197 lines
6.8 KiB
Plaintext
197 lines
6.8 KiB
Plaintext
#跟cpu内核数有关(据实践表明，nginx的这个参数在一般情况下开4个或8个就可以了，再往上开的话优化不太大)
|
||
worker_processes 32;
|
||
|
||
error_log /opt/tsg-2207/cm/nginx/log/error.log;
|
||
#error_log /opt/tsg-2207/cm/nginx/log/error.log notice;
|
||
#error_log /opt/tsg-2207/cm/nginx/log/error.log info;
|
||
|
||
#工作模式及连接数上限
|
||
events {
|
||
worker_connections 1024;
|
||
}
|
||
|
||
|
||
http {
|
||
include mime.types;
|
||
default_type application/octet-stream;
|
||
|
||
proxy_intercept_errors on;
|
||
fastcgi_intercept_errors on;
|
||
|
||
|
||
|
||
server_names_hash_bucket_size 128;
|
||
client_header_buffer_size 128k;
|
||
large_client_header_buffers 8 128k;
|
||
client_max_body_size 1200m;
|
||
client_body_buffer_size 128k;
|
||
proxy_connect_timeout 600;
|
||
proxy_read_timeout 1800;
|
||
proxy_send_timeout 1800;
|
||
proxy_buffer_size 16k;
|
||
proxy_buffers 4 32k;
|
||
proxy_busy_buffers_size 64k;
|
||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||
'$status $body_bytes_sent "$http_referer" '
|
||
'"$http_user_agent" "$http_x_forwarded_for"' '"$upstream_addr"' '"$upstream_response_time"';
|
||
|
||
access_log /opt/tsg-2207/cm/nginx/log/access.log main;
|
||
|
||
sendfile on;
|
||
tcp_nopush on;
|
||
tcp_nodelay on;
|
||
|
||
#keepalive_timeout 0;
|
||
keepalive_timeout 65;
|
||
fastcgi_connect_timeout 300;
|
||
fastcgi_send_timeout 300;
|
||
fastcgi_read_timeout 300;
|
||
fastcgi_buffer_size 64k;
|
||
fastcgi_buffers 4 64k;
|
||
fastcgi_busy_buffers_size 128k;
|
||
fastcgi_temp_file_write_size 128k;
|
||
|
||
gzip on;
|
||
gzip_min_length 1k;
|
||
gzip_buffers 4 16k;
|
||
gzip_comp_level 8;
|
||
gzip_http_version 1.1;
|
||
gzip_types text/plain application/x-javascript text/css application/xml text/javascript image/jpeg image/gif image/png application/x-font-opentype application/x-font-ttf application/javascript application/octet-stream;
|
||
gzip_vary on;
|
||
|
||
proxy_temp_path /usr/local/nginx/nginx_cache/proxy_temp_path;
|
||
proxy_cache_path /usr/local/nginx/nginx_cache/proxy_cache_path levels=1:2 keys_zone=cache_one:200m inactive=1d max_size=30g;
|
||
|
||
vhost_traffic_status_zone;
|
||
|
||
map $http_upgrade $connection_upgrade {
|
||
default upgrade;
|
||
'' close;
|
||
}
|
||
|
||
|
||
upstream bifang {
|
||
ip_hash;
|
||
server 10.224.11.249:8080 weight=5;
|
||
}
|
||
|
||
|
||
server {
|
||
listen 80;
|
||
server_name 10.224.11.1;
|
||
#将请求转成https
|
||
rewrite ^(.*)$ https://$host:443$1 permanent;
|
||
}
|
||
server {
|
||
listen 443 ssl;
|
||
server_name 10.224.11.1;
|
||
|
||
#ssl on;
|
||
#配置共享会话缓存大小，视站点访问情况设定
|
||
ssl_session_cache shared:SSL:10m;
|
||
#配置会话超时时间
|
||
ssl_session_timeout 10m;
|
||
#设置长连接
|
||
keepalive_timeout 70;
|
||
|
||
gzip on;
|
||
gzip_min_length 1k;
|
||
gzip_buffers 4 16k;
|
||
gzip_comp_level 8;
|
||
gzip_http_version 1.1;
|
||
gzip_types text/plain application/x-javascript text/css application/xml text/javascript image/jpeg image/gif image/png application/x-font-opentype application/x-font-ttf application/javascript application/octet-stream;
|
||
gzip_vary on;
|
||
|
||
#HSTS策略
|
||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||
|
||
#证书文件
|
||
ssl_certificate /opt/tsg-2207/cm/nginx/ssl/tsg-entity-for-e21.crt;
|
||
#私钥文件
|
||
ssl_certificate_key /opt/tsg-2207/cm/nginx/ssl/tsg-entity-for-e21.key;
|
||
|
||
#优先采取服务器算法
|
||
ssl_prefer_server_ciphers on;
|
||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||
#定义算法
|
||
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4";
|
||
#减少点击劫持
|
||
add_header X-Frame-Options DENY;
|
||
#禁止服务器自动解析资源类型
|
||
add_header X-Content-Type-Options nosniff;
|
||
#防XSS攻擊
|
||
add_header X-Xss-Protection 1;
|
||
|
||
#if ( $request_uri ~* /filedownload/ ){
|
||
# return 302 http://$host$request_uri;
|
||
#}
|
||
|
||
location / {
|
||
root /opt/tsg-2207/cm/nginx/html;
|
||
try_files $uri $uri/ /index.html last;
|
||
index index.html index.htm;
|
||
#后端的Web服务器可以通过X-Forwarded-For获取用户真实IP
|
||
client_max_body_size 1200m; #允许客户端请求的最大单文件字节数
|
||
client_body_buffer_size 128k; #缓冲区代理缓冲用户端请求的最大字节数，
|
||
proxy_connect_timeout 600; #nginx跟后端服务器连接超时时间(代理连接超时)
|
||
proxy_send_timeout 1800; #后端服务器数据回传时间(代理发送超时)
|
||
proxy_read_timeout 1800; #连接成功后，后端服务器响应时间(代理接收超时)
|
||
proxy_buffer_size 16k; #设置代理服务器（nginx）保存用户头信息的缓冲区大小
|
||
proxy_buffers 4 32k; #proxy_buffers缓冲区，网页平均在32k以下的话，这样设置
|
||
proxy_busy_buffers_size 64k; #高负荷下缓冲大小（proxy_buffers*2）
|
||
proxy_temp_file_write_size 64k; #设定缓存文件夹大小，大于这个值，nginx会先将文件写入“proxy_temp_path ”缓存目录
|
||
#nginx 加密配置
|
||
#auth_basic "Restricted Content";
|
||
#auth_basic_user_file /opt/tsg/cm/nginx/htpasswd;
|
||
}
|
||
|
||
location /v1/stat/asset/healthy {
|
||
proxy_pass https://10.224.11.248;
|
||
proxy_redirect off;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Authorization bca6b0a7-405b-4201-8a0c-675afa09e1d9;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
rewrite "^(.*)v1(.*)$" /$1$2?modelId=5&children=1 break;
|
||
}
|
||
|
||
|
||
location /v1/ {
|
||
proxy_pass http://bifang/v1/;
|
||
proxy_redirect off;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
proxy_cookie_path /v1 /;
|
||
}
|
||
|
||
|
||
location /status {
|
||
stub_status on;
|
||
vhost_traffic_status_display;
|
||
vhost_traffic_status_display_format html;
|
||
allow 127.0.0.1;
|
||
}
|
||
|
||
location /v2/ {
|
||
proxy_pass http://bifang/v2/;
|
||
proxy_redirect off;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_cookie_path /v2 /;
|
||
}
|
||
|
||
|
||
error_page 500 502 503 504 /50x.html;
|
||
location = /50x.html {
|
||
root html;
|
||
}
|
||
|
||
}
|
||
|
||
}
|