nginx 預設 defalut.conf

自簽憑證
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/nginx/key/default_server.key -out /etc/nginx/key/default_server.crt

server {
server_name _;
listen 80 default_server;
listen 443 default_server ssl;

ssl_certificate /etc/nginx/key/default_server.crt;
ssl_certificate_key /etc/nginx/key/default_server.key;
ssl_session_tickets off;

return 444;
}


幫 nginx 增加 geoip 模組

原本的 nginx 使用 yum 安裝
先取得原先參數
# nginx -V

在後面加入 geoip 模組開始編譯
# ./configure ............. --with-http_geoip_module

發生錯誤
./configure: error: the HTTP rewrite module requires the PCRE library.
You can either disable the module by using --without-http_rewrite_module
option, or install the PCRE library into the system, or build the PCRE library
statically from the source with nginx by using --with-pcre= option.

下載PCRE library
官網：http://www.pcre.org/
下載：https://ftp.pcre.org/pub/pcre/
# ./configure --prefix=/usr/local/web/pcre

發生錯誤
configure: error: Invalid C++ compiler or C++ compiler flags

# yum install -y gcc gcc-c++

編譯 nginx
# ./configure ............. --with-http_geoip_module --with-pcre=/usr/local/web/src/pcre-8.42/
這裡pcre路徑是原始碼路徑、非安裝路徑

出現 fPIC 錯誤
/usr/bin/ld: /usr/local/web/src/pcre-8.42/.libs/libpcre.a(libpcre_la-pcre_compile.o): relocation R_X86_64_32S against `.rodata' can not be used when making a shared object; recompile with -fPIC
/usr/local/web/src/pcre-8.42/.libs/libpcre.a: could not read symbols: Bad value
collect2: ld returned 1 exit status

編輯 objs/Makefile 裡面的 CFLAGS 參數，加入 -fPIC
/usr/local/web/src/pcre-8.42/Makefile: objs/Makefile
cd /usr/local/web/src/pcre-8.42 \
&& if [ -f Makefile ]; then $(MAKE) distclean; fi \
&& CC="$(CC)" CFLAGS="-fPIC -O2 -fomit-frame-pointer -pipe " \
./configure --disable-shared

# make && make install

使用 goaccess 分析 nginx 含有 virtual host 的紀錄

安裝 goaccess
$yum install glib2 glib2-devel GeoIP-devel ncurses-devel goaccess

nginx.conf 需要額外做調整、才能在 log 裡面記錄 virtual host
預設
log_format main '$remote_addr - $remote_user [$time_local] "$request" ' \
'$status $body_bytes_sent "$http_referer" ' \
'"$http_user_agent" "$http_x_forwarded_for"';
修改為
#log_format main '$host : $remote_addr - $remote_user [$time_local] "$request" ' \
'$status $body_bytes_sent "$http_referer" ' \
'"$http_user_agent" "$http_x_forwarded_for"';

/etc/goaccess.conf
time-format %H:%M:%S
date-format %d/%b/%Y
# NCSA Combined Log Format with Virtual Host
log-format %v:%^ %h %^[%d:%t %^] "%r" %s %b "%R" "%u"
或是
# Common Log Format (CLF) with Virtual Host
#log-format %v:%^ %h %^[%d:%t %^] "%r" %s %b

第九項就有顯示 virtual host 的訊息了
$goaccess -f /var/log/nginx/access.log


如果要輸出成網頁用瀏覽器及時察看的話
$goaccess /var/log/nginx/access.log -o /var/www/access.html --real-time-html

在 nginx 擋掉透過 CDN 或是 load balanced 的 IP 連線

一般來說、原始伺服器的 IP 最好不要直接對外、不然被攻擊時很麻煩。
但是透過 CDN 連線後、就無法直接使用 iptables 或是 nginx 的 deny 功能阻止連線。

這時候就需要通過 $http_x_forwarded_for 這個參數來取得真正的IP

1.少量 ip 的話、直接寫在 server{} 裡面
server{
...............
...............
if ($http_x_forwarded_for ~* "8.8.8.8|8.8.4.4") {
return 403;
break;
}
}

2.ip 數量可能不少的狀況下、就要透過 map 功能了
另外編輯一個 deny_ip.conf 檔
map $http_x_forwarded_for $allowed {
default allow;
~\s*192.168.1.*$ deny;
~\s*192.168.168.11$ deny;
}

然後 nginx.conf 的 http{} 內加一行
http{
...............
...............
include deny_ip.conf;
}

server{} 裡面加上
server{
...............
...............
if ( $allowed = "deny" ) {
return 403;
}
}

這樣之後單獨編輯 deny_ip.conf 檔就好了
編輯後 nginx 要 reload 才會生效

nginx 多網址重定向設定

把 aaa.com bbb.com ccc.com 重定向成 www.aaa.com www.bbb.com www.ccc.com，設定如下

server {
listen 80;
server_name aaa.com bbb.com ccc.com;

return 301 http://www.$host$request_uri;
}

server {
listen 80;
server_name www.aaa.com;
}

server {
listen 80;
server_name www.bbb.com;
}

server {
listen 80;
server_name www.ccc.com;
}

重點在
return 301 http://www.$host$request_uri;

$host
in this order of precedence: host name from the request line, or host name from the 「 Host 」 request header field, or the server name matching a request
$http_name
arbitrary request header field; the last part of a variable name is the field name converted to lower case with dashes replaced by underscores
$server_name
name of the server which accepted a request

php 上傳檔案出現 413 錯誤

前面是 nginx 做 reverse 、後面是 apache 做 webserver

php.ini 已經修改如下、但是還是會噴錯誤、重點是log沒東西
file_uploads on
upload_max_filesize 10m
post_max_size 10m

前面做 reverse 的 nginx 也要修改
client_max_body_size 10m;

預設只有1m、難怪後面怎麼改都沒用
http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size

reference:http://blog.csdn.net/webnoties/article/details/17266651