 2020 13:53:26 GMT
Connection: keep-alive
ETag: "5f6ca4d6-14"
Accept-Ranges: bytes

[root@centos8 ~]#vim /apps/nginx/conf/nginx.conf
http {
 include    mime.types;
 default_type text/html;
......
[root@centos8 ~]#nginx -s reload

[root@centos7 ~]#curl 10.0.0.8/index.html -I
HTTP/1.1 200 OK
Server: nginx/1.18.0
Date: Thu, 24 Sep 2020 13:56:26 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Thu, 24 Sep 2020 12:13:03 GMT
Connection: keep-alive
ETag: "5f6c8d4f-264"
Accept-Ranges: bytes

#是否在响应报文中的Content-Type显示指定的字符集，默认off不显示
charset charset | off;

#示例
charset utf-8;

#是否在响应报文的Server首部显示nginx版本
server_tokens on | off | build | string;

如果想自定义响应报文的nginx版本信息，需要修改源码文件，重新编译
如果server_tokens on，修改 src/core/nginx.h 修改第13-14行，如下示例
#define NGINX_VERSION   "1.68.9"
#define NGINX_VER     "cicinginx/" NGINX_VERSION

如果server_tokens off，修改 src/http/ngx_http_header_filter_module.c
第49行，如下示例：
static char ngx_http_server_string[] = "Server: nginx" CRLF;
把其中的nginx改为自己想要的文字即可,如：cicinginx

[root@centos8 ~]#vim /usr/local/src/nginx-1.18.0/src/core/nginx.h
#define NGINX_VERSION   "1.68.9"
#define NGINX_VER     "cicinginx/" NGINX_VERSION

[root@centos8 ~]#vim nginx-1.18.0/src/http/ngx_http_header_filter_module.c
static u_char ngx_http_server_string[] = "Server: cici-nginx" CRLF;

[root@centos7 ~]#curl -I www.cici.org
HTTP/1.1 200 OK
Server: ciciginx/1.68.9
Date: Thu, 24 Sep 2020 07:44:05 GMT
Content-Type: text/html
Content-Length: 8
Last-Modified: Wed, 23 Sep 2020 14:39:21 GMT
Connection: keep-alive
ETag: "5f6b5e19-8"
Accept-Ranges: bytes

[root@centos8 ~]#vim /apps/nginx/conf/conf.d/pc.conf
server {
  ......
  server_tokens off;
  ......

[root@centos7 ~]#curl -I www.cici.org
HTTP/1.1 200 OK
Server: cici-nginx
Date: Thu, 24 Sep 2020 07:44:59 GMT
Content-Type: text/html
Content-Length: 8
Last-Modified: Wed, 23 Sep 2020 14:39:21 GMT
Connection: keep-alive
ETag: "5f6b5e19-8"
Accept-Ranges: bytes

[root@s2 ~]# mkdir /apps/nginx/conf/conf.d
[root@s2 ~]# vim /apps/nginx/conf/nginx.conf
http {
    ......
    include /apps/nginx/conf/conf.d/*.conf; #在配置文件的最后面添加此行
}

#创建PC网站配置
[root@s2 ~]# cat /apps/nginx/conf/conf.d/pc.conf
server {
  listen 80;
  server_name www.cici.net;
  location / {
    root /data/nginx/html/pc;
  }
}

[root@s2 ~]# mkdir /data/nginx/html/pc -p
[root@s2 ~]# echo "pc web" > /data/nginx/html/pc/index.html

[root@s2 ~]# systemctl reload nginx
#访问测试

[root@s2 ~]# cat /apps/nginx/conf/conf.d/mobile.conf
server {
  listen 80;
  server_name mobile.cici.net;
  location / {
    root /data/nginx/html/mobile;
  }
}

[root@s2 ~]# mkdir /data/nginx/html/mobile -p
[root@s2 ~]# echo "mobile web" >> /data/nginx/html/mobile/index.html

[root@s2 ~]# systemctl reload nginx

server {
  listen 80;
  server_name www.cici.net;
  location / {
    root /data/nginx/html/pc;
  }

  location /about {
    root /data/nginx/html/pc; #必须要在html目录中创建一个about目录才可以访问，否则报错。
    index index.html;
  }
}

[root@s2 ~]# mkdir /data/nginx/html/pc/about
[root@s2 ~]# echo about > /data/nginx/html/pc/about/index.html

#重启Nginx并访问测试

server {
  listen 80;
  server_name www.cici.net;
  location / {
    root /data/nginx/html/pc;
  }

  location /about { #使用alias的时候uri后面如果加了斜杠则下面的路径配置必须加斜杠，否则403
    alias /data/nginx/html/pc; #当访问about的时候，会显示alias定义的/data/nginx/html/pc里面的内容。
    index index.html;
  }
}

重启Nginx并访问测试
http://www.cici.net/about/index.html #访问指定文件资源

语法规则：
location [=|~|~*|^~] /uri/ { … }

=   #用于标准uri前，需要请求字串与uri精确匹配，如果匹配成功就停止向下匹配并立即处理请求。
~   #用于标准uri前，表示包含正则表达式并且区分大小写，并且匹配
!~  #用于标准uri前，表示包含正则表达式并且区分大小写，并且不匹配

~*  #用于标准uri前，表示包含正则表达式并且不区分大写，并且匹配
!~* #用于标准uri前，表示包含正则表达式并且不区分大小写,并且不匹配

^~  #用于标准uri前，表示包含正则表达式并且匹配以什么开头
$   #用于标准uri前，表示包含正则表达式并且匹配以什么结尾
\   #用于标准uri前，表示包含正则表达式并且转义字符。可以转. * ?等
*   #用于标准uri前，表示包含正则表达式并且代表任意长度的任意字符

#匹配优先级从高到低：
=, ^~, ~/~*, 不带符号

location /about {
    alias /data/nginx/html/pc;
    index index.html;
    deny 192.168.1.1;
    allow 192.168.1.0/24;
    allow 10.1.1.0/16;
    allow 2001:0db8::/32;
    deny all; #先允许小部分，再拒绝大部分
}

#CentOS安装包
[root@centos8 ~]#yum -y install httpd-tools
#Ubuntu安装包
[root@Ubuntu ~]#apt -y install apache2-utils

#创建用户
#-b 非交互式方式提交密码
[root@s2 ~]# htpasswd -cbm /apps/nginx/conf/.htpasswd user1 123456
Adding password for user user1
[root@s2 ~]# htpasswd -bm /apps/nginx/conf/.htpasswd user2 123456
Adding password for user user2
[root@s2 ~]# tail /apps/nginx/conf/.htpasswd
user1:$apr1$Rjm0u2Kr$VHvkAIc5OYg.3ZoaGwaGq/
user2:$apr1$nIqnxoJB$LR9W1DTJT.viDJhXa6wHv.

[root@s2 ~]# vim /apps/nginx/conf/conf.d/pc.conf
  location = /login/ {
    root /data/nginx/html/pc;
    index index.html;
    auth_basic          "login password";
    auth_basic_user_file /apps/nginx/conf/.htpasswd;
  }

重启Nginx并访问测试

listen 80;
server_name www.cici.net;
error_page 500 502 503 504 404 /error.html;
location = /error.html {
  root html;
}
重启nginx并访问不存在的页面进行测试

[root@s2 ~]# mkdir /data/nginx/logs
  listen 80;
  server_name www.cici.net;
  error_page 500 502 503 504 404 /error.html; #默认目录下面创建error.html页面
  access_log /data/nginx/logs/www-cici-net_access.log;
  error_log /data/nginx/logs/www-cici-net_error.log;
  location = /error.html {
    root html;
  }
重启nginx并访问不存在的页面进行测试并验证是在指定目录生成新的日志文件

location /about {
  root /data/nginx/html/pc;
  #alias /data/nginx/html/pc;
  index index.html;
  #try_files $uri /about/default.html;
  #try_files $uri $uri/index.html $uri.html /about/default.html;
  try_files $uri $uri/index.html $uri.html =489;
}

[root@s2 ~]# echo "default" >> /data/nginx/html/pc/about/default.html

#重启nginx并测试，当访问到http://www.cici.net/about/xx.html等不存在的uri会显示default，如果是自定义的状态码则会显示在返回数据的状态码中，如：
[root@s2 about]# curl --head http://www.cici.net/about/xx.html
HTTP/1.1 489 #489就是自定义的状态返回码
Server: nginx
Date: Thu, 21 Feb 2019 00:11:40 GMT
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=65

keepalive_timeout timeout [header_timeout];  #设定保持连接超时时长，0表示禁止长连接，默认为75s，通常配置在http字段作为站点全局配置

keepalive_requests number;  #在一次长连接上所允许请求的资源的最大数量，默认为100次,建议适当调大,比如:500

keepalive_requests 3;
keepalive_timeout 65 65; #开启长连接后，返回客户端的会话保持时间为60s，单次长连接累计请求达到指定次数请求或65秒就会被断开，后面的60为发送给客户端应答报文头部中显示的超时时间设置为60s：如不设置客户端将不显示超时时间。
Keep-Alive:timeout=60 #浏览器收到的服务器返回的报文

#如果设置为0表示关闭会话保持功能，将如下显示：
Connection:close #浏览器收到的服务器返回的报文


#使用命令测试：
[root@s3 apps]# telnet www.cici.net 80
Trying 172.18.200.102...
Connected to www.cici.net.
Escape character is '^]'.
GET / HTTP/1.1
HOST: www.cici.net

#Response Headers(响应头信息)：
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 14 Mar 2019 17:23:46 GMT
Content-Type: text/html
Content-Length: 7
Last-Modified: Thu, 14 Mar 2019 14:54:50 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "5c8a6b3a-7"
Accept-Ranges: bytes

#页面内容
pc web

autoindex on | off;#自动文件索引功能，默为off
autoindex_exact_size on | off;  #计算文件确切大小（单位bytes），off 显示大概大小（单位K、M)，默认on
autoindex_localtime on | off ; #显示本机时间而非GMT(格林威治)时间，默认off
autoindex_format html | xml | json | jsonp; #显示索引的页面文件风格，默认html
limit_rate rate; #限制响应客户端传输速率(除GET和HEAD以外的所有方法)，单位B/s,即bytes/second，默认值0,表示无限制,此指令由ngx_http_core_module提供

#注意:download不需要index.html文件
[root@s2 about]# mkdir /data/nginx/html/pc/download

[root@s2 about]# vim /apps/nginx/conf/conf.d/pc.conf
  location /download {
    autoindex on;            #自动索引功能
    autoindex_exact_size on; #计算文件确切大小（单位bytes），off只显示大概大小（单位kb、mb、gb）
    autoindex_localtime on;  #显示本机时间而非GMT(格林威治)时间
    limit_rate 1024k;
    root /data/nginx/html/pc;
  }

[root@s2 pc]# cp /root/anaconda-ks.cfg /data/nginx/html/pc/download/
#重启Nginx并访问测试下载页面

#更新时间
ntpdate time1.aliyun.com

client_max_body_size 1m； #设置允许客户端上传单个文件的最大值，默认值为1m
client_body_buffer_size size; #用于接收每个客户端请求报文的body部分的缓冲区大小；默认16k；超出此大小时，其将被暂存到磁盘上的由下面client_body_temp_path指令所定义的位置
client_body_temp_path path [level1 [level2 [level3]]];
#设定存储客户端请求报文的body部分的临时存储路径及子目录结构和数量，目录名为16进制的数字，使用hash之后的值从后往前截取1位、2位、2位作为文件名：

[root@s3 ~]# md5sum /data/nginx/html/pc/index.html
95f6f65f498c74938064851b1bb 96 3d 4 /data/nginx/html/pc/index.html

1级目录占1位16进制，即2^4=16个目录 0-f
2级目录占2位16进制，即2^8=256个目录 00-ff
3级目录占2位16进制，即2^8=256个目录 00-ff

#配置示例：
    client_max_body_size 100m； #如果太大，上传时会出现下图的413错误,注意:如果php上传,还需要修改php.ini的相关配置
    client_body_buffer_size 1024k;
    client_body_temp_path /apps/nginx/temp 1 2 2; #reload Nginx会自动创建temp目录

keepalive_disable none | browser ...;
#对哪种浏览器禁用长连接

limit_except method ... { ... }，仅用于location
#限制客户端使用除了指定的请求方法之外的其它方法
method:GET, HEAD, POST, PUT, DELETE，MKCOL, COPY, MOVE, OPTIONS, PROPFIND,PROPPATCH, LOCK, UNLOCK, PATCH
limit_except GET {
    allow 192.168.0.0/24;
    allow 192.168.7.101;
    deny all;
}

#除了GET和HEAD 之外其它方法仅允许192.168.1.0/24网段主机使用
[root@s2 about]# mkdir /data/nginx/html/pc/upload
[root@s2 about]# echo "upload" > /data/nginx/html/pc/upload/index.html
[root@s2 about]# vim /apps/nginx/conf/conf.d/pc.conf
  location /upload {
    root /data/cici/pc;
    index index.html;
    limit_except GET {
      allow 172.18.200.101;
      deny all;
    }
  }

#重启Nginx并进行测试上传文件
[root@s2 pc]# systemctl restart nginx
[root@s2 pc]#
[root@s2 pc]# curl -XPUT /etc/issue http://www.cici.net/about
curl: (3) <url> malformed
<html>
<head><title>405 Not Allowed</title></head> #Nginx已经允许但是程序未支持上传功能
<body bgcolor="white">
<center><h1>405 Not Allowed</h1></center>
<hr><center>nginx</center>
</body>
</html>
[root@s1 ~]# curl -XPUT /etc/issue http://www.cici.net/upload
curl: (3) <url> malformed
<html>
<head><title>403 Forbidden</title></head> #Nginx拒绝上传
<body bgcolor="white">
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx</center>
</body>
</html>

aio on | off #是否启用asynchronous file I/O(AIO)功能，需要编译开启
linux 2.6以上内核提供以下几个系统调用来支持aio：
1、SYS_io_setup：建立aio 的context
2、SYS_io_submit: 提交I/O操作请求
3、SYS_io_getevents：获取已完成的I/O事件
4、SYS_io_cancel：取消I/O操作请求
5、SYS_io_destroy：毁销aio的context

directio size | off; #directio是直接读写文件到磁盘，启用直接I/O，默认为关闭，当文件大于等于给定大小时，例如directio 4m，可以和sebdfile结合使用，比如当大于此值使用AIO，当小于此值使用sendfile。

open_file_cache off; #是否缓存打开过的文件信息，一般加到主配置文件
open_file_cache max=N [inactive=time];
    nginx可以缓存以下三种信息：
    (1) 文件元数据：文件的描述符、文件大小和最近一次的修改时间
    (2) 打开的目录结构
    (3) 没有找到的或者没有权限访问的文件的相关信息
    max=N：可缓存的缓存项上限数量；达到上限后会使用LRU(Least recently used，最近最少使用)算法实现管理
    inactive=time：缓存项的非活动时长，在此处指定的时长内未被命中的或命中的次数少于open_file_cache_min_uses指令所指定的次数的缓存项即为非活动项，将被删除

open_file_cache_errors on | off;
    是否缓存查找时发生错误的文件一类的信息
    默认值为off

open_file_cache_min_uses number;
    open_file_cache指令的inactive参数指定的时长内，至少被命中此处指定的次数方可被归类为活动项默认值为1

open_file_cache_valid time;
    缓存项有效性的检查验证频率，默认值为60s

open_file_cache max=10000 inactive=60s; #最大缓存10000个文件，非活动数据超时时长60s
open_file_cache_valid 60s;  #每间隔60s检查一下缓存数据有效性
open_file_cache_min_uses 5; #60秒内至少被命中访问5次才被标记为活动数据
open_file_cache_errors on;  #缓存错误信息

server_tokens off; #隐藏Nginx server版本。

open_file_cache max=10000 inactive=60s; #最大缓存10000个文件，非活动数据超时时长60s
open_file_cache_valid  60s;  #每间隔60s检查一下缓存数据有效性
open_file_cache_min_uses 5; #60秒内至少被命中访问5次才被标记为活动数据
open_file_cache_errors  on; #缓存错误信息

set $name cici;
echo $name;
set $my_port $server_port;
echo $my_port;
echo "$server_name:$server_port";

log_format nginx_format1 '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"'
'$server_name:$server_port';

access_log logs/access.log nginx_format1;

#重启nginx并访问测试日志格式
==> /apps/nginx/logs/access.log <==
192.168.0.1 - - [22/Feb/2019:08:44:14 +0800] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0" "-"www.cici.net:80

log_format access_json '{"@timestamp":"$time_iso8601",'
    '"host":"$server_addr",'
    '"clientip":"$remote_addr",'
    '"size":$body_bytes_sent,'
    '"responsetime":$request_time,' #总的处理时间
    '"upstreamtime":"$upstream_response_time",'
    '"upstreamhost":"$upstream_addr",'  #后端应用服务器处理时间
    '"http_host":"$host",'
    '"uri":"$uri",'
    '"domain":"$host",'
    '"xff":"$http_x_forwarded_for",'
    '"referer":"$http_referer",'
    '"tcp_xff":"$proxy_protocol_addr",'
    '"http_user_agent":"$http_user_agent",'
    '"status":"$status"}';
access_log /apps/nginx/logs/access_json.log access_json;

#重启Nginx并访问测试日志格式
{"@timestamp":"2019-02-22T08:55:32+08:00","host":"192.168.7.102","clientip":"192.168.0.1","size":162,"response time":0.000,"upstreamtime":"-","upstreamhost":"-
","http_host":"www.cici.net","uri":"/favicon.ico","domain":"www.cici.net","xff":"-","referer":"-","tcp_xff":"","http_user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64;
x64; rv:65.0) Gecko/20100101 Firefox/65.0","status":"404"}

#!/usr/bin/env python
#coding:utf-8
#Author:Zhang ShiJie
status_200= []
status_404= []
with open("access_json.log") as f:
    for line in f.readlines():
        line = eval(line)
        if line.get("status") == "200":
            status_200.append(line.get)
        elif line.get("status") == "404":
            status_404.append(line.get)
        else:
            print("状态码 ERROR")
f.close()

print "状态码200的有--:",len(status_200)
print "状态码404的有--:",len(status_404)

#保存日志文件到指定路径并进测试：
[root@s2 ~]# python nginx_json.py
状态码200的有--: 1910
状态码404的有--: 13

ssl on | off;
#为指定的虚拟主机配置是否启用ssl功能，此功能在1.15.0废弃，使用listen [ssl]替代。

ssl_certificate /path/to/file;
#当前虚拟主机使用使用的公钥文件，一般是crt文件

ssl_certificate_key /path/to/file;
#当前虚拟主机使用的私钥文件，一般是key文件

ssl_protocols [SSLv2] [SSLv3] [TLSv1] [TLSv1.1] [TLSv1.2];
#支持ssl协议版本，早期为ssl,现在是TSL，默认为后三个

ssl_session_cache off | none | [builtin[:size]] [shared:name:size];
#配置ssl缓存
    off： 关闭缓存
    none: 通知客户端支持ssl session cache，但实际不支持
    builtin[:size]：使用OpenSSL内建缓存，为每worker进程私有
    [shared:name:size]：在各worker之间使用一个共享的缓存，需要定义一个缓存名称和缓存空间大小，一兆可以存储4000个会话信息，多个虚拟主机可以使用相同的缓存名称。

ssl_session_timeout time;#客户端连接可以复用ssl session cache中缓存的有效时长，默认5m

#自签名CA证书
[root@s2 ~]# cd /apps/nginx/
[root@s2 nginx]# mkdir certs
[root@s2 nginx]# cd certs/
[root@s2 nginx]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 3650 -out ca.crt #自签名CA证书
Generating a 4096 bit RSA private key
.................++
.....
Country Name (2 letter code) [XX]:CN #国家代码,https://country-code.cl/
State or Province Name (full name) []:BeiJing #省份
Locality Name (eg, city) [Default City]:Beijing #城市名称
Organization Name (eg, company) [Default Company Ltd]:cici.Ltd #公司名称
Organizational Unit Name (eg, section) []:cici #部门
Common Name (eg, your name or your server's hostname) []:cici.ca #通用名称
Email Address []:[email protected] #邮箱
[root@s2 certs]# ll ca.crt
-rw-r--r-- 1 root root 2118 Feb 22 12:10 ca.crt

#自制key和csr文件
[root@s2 certs]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout www.cici.net.key -out www.cici.net.csr
Generating a 4096 bit RSA private key
........................................................................++......
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BeiJing
Locality Name (eg, city) [Default City]:BeiJing
Organization Name (eg, company) [Default Company Ltd]:cici.net
Organizational Unit Name (eg, section) []:cici.net
Common Name (eg, your name or your server's hostname) []:www.cici.net
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@s2 certs]# ll
total 16
-rw-r--r-- 1 root root 2118 Feb 22 12:10 ca.crt
-rw-r--r-- 1 root root 3272 Feb 22 12:10 ca.key
-rw-r--r-- 1 root root 1760 Feb 22 12:18 www.cici.net.csr
-rw-r--r-- 1 root root 3272 Feb 22 12:18 www.cici.net.key

#签发证书
[root@s2 certs]# openssl x509 -req -days 3650 -in www.cici.net.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out www.cici.net.crt
Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJing/O=cici.net/OU=cici.net/CN=www.cici.net/emailAd
dress[email protected]
Getting CA Private Key

#验证证书内容
[root@s2 certs]# openssl x509 -in www.cici.net.crt -noout -text
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            bb:76:ea:fe:f4:04:ac:06
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=BeiJing, L=Beijing, O=cici.Ltd, OU=cici,
CN=cici.ca/[email protected]
        Validity
            Not Before: Feb 22 06:14:03 2019 GMT
            Not After : Feb 22 06:14:03 2020 GMT
        Subject: C=CN, ST=BeiJing, L=BeiJing, O=cici.net, OU=cici.net,
CN=www.cici.net/[email protected]
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)

listen 80;
listen 443 ssl;
ssl_certificate /apps/nginx/certs/www.cici.net.crt;
ssl_certificate_key /apps/nginx/certs/www.cici.net.key;
ssl_session_cache shared:sslcache:20m;
ssl_session_timeout 10m;
#重启Nginx并访问验证

[root@centos8 ~]#nginx -V
nginx version: nginx/1.18.0
built by gcc 8.3.1 20191121 (Red Hat 8.3.1-5) (GCC)
built with OpenSSL 1.1.1c FIPS  28 May 2019
TLS SNI support enabled
configure arguments: --prefix=/apps/nginx --user=nginx --group=nginx --with-
http_ssl_module --with-http_v2_module --with-http_realip_module --with-
http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream
--with-stream_ssl_module --with-stream_realip_module --add-module=../echo-nginx-
module/

#制作key和csr文件
[root@s2 certs]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout mobile.cici.net.key -out mobile.cici.net.csr
Generating a 4096 bit RSA private key
..........
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BeiJing
Locality Name (eg, city) [Default City]:BeiJing
Organization Name (eg, company) [Default Company Ltd]:cici
Organizational Unit Name (eg, section) []:cici
Common Name (eg, your name or your server's hostname) []:mobile.cici.net
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

#签名证书
[root@s2 certs]# openssl x509 -req -days 3650 -in mobile.cici.net.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out mobile.cici.net.crt

Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJing/O=cici/OU=cici/CN=mobile.cici.net/emailAddress
[email protected]
Getting CA Private Key

#验证证书内容
[root@s2 certs]# openssl x509 -in mobile.cici.net.crt -noout -text
Certificate:
Data:
Version: 1 (0x0)
Serial Number:
bb:76:ea:fe:f4:04:ac:07
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=CN, ST=BeiJing, L=Beijing, O=cici.Ltd, OU=cici,
CN=cici.ca/[email protected]
Validity
Not Before: Feb 22 13:50:43 2019 GMT
Not After : Feb 19 13:50:43 2029 GMT
Subject: C=CN, ST=BeiJing, L=BeiJing, O=cici, OU=cici,
CN=mobile.cici.net/[email protected]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (4096 bit)
..............

#合并证书文件
[root@centos8 certs]#cat mobile.cici.net.crt ca.crt > mobile.cici.net.pem

#Nginx 配置
[root@s2 certs]# cat /apps/nginx/conf/conf.d/mobile.conf
server {
listen 80;
server_name mobile.cici.net;
location / {
root html;
index index.html index.htm;
}
location /linux38 {
root /data/nginx/mobile/html;
index index.html index.htm;
}
location /python {
root /data/nginx/mobile/html;
index index.html index.htm;
}
}
server {
listen 443 ssl;
server_name mobile.cici.net;
ssl_certificate /apps/nginx/certs/mobile.cici.net.pem;
ssl_certificate_key /apps/nginx/certs/mobile.cici.net.key;
ssl_session_cache shared:sslcache:20m;
ssl_session_timeout 10m;
location / {
root html;
index index.html index.htm;
}
}

# vim src/http/ngx_http_header_filter_module.c
49 static u_char ngx_http_server_string[] = "Server: linux38" CRLF; #定义响应报文中的server字段信息

#准备OpenSSL源码包：

cd /usr/local/src
wget https://www.openssl.org/source/openssl-1.1.1h.tar.gz
tar xvf openssl-1.1.1h.tar.gz


#编译安装Nginx并制定新版本OpenSSL路径：
# cd /usr/local/src/nginx-1.16.1/
#./configure --prefix=/apps/nginx --user=nginx --group=nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --withhttp_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --withstream_realip_module --with-select_module --with-file-aio --addmodule=/usr/local/src/echo-nginx-module --with-openssl=/usr/local/src/openssl-1.1.1h
# make && make install

验证并启动Nginx：
# /apps/nginx/sbin/nginx -t
nginx: the configuration file /apps/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /apps/nginx/conf/nginx.conf test is successful
#systemctl restart nginx

#nginx -V

server {
 listen 443 ssl;
 server_name www.cici.org;
 add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
 location / {
   if ( $scheme = http ) {
    rewrite ^/(.*)$ https://www.cici.org/$1 redirect;

   }
 .....
 }
}

# /usr/local/nginx-1.7.0/sbin/nginx -V
nginx version: nginx/1.7.0
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-3) (GCC)
configure arguments: --prefix=/usr/local/nginx-1.7.0 --with-http_stub_status_module

/usr/local/nginx-1.7.0/sbin/nginx -s reload

if （条件匹配） {
    action
}

=： #比较变量和字符串是否相等，相等时if指令认为该条件为true，反之为false。
!=: #比较变量和字符串是否不相等，不相等时if指令认为条件为true，反之为false。
~： #表示在匹配过程中区分大小写字符，（可以通过正则表达式匹配），满足匹配条件为真，不满足为假。
!~：#为区分大小写字符且匹配结果不匹配，不满足为真，满足为假。
~*: #表示在匹配过程中不区分大小写字符，（可以通过正则表达式匹配），满足匹配条件为真，不满足为假。
!~*: #为不区分大小字符且匹配结果不匹配，满足为假，不满足为真。

-f 和 ! -f: #判断请求的文件是否存在和是否不存在
-d 和 ! -d: #判断请求的目录是否存在和是否不存在。
-x 和 ! -x: #判断文件是否可执行和是否不可执行。
-e 和 ! -e: #判断请求的文件或目录是否存在和是否不存在(包括文件，目录，软链接)。

#注意：
#如果$变量的值为空字符串或0，则if指令认为该条件为false，其他条件为true。
#nginx 1.0.1之前$变量的值如果以0开头的任意字符串会返回false

#实例-1：
location /main {
    index index.html;
    default_type text/html;
    if ( $scheme = http ){
      echo "if-----> $scheme";
    }
    if ( $scheme = https ){
      echo "if ----> $scheme";
    }

    #if (-f $request_filename) {
    #   echo "file is exist";
    #}
    if (!-f $request_filename) {
        echo "file is not exist";
        #return 409;
    }
}

location /main {
  root /data/nginx/html/pc;
  index index.html;
  default_type text/html;
  set $name cici;
  echo $name;
  set $my_port $server_port;
  echo $my_port;
}

if ($slow) {
 limit_rate 10k;
 break;
}
location /main {
 root /data/nginx/html/pc;
 index index.html;
 default_type text/html;
 set $name cici;
 echo $name;
 break;  #location块中break后面指令还会执行
 set $my_port $server_port;
 echo $my_port;
}

location /main {
  root /data/nginx/html/pc;
  default_type text/html;
  index index.html;
    if ( $scheme = http ){
      #return 666;
      #return 666 "not allow http";
      #return 301 http://www.baidu.com;
      return 500 "service error";
      echo "if-----> $scheme"; #return后面的将不再执行
    }
    if ( $scheme = https ){
      echo "if ----> $scheme";
    }
}

location /main {
    index index.html;
    default_type text/html;
    set $name cici;
    echo $name;
    rewrite_log on;
    break;
    set $my_port $server_port;
    echo $my_port;
}

#重启nginx，访问并验证error_log：
[root@s2 ~]# tail -f /apps/nginx/logs/error.log
2019/02/27 15:10:02 [warn] 5815#0: *3 using uninitialized "my_port" variable, client:192.168.0.1, server: www.cici.net, request: "GET /main HTTP/1.1", host:"www.cici.net"

redirect;
#临时重定向，重写完成后以临时重定向方式直接返回重写后生成的新URL给客户端，由客户端重新发起请求;
#使用相对路径,或者http://或https://开头，状态码：302

permanent;
#重写完成后以永久重定向方式直接返回重写后生成的新URL给客户端，由客户端重新发起请求，状态码：301

break;
#重写完成后,停止对当前URL在当前location中后续的其它重写操作，而后直接跳转至重写规则配置块之后的其它配置;结束循环，建议在location中使用
#适用于一个URL一次重写

last;
#重写完成后,停止对当前URI在当前location中后续的其它重写操作，而后对新的URL启动新一轮重写检查，不建议在location中使用
#适用于一个URL多次重写，要注意避免出现超过十次以及URL重写后返回错误的给用户

location / {
  root /data/nginx/html/pc;
  index index.html;
  rewrite / http://www.cici.com permanent;
  #rewrite / http://www.cici.com redirect;
}
#重启Nginx并访问域名www.cici.net进行测试

server {
  listen 443 ssl;
  listen 80;
  ssl_certificate /apps/nginx/certs/www.cici.net.crt;
  ssl_certificate_key /apps/nginx/certs/www.cici.net.key;
  ssl_session_cache shared:sslcache:20m;
  ssl_session_timeout 10m;
  server_name www.cici.net;
  location / {
    root /data/nginx/html/pc;
    index index.html;
    if ($scheme = http ){     #未加条件判断，会导致死循环
      rewrite / https://www.cici.net permanent;
    }
  }
}

#重启Nginx并访问测试
[root@s3 ~]# curl -L -k -i https://www.cici.net/
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 15 Mar 2019 19:53:07 GMT
Content-Type: text/html
Content-Length: 7
Last-Modified: Thu, 14 Mar 2019 14:54:50 GMT
Connection: keep-alive
Keep-Alive: timeout=60
ETag: "5c8a6b3a-7"
Accept-Ranges: bytes

pc web

location / {
  root /data/nginx/html/pc;
  index index.html;
  if (!-e $request_filename) {
    #return 404 "linux35";
    rewrite (.*) http://www.cici.net/index.html; #实现客户端浏览器的302跳转
    #rewrite .* /index.html; #web服务器内部跳转
  }
}

#重启Nginx并访问测试

#案例1:如果客户端浏览器包含MSIE，则rewrite客户端请求到/msie目录下
if ( $http_user_agent ~ MSIE){
rewrite ^(.*)$ /msie/$1 break;
}

#案例2: 更换目录访问方式,目录转换为对象存储形式
#要求:
#/20200106/static ->/static?id=20200106
#/20200123/image ->/image?id=20200123
rewrite ^/(\d+)/(.+)/  /$2?id=$l last;

#案例3:多目录转换访问方式
#要求: www.cici.com/images/20200106/1.jpg => www.cici.com/index.do?name=images&dir=20200106=&file=1.jpg
#规则配置:
if ($host ~* (.*)\.cici\.com) {
rewrite ^/(.*)/(\d+)/(.*)$  /index.do?name=$1&dir=$2&file=$3 last;

[root@s2 conf.d]# pwd
/apps/nginx/conf/conf.d

[root@s2 conf.d]# cat ncici.net.conf
server {
  listen 80;
  server_name www.ncici.net;

  location / {
    index index.html;
    root "/data/nginx/html/ncici";
    access_log /apps/nginx/logs/www.ncici.net.log access_json;
  }
}

#准备盗链web页面：
[root@s2 conf.d]# mkdir /data/nginx/html/ncici
[root@s2 conf.d]# cat /data/nginx/html/ncici/index.html
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>盗链页面</title>
</head>
<body>
<a href="http://www.cici.net">测试盗链</a>
<img src="http://www.cici.net/images/1.jpg">
</body>
</html>

#重启Nginx并访问http://www.ncici.net/测试
#验证两个域名的日志，是否会在被盗连的web站点的日志中出现以下盗链日志信息：
==> /apps/nginx/logs/access_json.log <==
{"@timestamp":"2019-02-28T13:27:37+08:00","host":"192.168.7.102","clientip":"192.168.0.1","size":0,"responsetime":0.000,"upstreamtime":"-","upstreamhost":"-","http_host":"www.cici.net","uri":"/images/1.jpg","domain":"www.cici.net","xff":"-","referer":"http://www.ncici.net/","tcp_xff":"","http_user_agent":"Mozilla/5.0(Windows NT 6.1; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0","status":"304"}

[root@s2 ~]# vim /apps/nginx/conf/conf.d/pc.conf
location /images {
  root /data/nginx/html/pc;
  index index.html;
  valid_referers none blocked server_names
    *.example.com example.* www.example.org/galleries/
    ~\.google\.;

  if ($invalid_referer) {
    return 403;
  }
}

location ^~ /images {
  root /data/nginx;
  index index.html;
  valid_referers none blocked server_names *.cici.com www.cici.* api.online.test/v1/hostlist ~\.google\. ~\.baidu\.; #定义有效的referer
  if ($invalid_referer) { #假如是使用其他的无效的referer访问：
    return 403; #返回状态码403
  }
}
#重启Nginx并访问测试

http {
  limit_req_status 555;
    limit_req_zone $server_name zone=perserver:10m rate=2000r/s;
    limit_req_zone $server_name zone=qiguoread:10m rate=1500r/s;
    limit_req_zone $binary_remote_addr zone=distributorperip:10m rate=1r/s;
    limit_req_zone $binary_remote_addr$uri zone=distributorperip_uri:10m rate=1r/s;
    limit_req_zone $binary_remote_addr zone=spreadchannelperip:10m rate=1r/s;

server {
  ... ...
  location /cdp/distributor/api/batch_data {
    proxy_read_timeout 60;
    limit_req_status 453;
    limit_req zone=distributorperip_uri nodelay;
    proxy_pass http://xxx;
  }
}
}

[root@s3 ~]# yum install httpd -y
[root@s3 ~]# echo "web1 192.168.7.103" > /var/www/html/index.html
[root@s3 ~]# systemctl start httpd && systemctl enable httpd

[root@s4 ~]# yum install httpd -y
[root@s4 ~]# echo "web2 192.168.7.104" >> /var/www/html/index.html
[root@s4 ~]# systemctl start httpd && systemctl enable httpd

#访问测试
[root@s4 ~]# curl http://192.168.7.103
web1 192.168.7.103
[root@s3 ~]# curl http://192.168.7.104
web2 192.168.7.104

stream { #定义stream
  upstream backend { #定义后端服务器
    hash $remote_addr consistent; #定义调度算法

    server backend1.example.com:12345 weight=5; #定义具体server
    server 127.0.0.1:12345 max_fails=3 fail_timeout=30s;
    server unix:/tmp/backend3;
  }

  upstream dns { #定义后端服务器
    server 192.168.0.1:53535; #定义具体server
    server dns.example.com:53;
  }

  server { #定义server
    listen 12345; #监听IP:PORT
    proxy_connect_timeout 1s; #连接超时时间
    proxy_timeout 3s; #转发超时时间
    proxy_pass backend; #转发到具体服务器组
  }

  server {
    listen 127.0.0.1:53 udp reuseport;
    proxy_timeout 20s;
    proxy_pass dns;
  }

  server {
    listen [::1]:12345;
    proxy_pass unix:/tmp/stream.socket;
  }
}

[root@s4 ~]# yum install redis -y
[root@s4 ~]# vim /etc/redis.conf
bind 0.0.0.0
......
[root@s4 ~]# systemctl start redis
[root@s4 ~]# systemctl enable redis
[root@s4 ~]# ss -tnl | grep 6379
LISTEN  0   128     *:6379      *:*

[root@s2 ~]# mkdir /apps/nginx/conf/tcp
[root@s2 ~]# cat /apps/nginx/conf/tcp/tcp.conf
stream {
  upstream redis_server {
    #hash $remote_addr consistent;
    server 192.168.7.104:6379 max_fails=3 fail_timeout=30s;
  }

  server {
    listen 192.168.7.102:6379;
    proxy_connect_timeout 3s;
    proxy_timeout 3s;
    proxy_pass redis_server;
  }
}

[root@s2 ~]# vim /apps/nginx/conf/nginx.conf
21 include /apps/nginx/conf/tcp/tcp.conf; #注意此处的include与http模块平级

#重启nginx并访问测试
[root@s2 ~]# systemctl restart nginx
[root@s2 ~]# ss -tnl | grep 6379
LISTEN  0   128     192.168.7.102:6379  *:*

#测试通过nginx 负载连接redis：
[root@s4 ~]# redis-cli -h 192.168.7.102
192.168.7.102:6379> set name jack
OK
192.168.7.102:6379> get name
"jack"
192.168.7.102:6379>

[root@s4 ~]# yum install mariadb mariadb-server -y
[root@s4 ~]# systemctl start mariadb
[root@s4 ~]# mysql_secure_installation #安全初始化
[root@s4 ~]# systemctl enable mariadb
[root@s4 ~]# mysql -uroot -p123456
MariaDB [(none)]> GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '123456' WITH GRANT OPTION;
MariaDB [(none)]> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> exit

[root@s2 ~]# cat /apps/nginx/conf/tcp/tcp.conf
stream {
  upstream redis_server {
    server 192.168.7.104:6379 max_fails=3 fail_timeout=30s;
  }

  upstream mysql_server {
    least_conn;
    server 192.168.7.104:3306 max_fails=3 fail_timeout=30s;
  }
###################################################################
  server {
    listen 192.168.7.102:3306;
    proxy_connect_timeout 6s;
    proxy_timeout 15s;
    proxy_pass mysql_server;
  }

  server {
    listen 192.168.7.102:6379;
    proxy_connect_timeout 3s;
    proxy_timeout 3s;
    proxy_pass redis_server;
  }
}

#重启nginx并访问测试：
[root@s2 ~]# systemctl restart nginx

#测试通过nginx负载连接MySQL：
[root@s4 ~]# mysql -uroot -p123456 -h 192.168.7.102
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 32
Server version: 5.5.60-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> create database linux34;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| linux34            |
| mysql              |
| performance_schema |
+--------------------+
4 rows in set (0.01 sec)

MariaDB [(none)]>

fastcgi_pass address;
#转发请求到后端服务器，address为后端的fastcgi server的地址，可用位置：location, if in location

fastcgi_index name;
#fastcgi默认的主页资源，示例：fastcgi_index index.php;

fastcgi_param parameter value [if_not_empty];
#设置传递给FastCGI服务器的参数值，可以是文本，变量或组合，可用于将Nginx的内置变量赋值给自定义key
fastcgi_param REMOTE_ADDR $remote_addr; #客户端源IP
fastcgi_param REMOTE_PORT $remote_port; #客户端源端口
fastcgi_param SERVER_ADDR $server_addr; #请求的服务器IP地址
fastcgi_param SERVER_PORT $server_port; #请求的服务器端口
fastcgi_param SERVER_NAME $server_name; #请求的server name

Nginx默认配置示例：
location ~ \.php$ {
  root html;
  fastcgi_pass 127.0.0.1:9000;
  fastcgi_index index.php;
  fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name; #默认脚本路径
  include fastcgi_params;
}

fastcgi_cache_path path [levels=levels] [use_temp_path=on|off] keys_zone=name:size [inactive=time] [max_size=size] [manager_files=number] [manager_sleep=time] [manager_threshold=time] [loader_files=number] [loader_sleep=time] [loader_threshold=time] [purger=on|off] [purger_files=number] [purger_sleep=time] [purger_threshold=time];

定义fastcgi的缓存；
    path #缓存位置为磁盘上的文件系统路径
    max_size=size #磁盘path路径中用于缓存数据的缓存空间上限
    levels=levels：#十六进制的缓存目录的层级数量，以及每一级的目录数量，levels=ONE:TWO:THREE，示例：leves=1:2:2
    keys_zone=name:size #设置缓存名称及k/v映射的内存空间的名称及大小
    inactive=time #缓存有效时间，默认10分钟，需要在指定时间满足fastcgi_cache_min_uses 次数被视为活动缓存。

fastcgi_cache zone | off;
#调用指定的缓存空间来缓存数据，可用位置：http, server, location

fastcgi_cache_key string;
#定义用作缓存项的key的字符串，示例：fastcgi_cache_key $request_uri;

fastcgi_cache_methods GET | HEAD | POST ...;
#为哪些请求方法使用缓存

fastcgi_cache_min_uses number;
#缓存空间中的缓存项在inactive定义的非活动时间内至少要被访问到此处所指定的次数方可被认作活动项

fastcgi_keep_conn on | off;
#收到后端服务器响应后，fastcgi服务器是否关闭连接，建议启用长连接

fastcgi_cache_valid [code ...] time;
#不同的响应码各自的缓存时长

fastcgi_hide_header field; #隐藏响应头指定信息
fastcgi_pass_header field; #返回响应头指定信息，默认不会将Status、X-Accel-...返回

[root@centos7 ~]#yum -y install gcc pcre-devel openssl-devel
[root@centos7 ~]#useradd -r nginx
[root@centos7 ~]#cd /usr/local/src
[root@centos7 src]#wget http://tengine.taobao.org/download/tengine-2.1.2.tar.gz
[root@centos7 src]#tar xf tengine-2.1.2.tar.gz
[root@centos7 src]#cd tengine-2.1.2/
[root@nginx-web1 tengine-2.1.2]#./configure --prefix=/apps/tengine-2.1.2 --user=nginx --group=nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre  --add-module=/usr/local/src/echo-nginx-module


# make && make install

# yum install lua lua-devel
# ./configure --help | grep shared

# ./configure --prefix=/apps/tengine-2.1.2 --user=nginx --group=nginx --withhttp_ssl_module --with-http_v2_module --with-http_realip_module --withhttp_stub_status_module --with-http_gzip_static_module --with-pcre --withhttp_lua_module=shared

# make dso_install

# ll /apps/tengine-2.1.2/modules/ngx_http_lua_module.so

# vim /apps/tengine-2.1.2/conf/nginx.conf
worker_processes 1;

dso {
  load ngx_http_lua_module.so;
}

#/apps/tengine-2.1.2/sbin/nginx -t
the configuration file /apps/tengine-2.1.2/conf/nginx.conf syntax is ok
configuration file /apps/tengine-2.1.2/conf/nginx.conf test is successful

# wget http://tengine.taobao.org/download/tengine-2.3.2.tar.gz
# tar xvf tengine-2.3.2.tar.gz
# cd tengine-2.3.2/
# /apps/nginx/sbin/nginx -V #如果需要兼容Nginx则使用之前Nginx的编译参数
# ./configure --prefix=/apps/tengine-2.3.2 --user=nginx --group=nginx --withhttp_ssl_module --with-http_v2_module --with-http_realip_module --withhttp_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module
# make
# make install

[root@centos8 tengine-2.3.2]#ln -s /apps/tengine-2.3.2/sbin/* /usr/sbin/
[root@centos8 tengine-2.3.2]#nginx -v

#tengine-2.1.2有此模块
#./configure --help |grep http_concat
#./configure --prefix=/apps/tengine --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-file-aio --with-http_concat_module=shared --withhttp_lua_module=shared
#make dso_install

#通过动态模块实现concat功能：
# vim /apps/tenginx/conf/nginx.conf
worker_processes 1;
#error_log logs/error.log info;
#pid logs/nginx.pid;

dso {
    load ngx_http_lua_module.so;
    load ngx_http_concat_module.so;
}

#/apps/tengine/sbin/nginx -t
# /apps/tengine/sbin/nginx -s reload

#通过重新编译tengine实现concat功能：
#直接编译至tengine
--with-http_concat_module

pc.conf配置文件：
# cat /apps/tenginx/conf/conf.d/pc.conf
server {
  listen 80;
  server_name www.cici.net *.www.cici.net pc.cici.net;
  aio on;
  location / {
    concat on;
    root html;
    index index.html index.htm;
  }

  location ~ \.php$ {
    root /data/nginx/php;
    fastcgi_pass 172.18.0.202:9000;
    fastcgi_index index.php;
    #fastcgi_param SCRIPT_FILENAME /data/nginx/php$fastcgi_script_name;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
  }
}

fs.file-max = 1000000
#表示单个进程较大可以打开的句柄数

net.ipv4.tcp_tw_reuse = 1
#参数设置为 1 ，表示允许将TIME_WAIT状态的socket重新用于新的TCP链接，这对于服务器来说意义重大，因为总有大量TIME_WAIT状态的链接存在

net.ipv4.tcp_keepalive_time = 600
#当keepalive启动时，TCP发送keepalive消息的频度;默认是2小时，将其设置为10分钟，可更快的清理无效链接

net.ipv4.tcp_fin_timeout = 30
#当服务器主动关闭链接时，socket保持在FIN_WAIT_2状态的较大时间

net.ipv4.tcp_max_tw_buckets = 5000
#表示操作系统允许TIME_WAIT套接字数量的较大值，如超过此值，TIME_WAIT套接字将立刻被清除并打印警告信息,默认为8000，过多的TIME_WAIT套接字会使Web服务器变慢

net.ipv4.ip_local_port_range = 1024 65000
#定义UDP和TCP链接的本地端口的取值范围

net.ipv4.tcp_rmem = 10240 87380 12582912
#定义了TCP接受缓存的最小值、默认值、较大值

net.ipv4.tcp_wmem = 10240 87380 12582912
#定义TCP发送缓存的最小值、默认值、较大值

net.core.netdev_max_backlog = 8096
#当网卡接收数据包的速度大于内核处理速度时，会有一个列队保存这些数据包。这个参数表示该列队的较大值

net.core.rmem_default = 6291456
#表示内核套接字接受缓存区默认大小

net.core.wmem_default = 6291456
#表示内核套接字发送缓存区默认大小

net.core.rmem_max = 12582912
#表示内核套接字接受缓存区较大大小

net.core.wmem_max = 12582912
#表示内核套接字发送缓存区较大大小

注意：以上的四个参数，需要根据业务逻辑和实际的硬件成本来综合考虑

net.ipv4.tcp_syncookies = 1
#与性能无关。用于解决TCP的SYN攻击

net.ipv4.tcp_max_syn_backlog = 8192
#这个参数表示TCP三次握手建立阶段接受SYN请求列队的较大长度，默认1024，将其设置的大一些可使出现Nginx繁忙来不及accept新连接时，Linux不至于丢失客户端发起的链接请求

net.ipv4.tcp_tw_recycle = 1
#这个参数用于设置启用timewait快速回收

net.core.somaxconn=262114
#选项默认值是128，这个参数用于调节系统同时发起的TCP连接数，在高并发的请求中，默认的值可能会导致链接超时或者重传，因此需要结合高并发请求数来调节此值。

net.ipv4.tcp_max_orphans=262114
#选项用于设定系统中最多有多少个TCP套接字不被关联到任何一个用户文件句柄上。如果超过这个数字，孤立链接将立即被复位并输出警告信息。这个限制指示为了防止简单的DOS攻击，不用过分依靠这个限制甚至认为的减小这个值，更多的情况是增加这个值

* soft nofile 65535
* hard nofile 65535
* soft nproc 65535
* hard nproc 65535

#一键安装脚本
[root@centos7 ~]#cat install_mysql5.7or8.0_for_centos.sh
#!/bin/bash
#MySQL Download URL: https://dev.mysql.com/get/Downloads/MySQL-5.7/mysql-5.7.29-linux-glibc2.12-x86_64.tar.gz

. /etc/init.d/functions
SRC_DIR=`pwd`
MYSQL='mysql-8.0.19-linux-glibc2.12-x86_64.tar.xz'
COLOR='echo -e \E[01;31m'
END='\E[0m'
MYSQL_ROOT_PASSWORD=cici

check (){
if [ $UID -ne 0 ]; then
action "当前用户不是root,安装失败" false
 exit 1
fi

cd  $SRC_DIR
if [ !  -e $MYSQL ];then
    $COLOR"缺少${MYSQL}文件"$END
$COLOR"请将相关软件放在${SRC_DIR}目录下"$END
    exit
elif [ -e /usr/local/mysql ];then
   action "数据库已存在，安装失败" false
    exit
else
return
fi
}

install_mysql(){
  $COLOR"开始安装MySQL数据库..."$END

  yum  -y -q install libaio numactl-libs  libaio &> /dev/null
  cd $SRC_DIR
  tar xf $MYSQL -C /usr/local/
  MYSQL_DIR=`echo $MYSQL| sed -nr 's/^(.*[0-9]).*/\1/p'`
  ln -s /usr/local/$MYSQL_DIR /usr/local/mysql
  chown -R root.root /usr/local/mysql/
  id mysql &> /dev/null || { useradd -s /sbin/nologin -r mysql ; action "创建mysql用户"; }

  echo 'PATH=/usr/local/mysql/bin/:$PATH' > /etc/profile.d/mysql.sh
  . /etc/profile.d/mysql.sh
  ln -s /usr/local/mysql/bin/* /usr/bin/
  cat > /etc/my.cnf <<-EOF
[mysqld]
server-id=`hostname -I|cut -d. -f4`
log-bin
datadir=/data/mysql
socket=/data/mysql/mysql.sock

log-error=/data/mysql/mysql.log
pid-file=/data/mysql/mysql.pid
[client]
socket=/data/mysql/mysql.sock
EOF

  mysqld --initialize --user=mysql --datadir=/data/mysql
  cp /usr/local/mysql/support-files/mysql.server /etc/init.d/mysqld
  chkconfig --add mysqld
  chkconfig mysqld on
  service mysqld start
  [ $? -ne 0 ] && { $COLOR"数据库启动失败，退出!"$END;exit; }
  MYSQL_OLDPASSWORD=`awk '/A temporary password/{print $NF}' /data/mysql/mysql.log`
  mysqladmin  -uroot -p$MYSQL_OLDPASSWORD password $MYSQL_ROOT_PASSWORD &>/dev/null
 action "数据库安装完成"
}

check
install_mysql

#运行脚本安装数据库

[root@centos7 ~]#mysql -uroot -pcici
mysql> create database wordpress;
Query OK, 1 row affected (0.01 sec)
mysql> create user wordpress@'10.0.0.%' identified by '123456';
Query OK, 0 rows affected (0.01 sec)
mysql> grant all on wordpress.* to wordpress@'10.0.0.%';
Query OK, 0 rows affected (0.01 sec)

[root@centos7 ~]#mysql -uwordpress -p123456 -h10.0.0.17
mysql> show databases;
+--------------------+
| Database      |
+--------------------+
| information_schema |
| wordpress     |
+--------------------+

[root@centos7 ~]#yum -y install gcc openssl-devel libxml2-devel bzip2-devel libmcrypt-devel sqlite-devel oniguruma-devel
[root@centos7 ~]#cd /usr/local/src

[root@centos7 php-7.4.11]#./configure --prefix=/apps/php74 --enable-mysqlnd --with-mysqli=mysqlnd --with-pdo-mysql=mysqlnd --with-openssl  --with-zlib --with-config-file-path=/etc --with-config-file-scan-dir=/etc/php.d --enable-mbstring --enable-xml --enable-sockets --enable-fpm --enable-maintainer-zts --disable-fileinfo

[root@centos7 php-7.4.11]#make -j 8 && make install

#生成配置文件
[root@centos7 php-7.4.11]#cp /usr/local/src/php-7.4.11/php.ini-production /etc/php.ini

[root@centos7 php-7.4.11]#cd /apps/php74/etc
[root@centos7 etc]#cp php-fpm.conf.default php-fpm.conf
[root@centos7 php-7.4.11]#cd php-fpm.d/
[root@centos7 php-fpm.d]#cp www.conf.default www.conf

[root@centos7 php-fpm.d]#vim www.conf
[root@centos7 php-fpm.d]#grep '^[^;]' www.conf
[www]
user = www
group = www
listen = 127.0.0.1:9000
pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
pm.status_path = /pm_status
ping.path = /ping
access.log = log/$pool.access.log
slowlog = log/$pool.log.slow

#创建用户
[root@centos7 php-fpm.d]#useradd -r -s /sbin/nologin www

#创建访问日志文件路径
[root@centos7 php-fpm.d]#mkdir /apps/php74/log

[root@centos7 ~]#/apps/php74/sbin/php-fpm -t
[22-Oct-2020 10:55:19] NOTICE: configuration file /apps/php74/etc/php-fpm.conf
test is successful

[root@centos7 ~]#cp /usr/local/src/php-7.4.11/sapi/fpm/php-fpm.service /usr/lib/systemd/system/

[root@centos7 ~]#systemctl daemon-reload
[root@centos7 ~]#systemctl enable --now php-fpm

[root@centos7 php-7.4.11]#ss -ntl

[root@centos7 ~]#pstree -p |grep php

[root@centos7 ~]#ps -ef |grep php

root@centos7 ~]#yum -y install gcc pcre-devel openssl-devel zlib-devel
[root@centos7 ~]#cd /usr/local/src/
[root@centos7 src]#wget http://nginx.org/download/nginx-1.18.0.tar.gz
[root@centos7 src]#tar xf nginx-1.18.0.tar.gz
[root@centos7 src]#cd nginx-1.18.0/
[root@centos7 nginx-1.18.0]#./configure --prefix=/apps/nginx \
--user=www \
--group=www \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_realip_module \
--with-http_stub_status_module \
--with-http_gzip_static_module \
--with-pcre \
--with-stream \
--with-stream_ssl_module \
--with-stream_realip_module

[root@centos7 nginx-1.18.0]#make && make install

[root@centos8 ~]#vim /usr/lib/systemd/system/nginx.service
[Unit]
Description=nginx - high performance web server
Documentation=http://nginx.org/en/docs/
After=network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/apps/nginx/run/nginx.pid
ExecStart=/apps/nginx/sbin/nginx -c /apps/nginx/conf/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s TERM $MAINPID

[Install]
WantedBy=multi-user.target

#创建目录
[root@centos8 ~]#mkdir /apps/nginx/run/

#修改配置文件
[root@centos8 ~]#vim /apps/nginx/conf/nginx.conf
pid  /apps/nginx/run/nginx.pid;

[root@centos7 ~]#systemctl daemon-reload
[root@centos7 ~]#systemctl enable --now nginx

[root@centos7 ~]#ss -ntl

[root@centos7 ~]#vim /apps/nginx/conf/nginx.conf
[root@centos7 ~]#grep -Ev '#|^$' /apps/nginx/conf/nginx.conf
worker_processes  1;
pid    /apps/nginx/run/nginx.pid;
events {
  worker_connections  1024;
}
http {
    include    mime.types;
    default_type application/octet-stream;
    sendfile    on;
    keepalive_timeout  65;
    server {
        listen    80;
        server_name www.cici.org;  #指定主机名
        location / {
            root  /data/nginx/wordpress;  #指定数据目录
            index index.php index.html index.htm;      #指定默认主页
        }
        error_page  500 502 503 504 /50x.html;
        location = /50x.html {
            root  html;
        }
        location ~ \.php$ {             #实现php-fpm
            root      /data/nginx/wordpress;
            fastcgi_pass  127.0.0.1:9000;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME  $document_root$fastcgi_script_name;
            include    fastcgi_params;
        }
        location ~ ^/(ping|pm_status)$ {       #实现状态页
            include fastcgi_params;
            fastcgi_pass 127.0.0.1:9000;
            fastcgi_param PATH_TRANSLATED $document_root$fastcgi_script_name;
        }
    }
}

[root@centos7 ~]# /apps/nginx/sbin/nginx -t
[root@centos7 ~]#systemctl reload nginx

[root@centos7 ~]#mkdir -p /data/nginx/wordpress
[root@centos7 ~]#vim /data/nginx/wordpress/test.php
[root@centos7 ~]#cat /data/nginx/wordpress/test.php
<?php
phpinfo();
?>

[root@centos7 ~]#tar xf wordpress-5.4.2-zh_CN.tar.gz
[root@centos7 ~]#cp -r wordpress/* /data/nginx/wordpress
[root@centos7 ~]#chown -R www.www /data/nginx/wordpress/

#注意:默认只支持1M以下文件上传,要上传大图片,需要修改下面三项配置,最大上传由三项值的最小值决定
#直接上传大于1M文件,会出现下面413错误
[root@centos7 ~]#tail -f /apps/nginx/logs/access.log
10.0.0.1 - - [27/Nov/2020:12:21:16 +0800] "POST /wp-admin/async-upload.php
HTTP/1.1" 413 585 "http://10.0.0.7/wp-admin/upload.php" "Mozilla/5.0 (Windows NT
10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.67
Safari/537.36 Edg/87.0.664.47"

[root@centos7 ~]#vim /apps/nginx/conf/nginx.conf
server {
   client_max_body_size 10m; #默认值为1M
.....

[root@centos7 ~]#vim /etc/php.ini
post_max_size = 30M  #默认值为8M
upload_max_filesize = 20M  #默认值为2M

[root@centos7 ~]#systemctl restart nginx php-fpm

[root@centos7 ~]#vim /apps/nginx/conf/nginx.conf
[root@centos7 ~]#grep -Ev '#|^$' /apps/nginx/conf/nginx.conf
worker_processes  1;
pid    /apps/nginx/run/nginx.pid;
events {
 worker_connections  1024;
}

http {
 include    mime.types;
 default_type application/octet-stream;
 sendfile    on;
 keepalive_timeout  65;
 server {
     listen    80;
     server_name www.cici.org;
     server_tokens off; #添加此行
     location / {
         root  /data/nginx/wordpress;
         index index.php index.html index.htm;
     }
     error_page  500 502 503 504 /50x.html;
     location = /50x.html {
         root  html;
     }
     location ~ \.php$ {
         root      /data/nginx/wordpress;
         fastcgi_pass  127.0.0.1:9000;
         fastcgi_index index.php;
         fastcgi_param SCRIPT_FILENAME  $document_root$fastcgi_script_name;
         include    fastcgi_params;
         fastcgi_hide_header X-Powered-By;  #添加此行
     }
     location ~ ^/(ping|pm_status)$ {
         include fastcgi_params;
         fastcgi_pass 127.0.0.1:9000;
         fastcgi_param PATH_TRANSLATED $document_root$fastcgi_script_name;
     }
 }
}
[root@centos7 ~]#systemctl reload nginx

#编辑php.ini配置文件
[root@centos7 ~]#vim /etc/php.ini
[opcache]
; Determines if Zend OPCache is enabled
zend_extension=opcache.so
              opcache.enable=1
.....
[root@centos7 ~]#systemctl restart php-fpm

#访问测试页确认开启opcache加速

[root@centos7 ~]#cd /usr/local/src
[root@centos7 src]#ls
[root@centos7 src]#wget http://pecl.php.net/get/redis-5.3.1.tgz
[root@centos7 src]#tar xf redis-5.3.1.tgz
[root@centos7 src]#cd redis-5.3.1/

#如果是yum安装php,需要执行yum -y install php-cli php-devel
#以下为编译安装php的对应方式
[root@centos7 redis-5.3.1]#/apps/php74/bin/phpize
Configuring for:
PHP Api Version:     20190902
Zend Module Api No:    20190902
Zend Extension Api No:  320190902
Cannot find autoconf. Please check your autoconf installation and the #报错提示
$PHP_AUTOCONF environment variable. Then, rerun this script.

[root@centos7 redis-5.3.1]#yum -y install autoconf
#重新执行成功
[root@centos7 redis-5.3.1]#/apps/php74/bin/phpize
Configuring for:
PHP Api Version:     20190902
Zend Module Api No:    20190902
Zend Extension Api No:  320190902

#查看生成configure脚本
[root@centos7 redis-5.3.1]#ls

#yum安装php,无需指定--with-php-config
[root@centos7 redis-5.3.1]#./configure --with-php-config=/apps/php74/bin/php-config
[root@centos7 redis-5.3.1]#make -j 8 && make install
.....
See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
----------------------------------------------------------------------
Build complete.
Don't forget to run 'make test'.
Installing shared extensions:   /apps/php74/lib/php/extensions/no-debug-zts-
20190902/

#验证redis模块
#yum安装php,模块文件默认存放在 /usr/lib64/php/modules/redis.so
[root@centos7 redis-5.3.1]#ll /apps/php74/lib/php/extensions/no-debug-zts-20190902/
total 9584
-rwxr-xr-x 1 root root 4647668 Oct 22 10:44 opcache.a
-rwxr-xr-x 1 root root 2509416 Oct 22 10:44 opcache.so
-rwxr-xr-x 1 root root 2651320 Oct 22 12:10 redis.so

#编辑php.ini配置文件，扩展redis.so模块
[root@centos7 ~]#vim /etc/php.ini
.....
#extension=/apps/php74/lib/php/extensions/no-debug-zts-20190902/redis.so
extension=redis.so   #文件最后一行添加此行,路径可省略

[root@centos7 ~]#systemctl restart php-fpm

#在10.0.0.17主机安装redis服务
[root@centos7 ~]#yum -y install redis
[root@centos7 ~]#vim /etc/redis.conf
bind 0.0.0.0
requirepass 123456
[root@centos7 ~]#systemctl enable --now redis
[root@centos7 ~]#ss -tnl

#在10.0.0.7主机配置php的session保存在redis服务
[root@centos7 ~]#vim /etc/php.ini
[Session]
; Handler used to store/retrieve data.
; http://php.net/session.save-handler
session.save_handler = redis
session.save_path = "tcp://10.0.0.17:6379?auth=123456"

[root@centos7 ~]#systemctl restart php-fpm

[root@centos7 ~]#cat /data/nginx/wordpress/session.php
<?php
session_start();
//redis用session_id作为key 并且是以string的形式存储
$redisKey = 'PHPREDIS_SESSION:' . session_id();
// SESSION 赋值测试
$_SESSION['message'] = "Hello, I'm in redis";
$_SESSION['arr'] = [1, 2, 3, 4, 5, 6];
echo $_SESSION["message"] , "<br/>";
echo "Redis key =  " . $redisKey . "<br/>";
echo "以下是从Redis获取的数据", "<br/>";
// 取数据'
$redis = new Redis();
$redis->connect('10.0.0.17', 6379);
$redis->auth('123456');
echo $redis->get($redisKey);
?>

[root@centos7 ~]#redis-cli -h 10.0.0.17 -a 123456
10.0.0.17:6379> keys *
1) "PHPREDIS_SESSION:ad3nujfqfvcltkg2ml4snsf72h"
10.0.0.17:6379> get PHPREDIS_SESSION:ad3nujfqfvcltkg2ml4snsf72h
"message|s:19:\"Hello, I'm in redis\";arr|a:6:
{i:0;i:1;i:1;i:2;i:2;i:3;i:3;i:4;i:4;i:5;i:5;i:6;}"