1. 为什么选择Nginx作为Web服务器在Linux环境下部署Web服务时Nginx以其高性能、低资源消耗和灵活的配置成为大多数运维人员的首选。与传统的Apache相比Nginx采用事件驱动的异步架构单个进程就能处理数千个并发连接特别适合现代高并发的Web应用场景。我最早接触Nginx是在2013年为一个电商项目做性能优化时当时Apache在促销活动期间经常出现响应迟缓的情况。切换到Nginx后服务器负载直接下降了60%这让我深刻认识到选择合适的Web服务器对业务稳定性的重要性。2. 环境准备与依赖检查2.1 系统环境确认在开始安装前建议先确认你的Linux发行版和版本信息。不同发行版的安装命令和依赖管理方式有所差异# 查看系统版本信息 cat /etc/os-release lsb_release -a uname -a对于主流发行版我通常这样区分Ubuntu/Debian系使用apt包管理CentOS/RHEL系使用yum/dnf包管理Arch Linux使用pacman2.2 依赖库安装Nginx的核心依赖包括PCRE、zlib和OpenSSL。虽然大多数现代Linux发行版已经预装了这些库但为了确保兼容性建议手动安装开发版本# Ubuntu/Debian sudo apt update sudo apt install -y build-essential libpcre3 libpcre3-dev zlib1g zlib1g-dev libssl-dev # CentOS/RHEL sudo yum install -y gcc-c pcre pcre-devel zlib zlib-devel openssl openssl-devel注意如果在最小化安装的系统上操作可能需要先安装基本的编译工具链。我曾经在干净的CentOS最小安装上踩过坑后来养成了先装开发工具组的习惯。3. 多种安装方式详解3.1 通过系统包管理器安装这是最快捷的安装方式适合大多数标准场景# Ubuntu/Debian sudo apt install -y nginx # CentOS/RHEL sudo yum install -y epel-release sudo yum install -y nginx # 启动并设置开机自启 sudo systemctl start nginx sudo systemctl enable nginx这种方式的优点是简单快捷缺点是版本可能不是最新的。例如在Ubuntu 20.04上默认安装的是1.18版本而当前稳定版已经是1.25。3.2 从源码编译安装当需要特定版本或自定义模块时源码编译是最灵活的选择。以下是我常用的编译流程# 下载最新稳定版以1.25.3为例 wget https://nginx.org/download/nginx-1.25.3.tar.gz tar zxvf nginx-1.25.3.tar.gz cd nginx-1.25.3 # 配置编译选项 ./configure \ --prefix/usr/local/nginx \ --with-http_ssl_module \ --with-http_v2_module \ --with-http_realip_module \ --with-http_stub_status_module \ --with-http_gzip_static_module \ --with-pcre \ --with-stream # 编译并安装 make -j$(nproc) sudo make install关键编译选项说明--with-http_ssl_module启用HTTPS支持--with-http_v2_module支持HTTP/2协议--with-http_stub_status_module启用状态监控页面--with-stream支持TCP/UDP代理经验分享在配置阶段使用--with-debug选项可以开启调试日志这在排查复杂问题时非常有用。但生产环境建议去掉这个选项以避免性能开销。3.3 使用官方仓库安装对于需要保持最新版本的情况可以使用Nginx官方维护的仓库# Ubuntu/Debian sudo apt install -y curl gnupg2 ca-certificates lsb-release echo deb http://nginx.org/packages/ubuntu lsb_release -cs nginx | sudo tee /etc/apt/sources.list.d/nginx.list curl -fsSL https://nginx.org/keys/nginx_signing.key | sudo apt-key add - sudo apt update sudo apt install -y nginx # CentOS/RHEL sudo yum install -y yum-utils sudo yum-config-manager --add-repo https://nginx.org/packages/centos/7/uname -m/ sudo yum install -y nginx这种方式既方便又能获得较新的版本是我目前在生产环境最常使用的方法。4. 基础配置详解4.1 配置文件结构解析Nginx的配置文件通常位于以下路径主配置文件/etc/nginx/nginx.conf额外配置/etc/nginx/conf.d/*.conf站点配置/etc/nginx/sites-available/和/etc/nginx/sites-enabled/Debian系典型的nginx.conf结构如下user nginx; # 运行用户 worker_processes auto; # 自动根据CPU核心数设置工作进程数 events { worker_connections 1024; # 每个工作进程的最大连接数 } http { include /etc/nginx/mime.types; default_type application/octet-stream; # 日志格式定义 log_format main $remote_addr - $remote_user [$time_local] $request $status $body_bytes_sent $http_referer $http_user_agent $http_x_forwarded_for; access_log /var/log/nginx/access.log main; error_log /var/log/nginx/error.log warn; # 其他全局配置 sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 2048; # 包含其他配置文件 include /etc/nginx/conf.d/*.conf; include /etc/nginx/sites-enabled/*; }4.2 虚拟主机配置一个基本的虚拟主机配置示例保存为/etc/nginx/conf.d/example.confserver { listen 80; server_name example.com www.example.com; # 访问日志和错误日志 access_log /var/log/nginx/example.access.log; error_log /var/log/nginx/example.error.log; # 根目录配置 root /var/www/example.com; index index.html index.htm; # 静态文件处理 location / { try_files $uri $uri/ 404; } # 禁止访问隐藏文件 location ~ /\. { deny all; } # 错误页面配置 error_page 404 /404.html; error_page 500 502 503 504 /50x.html; }4.3 常用配置技巧启用Gzip压缩显著减少传输数据量gzip on; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xmlrss text/javascript; gzip_min_length 1024; gzip_comp_level 6;客户端缓存控制合理利用浏览器缓存location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ { expires 30d; add_header Cache-Control public, no-transform; }限制请求方法增强安全性location /api/ { limit_except GET POST { deny all; } }5. 安全加固与性能调优5.1 基础安全配置# 隐藏Nginx版本信息 server_tokens off; # 防止点击劫持 add_header X-Frame-Options SAMEORIGIN; # 启用XSS防护 add_header X-XSS-Protection 1; modeblock; # 禁用内容类型嗅探 add_header X-Content-Type-Options nosniff; # CSP策略根据实际需求调整 add_header Content-Security-Policy default-src self; script-src self unsafe-inline unsafe-eval; img-src self data:; style-src self unsafe-inline; font-src self; connect-src self; frame-ancestors self; form-action self;;5.2 性能优化参数# 工作进程与连接数优化 worker_processes auto; # 自动设置为CPU核心数 worker_rlimit_nofile 100000; # 每个worker能打开的文件描述符数量 events { worker_connections 4096; # 每个worker的最大连接数 multi_accept on; # 一次性接受所有新连接 use epoll; # 使用epoll事件模型Linux } http { # 文件描述符缓存 open_file_cache max200000 inactive20s; open_file_cache_valid 30s; open_file_cache_min_uses 2; open_file_cache_errors on; # 缓冲区优化 client_body_buffer_size 10K; client_header_buffer_size 1k; client_max_body_size 8m; large_client_header_buffers 4 4k; # 超时设置 client_body_timeout 12; client_header_timeout 12; keepalive_timeout 15; send_timeout 10; }6. 常见问题排查6.1 配置文件测试与重载在修改配置后务必先测试语法是否正确sudo nginx -t如果显示syntax is ok则可以安全重载配置sudo systemctl reload nginx # 或者 sudo nginx -s reload6.2 常见错误与解决方案端口冲突nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)解决方法sudo lsof -i :80 # 查看占用80端口的进程 sudo systemctl stop apache2 # 如果被Apache占用权限问题nginx: [alert] could not open error log file: open() /var/log/nginx/error.log failed (13: Permission denied)解决方法sudo chown -R nginx:nginx /var/log/nginx sudo chmod -R 755 /var/log/nginx模块缺失nginx: [emerg] the http_ssl module requires the OpenSSL library解决方法安装OpenSSL开发包后重新编译Nginx。6.3 日志分析技巧Nginx访问日志的典型格式192.168.1.100 - - [10/Jul/2023:14:30:22 0800] GET /index.html HTTP/1.1 200 612 - Mozilla/5.0 (Windows NT 10.0; Win64; x64)常用日志分析命令# 统计访问量最高的IP awk {print $1} /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -n 10 # 统计HTTP状态码 awk {print $9} /var/log/nginx/access.log | sort | uniq -c | sort -nr # 实时监控访问日志 tail -f /var/log/nginx/access.log | grep -v 127.0.0.17. 进阶配置示例7.1 HTTPS配置与证书管理使用Lets Encrypt免费证书的配置示例server { listen 443 ssl http2; server_name example.com www.example.com; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # SSL协议配置 ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; # HSTS头 add_header Strict-Transport-Security max-age31536000; includeSubDomains always; # 其他配置... }7.2 反向代理配置将请求代理到后端应用的典型配置location /api/ { proxy_pass http://backend_server; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # 超时设置 proxy_connect_timeout 60s; proxy_send_timeout 60s; proxy_read_timeout 60s; # 缓冲区设置 proxy_buffer_size 4k; proxy_buffers 8 16k; proxy_busy_buffers_size 32k; }7.3 负载均衡配置Nginx内置的负载均衡功能配置示例upstream backend { least_conn; # 最少连接算法 server 192.168.1.101:8080 weight3; server 192.168.1.102:8080; server 192.168.1.103:8080 backup; # 备用服务器 # 健康检查 check interval3000 rise2 fall3 timeout1000; } server { location / { proxy_pass http://backend; # 其他代理配置... } }8. 维护与管理技巧8.1 日志轮转配置创建/etc/logrotate.d/nginx文件/var/log/nginx/*.log { daily missingok rotate 14 compress delaycompress notifempty create 0640 nginx adm sharedscripts postrotate if [ -f /var/run/nginx.pid ]; then kill -USR1 cat /var/run/nginx.pid fi endscript }8.2 性能监控使用Nginx内置的stub_status模块location /nginx_status { stub_status on; access_log off; allow 127.0.0.1; deny all; }访问输出示例Active connections: 291 server accepts handled requests 16630948 16630948 31070465 Reading: 6 Writing: 179 Waiting: 1068.3 动态模块管理从Nginx 1.9.11开始支持动态模块加载。查看已安装模块nginx -V 21 | grep -o with-http_[a-z0-9_]*_module加载动态模块示例load_module modules/ngx_http_geoip_module.so;