Nginx在物联网架构中的角色物联网平台部署上线时Nginx几乎是标配。原因很简单你的API服务跑在8080端口MQTT WebSocket跑在8083端口管理界面跑在3000端口用户不可能记住三个端口号浏览器默认只认80和443没有HTTPS浏览器会拦截微信小程序也不让调Nginx解决的就是统一入口、HTTPS加密、跨域处理、负载分发。最小可用配置先把最基本的跑起来# /etc/nginx/sites-available/iot-platform server { listen 80; server_name iot.example.com; # 管理界面 location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } # API接口 location /api/ { proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } # MQTT over WebSocket location /mqtt { proxy_pass http://127.0.0.1:8083; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade; proxy_read_timeout 300s; } }sudo nginx -t sudo systemctl reload nginx生效。这样https://iot.example.com访问管理界面/api/走API/mqtt走MQTT WebSocket。用户只记一个域名。HTTPS配置申请免费证书用Let’s Encrypt免费、自动续期# 安装certbotsudoaptinstallcertbot python3-certbot-nginx# 申请证书sudocertbot--nginx-diot.example.com# certbot会自动修改Nginx配置加上HTTPS# 并设置自动续期的cron手动配置HTTPS如果不用certbot自动配置手动写server { listen 80; server_name iot.example.com; # HTTP强制跳转HTTPS return 301 https://$server_name$request_uri; } server { listen 443 ssl http2; server_name iot.example.com; ssl_certificate /etc/letsencrypt/live/iot.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/iot.example.com/privkey.pem; # SSL优化 ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256; ssl_prefer_server_ciphers off; ssl_session_cache shared:SSL:10m; ssl_session_timeout 1d; # HSTS add_header Strict-Transport-Security max-age63072000 always; location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /api/ { proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # API限流 limit_req zoneapi burst20 nodelay; } location /mqtt { proxy_pass http://127.0.0.1:8083; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade; proxy_read_timeout 300s; proxy_send_timeout 300s; } }MQTT over WSS如果前端通过WebSocket连接MQTT Broker比如Web端实时显示设备数据需要配置WSSWebSocket over TLSlocation /mqtt { proxy_pass http://127.0.0.1:8083; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade; proxy_read_timeout 300s; # WSS需要这些 proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }前端连接constclientmqtt.connect(wss://iot.example.com/mqtt,{clientId:web_Math.random().toString(16).substr(2,8),username:user,password:pass,clean:true});注意是wss://不是ws://走HTTPS端口443。限流配置物联网API容易被刷。一个设备正常每10秒调一次API但如果被攻击或固件bug导致疯狂重试服务器扛不住。# http块中定义限流区域 limit_req_zone $binary_remote_addr zoneapi:10m rate10r/s; limit_req_zone $binary_remote_addr zonemqtt:10m rate5r/s; server { # API限流每秒10个请求突发20个 location /api/ { limit_req zoneapi burst20 nodelay; proxy_pass http://127.0.0.1:8080; } # MQTT WebSocket限流 location /mqtt { limit_req zonemqtt burst10 nodelay; proxy_pass http://127.0.0.1:8083; } }10MB的zone可以存约16000个IP地址的限流状态。对于物联网平台每个设备用不同的client_id但IP可能相同通过NAT所以按IP限流应用层按设备ID限流双重保护。跨域处理物联网平台前后端分离时前端在web.example.comAPI在iot.example.com会遇到CORS问题location /api/ { if ($request_method OPTIONS) { add_header Access-Control-Allow-Origin https://web.example.com; add_header Access-Control-Allow-Methods GET, POST, PUT, DELETE, OPTIONS; add_header Access-Control-Allow-Headers Content-Type, Authorization; add_header Access-Control-Max-Age 86400; return 204; } add_header Access-Control-Allow-Origin https://web.example.com always; add_header Access-Control-Allow-Credentials true always; proxy_pass http://127.0.0.1:8080; }注意不要用Access-Control-Allow-Origin: *对于带Cookie的请求不生效。明确指定域名更安全。日志配置物联网平台的日志格式可以加上设备ID和请求时间log_format iot_format $remote_addr - $remote_user [$time_local] $request $status $body_bytes_sent $http_referer $http_user_agent rt$request_time uct$upstream_connect_time urt$upstream_response_time; access_log /var/log/nginx/iot_access.log iot_format; error_log /var/log/nginx/iot_error.log warn;日志按天分割# /etc/logrotate.d/nginx/var/log/nginx/iot_*.log{daily rotate30compress delaycompress notifempty create640www-data adm postrotate[-f/var/run/nginx.pid]kill-USR1cat/var/run/nginx.pidendscript}完整配置示例把上面的所有配置整合# /etc/nginx/nginx.conf user www-data; worker_processes auto; pid /run/nginx.pid; events { worker_connections 4096; multi_accept on; } http { sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 30; types_hash_max_size 2048; server_tokens off; include /etc/nginx/mime.types; default_type application/octet-stream; # 限流区域 limit_req_zone $binary_remote_addr zoneapi:10m rate10r/s; # 日志 log_format iot $remote_addr - [$time_local] $request $status $body_bytes_sent rt$request_time; access_log /var/log/nginx/access.log iot; include /etc/nginx/conf.d/*.conf; include /etc/nginx/sites-enabled/*; } # /etc/nginx/sites-available/iot-platform server { listen 80; server_name iot.example.com; return 301 https://$server_name$request_uri; } server { listen 443 ssl http2; server_name iot.example.com; ssl_certificate /etc/letsencrypt/live/iot.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/iot.example.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; add_header Strict-Transport-Security max-age63072000 always; add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff; client_max_body_size 20M; location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /api/ { limit_req zoneapi burst20 nodelay; proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location /mqtt { proxy_pass http://127.0.0.1:8083; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade; proxy_read_timeout 300s; } }性能优化在4核8G服务器上的实测数据并发连接数CPU占用内存响应延迟1002%20MB5ms5005%30MB10ms100010%50MB15ms200020%80MB25msNginx本身永远不会是瓶颈。如果你的物联网平台慢了先查API后端和数据库不要先怀疑Nginx。总结Nginx在物联网平台中的角色很明确统一入口、HTTPS、限流、跨域。配置不复杂但有几个关键点容易踩坑MQTT WebSocket的proxy_read_timeout要设长默认60秒会断连HTTPS强制跳转不要忘了限流要按实际设备量调整不要用Access-Control-Allow-Origin: *虎王科技的物联网平台部署方案中Nginx配置已经标准化有需要可以交流。沧州虎王科技专注物联网软硬件开发、通信设备、嵌入式系统与设备管理平台。