Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nginx服务器配置教程（以ubuntu 16.04为例） #13

Open
lensh opened this issue Aug 4, 2017 · 0 comments
Open

nginx服务器配置教程（以ubuntu 16.04为例） #13

lensh opened this issue Aug 4, 2017 · 0 comments

Comments

@lensh
Copy link
Owner

lensh commented Aug 4, 2017 •
edited
Loading

lnmp安装：https://lnmp.org/install.html
一、安装nginx
注意先apt-get update一下
1.安装pcre（rewrite 模块）
sudo apt install libpcre3 libpcre3-dev
2.安装 openssl（ssl 功能）
sudo apt-get intall openssl libssl-dev
3.安装 zlib（gzip模块）
sudo apt-get install zlib1g-dev
4.下载nginx源码包
wget http://nginx.org/download/nginx-1.19.5.tar.gz
5.解压该tar包
tar zxvf nginx-1.19.5.tar.gz
6.编译参数说明
--prefix=path 定义一个目录来保存你的nginx的提供功能的文件夹，就这好比我们安装软件的时候软件存放的目录，如果我们在编译的不指定安装位置，那么默认的位置/usr/local/nginx 目录
--sbin-path=path 设置nginx执行脚本的位置，这里如果设置在path变量里面，就可以在bash环境下，任意使用nginx命令，默认位置prefix/sbin/nginx 注意这里的prefix是在配置文件里面配置的路径
--conf-path=path 配置nginx配置文件的路径，如果不指定这个选项，那么配置文件的默认路径就会是 prefix/conf/nginx.conf
--pid-path =path 配置nginx.pid file的路径，一般来说，进程在运行的时候的时候有一个进程id，这个id会保存在pid file里面，默认的pid file的放置位置是prefix/logs/nginx.pid
--error-log-path=path 设置错误日志的存放路径，如果不指定，就默认 prefix/logs/error.log
--http-log-path= path 设置http访问日志的路径，如果不指定，就默认 prefix/logs/access.log
--user=name 设置默认启动进程的用户，如果不指定，就默认 nobody
--group=name 设置这个用户所在的用户组，如果不指定，依然是nobody
这些是我们常用的编译选项，其他的可以均保持默认，如需特殊指定，可上nginx官网查阅 http://nginx.org/en/docs/configure.html

下面是一些不常用的选项
--with-http_ssl_module -开启HTTP SSL模块，使NGINX可以支持HTTPS请求。需要安装了OPENSSL
--with-http_flv_module
--with-http_stub_status_module - 启用 "server status" 页(可有可无)
--without-http_gzip_module - 禁用 ngx_http_gzip_module. 如果启用，需要 zlib 。
--without-http_ssi_module - 禁用 ngx_http_ssi_module
--without-http_referer_module - 禁用 ngx_http_referer_module
--without-http_rewrite_module - 禁用 ngx_http_rewrite_module. 如果启用需要 PCRE 。
--without-http_proxy_module - 禁用 ngx_http_proxy_module
--without-http_fastcgi_module - 禁用 ngx_http_fastcgi_module
--without-http_memcached_module - 禁用 ngx_http_memcached_module
--without-http_browser_module - 禁用 ngx_http_browser_module
--http-proxy-temp-path=PATH - Set path to the http proxy temporary files
--http-fastcgi-temp-path=PATH - Set path to the http fastcgi temporary files
--without-http - 禁用 HTTP server（用作代理或反向代理）
--with-mail - 启用 IMAP4/POP3/SMTP 代理模块
--with-mail_ssl_module - 启用 ngx_mail_ssl_module
--with-openssl=DIR - Set path to OpenSSL library sources
7.源码编译步骤
a.切换到解压目录
cd nginx-1.19.5
b.执行configure命令
sudo ./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module
c.执行make命令
sudo make
d.执行安装命令
sudo make install
8.查看端口状态：netstat -ano|grep 80
9.启动Nginx：sudo /usr/local/nginx/sbin/nginx

如果你是阿里云的ECS，则需要配置安全组，80端口才能正常访问。

image

image

image

二、nginx的相关命令
先进入到 /usr/local/nginx/sbin/ 目录下，
启动 ./nginx
停止 ./nginx -s stop
重启 ./nginx -s reload

三、修改apache2的默认端口

1.修改 /etc/apache2/ports.conf 将
NameVirtualHost *:80
Listen 80
改为自己需要的端口
NameVirtualHost *:81
Listen 81
2.修改/etc/apache2/sites-available/default 将第一行的
<VirtualHost *:81>
改为自己需要的端口
<VirtualHost *:81>

四、部署SSL证书

首先得购买证书（一般CA机构会颁发3个证书，即服务器证书、CA证书、根证书），然后生成合并后的证书（lenshen.com.crt）和私钥（lenshen.com.key），具体怎么生成可参考：
http://jingyan.baidu.com/article/154b463178eac928ca8f41a9.html
最后把证书（lenshen.com.crt）和私钥（lenshen.com.key）放在 /usr/local/nginx/conf/目录下。

五、nginx配置https

用vim打开 /usr/local/nginx/conf/nginx.conf

  1. 配置二级域名和端口转发
   server {
        listen       443 ssl;
        server_name  cet.lenshen.com;

        ssl_certificate /usr/local/nginx/conf/lenshen.com.crt;
        ssl_certificate_key /usr/local/nginx/conf/lenshen.com.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
           proxy_pass http://localhost:8001; #后端的web服务器
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        }
    }
   server {
        listen       443 ssl;
        server_name  qq.lenshen.com;

        ssl_certificate /usr/local/nginx/conf/lenshen.com.crt;
        ssl_certificate_key /usr/local/nginx/conf/lenshen.com.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
           proxy_pass http://localhost:8080; #后端的web服务器
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        }
    }
    server {
        listen       443 ssl;
        server_name  music.lenshen.com;

        ssl_certificate /usr/local/nginx/conf/lenshen.com.crt;
        ssl_certificate_key /usr/local/nginx/conf/lenshen.com.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
           proxy_pass http://localhost:8000; #后端的web服务器
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        }
    }

2.配置http重定向到https

  server {  
     listen      80;  
     server_name  lenshen.com;  
     return      301 https://$server_name$request_uri;  
   }
   server {  
     listen      80;  
     server_name    qq.lenshen.com;  
     return      301 https://$server_name$request_uri;  
   }  
   server {  
     listen      80;  
     server_name    music.lenshen.com;  
     return      301 https://$server_name$request_uri;  
   }     
   server {  
     listen      80;  
     server_name    cet.lenshen.com;  
     return      301 https://$server_name$request_uri;  
   }

六、安装node
cd ~
image
可以看到当前目录是root目录
wget https://npm.taobao.org/mirrors/node/v14.15.1/node-v14.15.1-linux-x64.tar.xz
tar -xvf node-v14.15.1-linux-x64.tar.xz
mv node-v14.15.1-linux-x64 node // 更改目录名
ln -s /root/node/bin/node /usr/local/bin/node //配置软链接
ln -s /root/node/bin/npm /usr/local/bin/npm //配置软链接
npm config set registry https://registry.npm.taobao.org // 设置淘宝镜像源
七、nodejs中使用https

var app = require('express')();
var fs = require('fs');
var https = require('https');
var privateKey  = fs.readFileSync('/usr/local/nginx/conf/lenshen.com.key', 'utf8');
var certificate = fs.readFileSync('/usr/local/nginx/conf/lenshen.com.crt', 'utf8');
var credentials = {key: privateKey, cert: certificate};
var httpsServer = https.createServer(credentials, app);
var SSLPORT = 18081;
httpsServer.listen(SSLPORT, function() {
     console.log('HTTPS Server is running on: https://localhost:%s', SSLPORT);
});
// Welcome
app.get('/', function(req, res) {
     if(req.protocol === 'https') {
        res.status(200).send('Welcome to Safety Land!');
     }
     else {
        res.status(200).send('Welcome!');
     }
});
@lensh lensh changed the title nginx服务端配置教程（以ubuntu 16.04为例） nginx服务器配置教程（以ubuntu 16.04为例） Aug 4, 2017
@lensh lensh mentioned this issue Jan 5, 2020
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@lensh