该教程花费我一天半的时间整理，全网最权威，最全的Nginx手动配置教程

# 全局块
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# events块
events {
    worker_connections 1024;
    use epoll;
}

# http块
http {
    # http全局块
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    
    # server块
    server {
        # server全局块
        listen       80;
        server_name  example.com;
        
        # location块
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }
    }
}

events {
    # 单个后台worker process进程的最大并发链接数
    worker_connections 1024;
    
    # 事件驱动模型：select|poll|kqueue|epoll|resig|/dev/poll|eventport
    use epoll;
    
    # 是否允许同时接收多个网络连接
    multi_accept on;
    
    # 只有一个worker进程接收新连接
    accept_mutex on;
    accept_mutex_delay 500ms;
}

http {
    # 文件扩展名与文件类型映射表
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    # 默认编码
    charset utf-8;
    
    # 服务器名字的hash表大小
    server_names_hash_bucket_size 128;
    
    # 上传文件大小限制
    client_max_body_size 8M;
    
    # 客户端请求头部缓冲区大小
    client_header_buffer_size 32k;
    large_client_header_buffers 4 64k;
    
    # 客户端请求体缓冲区大小
    client_body_buffer_size 128k;
}

http {
    # 高效文件传输
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    
    # 连接超时时间
    keepalive_timeout 65;
    client_header_timeout 10;
    client_body_timeout 10;
    send_timeout 10;
    
    # 开启gzip压缩
    gzip on;
    gzip_min_length 1k;
    gzip_buffers 4 16k;
    gzip_http_version 1.1;
    gzip_comp_level 2;
    gzip_types text/plain application/x-javascript text/css application/xml;
    gzip_vary on;
    
    # 缓存配置
    open_file_cache max=65535 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 1;
}

server {
    # 监听端口
    listen 80;
    listen [::]:80;
    
    # 服务器名
    server_name example.com www.example.com;
    
    # 网站根目录
    root /var/www/html;
    
    # 默认首页
    index index.html index.htm index.php;
    
    # 字符集
    charset utf-8;
    
    # 访问日志
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;
}

server {
    listen 443 ssl http2;
    server_name example.com;
    
    # SSL证书配置
    ssl_certificate /path/to/certificate.crt;
    ssl_certificate_key /path/to/private.key;
    
    # SSL协议版本
    ssl_protocols TLSv1.2 TLSv1.3;
    
    # SSL加密套件
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
    ssl_prefer_server_ciphers on;
    
    # SSL会话缓存
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    
    # HSTS安全头
    add_header Strict-Transport-Security "max-age=31536000" always;
}

# 精确匹配
location = /api/login {
    # 只匹配 /api/login
}

# 前缀匹配
location /images/ {
    # 匹配以 /images/ 开头的路径
}

# 正则匹配（区分大小写）
location ~ \.(gif|jpg|png)$ {
    # 匹配以gif、jpg、png结尾的文件
}

# 正则匹配（不区分大小写）
location ~* \.(gif|jpg|png)$ {
    # 不区分大小写匹配
}

# 前缀匹配（优先级高）
location ^~ /static/ {
    # 优先匹配以/static/开头的路径
}

# 静态文件处理
location /static/ {
    root /var/www;
    expires 30d;
    add_header Cache-Control "public, immutable";
}

# PHP文件处理
location ~ \.php$ {
    fastcgi_pass 127.0.0.1:9000;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
}

# 反向代理
location /api/ {
    proxy_pass http://backend;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

# 防止访问敏感文件
location ~ /\. {
    deny all;
}

upstream backend {
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

server {
    listen 80;
    server_name api.example.com;
    
    location / {
        proxy_pass http://backend;
        
        # 代理头设置
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # 超时设置
        proxy_connect_timeout 30;
        proxy_send_timeout 30;
        proxy_read_timeout 30;
        
        # 缓冲设置
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 4k;
    }
}

# 轮询（默认）
upstream backend_round_robin {
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

# 权重
upstream backend_weighted {
    server 192.168.1.10:8080 weight=3;
    server 192.168.1.11:8080 weight=2;
    server 192.168.1.12:8080 weight=1;
}

# IP哈希
upstream backend_ip_hash {
    ip_hash;
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

# 最少连接
upstream backend_least_conn {
    least_conn;
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
    add_header Vary Accept-Encoding;
    access_log off;
}

location ~* \.(html|htm)$ {
    expires 1h;
    add_header Cache-Control "public, must-revalidate";
}

# 缓存路径配置
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=10g 
                 inactive=60m use_temp_path=off;

server {
    location / {
        proxy_cache my_cache;
        proxy_cache_revalidate on;
        proxy_cache_min_uses 3;
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
        proxy_cache_background_update on;
        proxy_cache_lock on;
        
        proxy_pass http://backend;
    }
}

# 隐藏nginx版本号
server_tokens off;

# 安全头设置
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;

# 限制请求方法
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
    return 405;
}

# IP白名单
location /admin/ {
    allow 192.168.1.0/24;
    allow 10.1.1.0/16;
    deny all;
}

# 基础认证
location /secure/ {
    auth_basic "Restricted Area";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

# 限制请求频率
limit_req_zone $binary_remote_addr zone=login:10m rate=1r/m;

location /login {
    limit_req zone=login burst=5 nodelay;
}

# 自定义日志格式
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" '
                '"$http_user_agent" "$http_x_forwarded_for"';

log_format json escape=json '{'
    '"time":"$time_iso8601",'
    '"remote_addr":"$remote_addr",'
    '"request":"$request",'
    '"status":$status,'
    '"body_bytes_sent":$body_bytes_sent,'
    '"request_time":$request_time,'
    '"http_referrer":"$http_referer",'
    '"http_user_agent":"$http_user_agent"'
'}';

# 应用日志格式
access_log /var/log/nginx/access.log main;

# 全局错误日志
error_log /var/log/nginx/error.log warn;

# 特定server错误日志
server {
    error_log /var/log/nginx/site_error.log error;
}


# 简单重写
rewrite ^/old-path/(.*)$ /new-path/$1 permanent;

# 条件重写
if ($host != 'www.example.com') {
    return 301 https://www.example.com$request_uri;
}

# 移动端重定向
if ($http_user_agent ~* (mobile|iphone|ipod|ipad|android)) {
    rewrite ^(.*)$ https://m.example.com$1 permanent;
}

# HTTP重定向到HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

# WWW重定向
server {
    listen 80;
    server_name example.com;
    return 301 https://www.example.com$request_uri;
}

# 文件扩展名隐藏
location / {
    try_files $uri $uri.html $uri/ =404;
}


# 绑定worker进程到CPU核心
worker_processes auto;
worker_cpu_affinity auto;

# 工作进程优先级
worker_priority -10;

# 文件描述符限制
worker_rlimit_nofile 65535;

events {
    worker_connections 8192;
    use epoll;
    multi_accept on;
    accept_mutex off;
}

http {
    # 连接池大小
    connection_pool_size 256;
    
    # 请求池大小
    request_pool_size 4k;
    
    # 输出缓冲
    output_buffers 1 32k;
    postpone_output 1460;
}

# 启用状态模块
location /nginx_status {
    stub_status on;
    access_log off;
    allow 127.0.0.1;
    allow 192.168.1.0/24;
    deny all;
}

# 健康检查
location /health {
    access_log off;
    return 200 "healthy\n";
    add_header Content-Type text/plain;
}

# 测试配置文件语法
nginx -t

# 测试并显示配置
nginx -T

# 重新加载配置
nginx -s reload

# 开启调试日志
error_log /var/log/nginx/debug.log debug;

# 记录详细信息
location /debug/ {
    add_header X-Debug-URI $uri;
    add_header X-Debug-Args $args;
    add_header X-Debug-Remote-Addr $remote_addr;
}

Nginx配置详解完整指南

该教程花费我一天半的时间整理，全网最权威，最全的Nginx手动配置教程1. Nginx基础架构1.1 主配置文件结构# 全局块
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# events块
events {
    worker_connections 10

TDP会员

网络与通信

运维

后端

全网最全Nginx手动配置教程，涵盖基础架构、核心模块、HTTP配置、虚拟主机、反向代理、缓存、安全、日志等14大模块，提供SSL配置、负载均衡、性能调优等实用技巧。

负载均衡

虚拟主机

服务器

AI驱动 智领未来

4核4G3M云服务器 新用户低至38元/年！

lighthouse

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

Nginx配置详解完整指南

Nginx配置详解完整指南

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐