Nginx 配置

本文默认后端程序为PHP

/usr/local/nginx/conf/nginx.conf

# 全局块
user www-data;
pid /run/nginx.pid;
worker_processes auto;
worker_rlimit_nofile 65535;
# events块
events {
    multi_accept on; #设置一个进程是否同时接受多个网络连接，默认为off
    worker_connections 65535; #最大连接数，默认为512
}
# http块
http {
    charset utf-8; #字符集
    sendfile on; #允许sendfile方式传输文件，默认为off，可以在http块，server块，location块
    tcp_nopush on; # TCP优化
    tcp_nodelay on; # TCP优化
    server_tokens off; # 隐藏版本号
    log_not_found off; # 文件未找到是否记录到 error 日志
    types_hash_max_size 2048;
    client_max_body_size 16M; #允许客户端请求的最大单文件字节数。如果有上传较大文件，请设置它的限制值
    keepalive_timeout 65;  #连接超时时间，默认为75s，可以在http，server，location块
    # MIME
    include mime.types; #文件扩展名与文件类型映射表
    default_type application/octet-stream; #默认文件类型，默认为text/plain

    # logging
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log warn;

    # SSL
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;

    # Mozilla Modern configuration
    ssl_protocols TLSv1.3;

    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 1.1.1.1 1.0.0.1 valid=60s;
    resolver_timeout 2s;

    # load configs
    include /usr/local/nginx/conf/conf.d/*.conf;
    include /usr/local/nginx/conf/sites-available/*.conf;
}

/usr/local/nginx/conf/sites-available/www.domain.com.conf

server {
    listen 80;
    listen 443 ssl http2;

    server_name www.domain.com;
    set $base /var/www/domain;
    root $base;

    # SSL
    ssl_certificate /usr/local/nginx/conf/ssl/www.domain.com.crt;
    ssl_certificate_key /usr/local/nginx/conf/ssl/www.domain.com.key;

    # security
    include nginxconfig.io/security.conf;

    # logging
    access_log /var/log/nginx/www.domain.com.access.log;
    error_log /var/log/nginx/www.domain.com.error.log warn;

    # index.php
    index index.php;

    # index.php fallback
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # handle .php
    location ~ \.php$ {
        include nginxconfig.io/php_fastcgi.conf;
    }

    # additional config
    include nginxconfig.io/general.conf;
}

/usr/local/nginx/conf/nginxconfig.io/security.conf

# security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# . files
location ~ /\.(?!well-known) {
    deny all;
}

/usr/local/nginx/conf/nginxconfig.io/php_fastcgi.conf

# 404
try_files $fastcgi_script_name =404;

# default fastcgi_params
include fastcgi_params;

# fastcgi settings
fastcgi_pass            127.0.0.1:9000;
fastcgi_index           index.php;
fastcgi_buffers         8 16k;
fastcgi_buffer_size     32k;

# fastcgi params
fastcgi_param SCRIPT_FILENAME   $document_root$fastcgi_script_name;

/usr/local/nginx/conf/nginxconfig.io/general.conf

# favicon.ico
location = /favicon.ico {
    log_not_found off;
    access_log off;
}

# robots.txt
location = /robots.txt {
    log_not_found off;
    access_log off;
}

# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
    expires 7d;
    access_log off;
}

# svg, fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
    add_header Access-Control-Allow-Origin "*";
    expires 7d;
    access_log off;
}

# gzip
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

---

参考资料：

NGINX Config

Nginx 基本配置详解