1、安装nginx ./configure--prefix/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-stream --with-stream_ssl_preread_module --with-stream_ssl_module--usernginx--groupnginx2、配置nginx#user nobody;worker_processes1;#error_log logs/error.log;#error_log logs/error.log notice;#error_log logs/error.log info;#pid logs/nginx.pid;events{worker_connections1024;}#stream配置stream{upstream adr1{server127.0.0.1:8110;}server{listen82;proxy_pass adr1;}}http{include mime.types;default_type application/octet-stream;sendfile on;#tcp_nopush on;#keepalive_timeout 0;keepalive_timeout65;#gzip on;server{listen80;server_name localhost;#charset koi8-r;#access_log logs/host.access.log main;location /{root html;index index.html index.htm;}#error_page 404 /404.html;# redirect server error pages to the static page /50x.html#error_page500502503504/50x.html;location/50x.html{root html;}}# HTTPS serverserver{listen443ssl;server_name www.baidu.com;ssl_certificate /usr/local/nginx/cert/www.baidu.com/www.baidu.com.pem;ssl_certificate_key /usr/local/nginx/cert/www.baidu.com/www.baidu.com.key;ssl_session_timeout 10m;ssl_session_cache shared:SSL:10m;ssl_protocols SSLv3 SSLv2 TLSv1 TLSv1.1 TLSv1.2;#按照这个协议配置ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location /{root html;index index.html index.htm;}location /java/rehab/{proxy_pass http://127.0.0.1:8993/;proxy_http_version1.1;proxy_set_header Upgrade ℎ;ℎ;ℎ−−remote_addr;proxy_set_header X-Forwarded-For$remote_addr;}}server{listen81;server_name www.baidu.com;client_max_body_size 500M;location /{proxy_pass http://127.0.0.1:8110;proxy_http_version1.1;proxy_set_header Upgrade$http_upgrade;proxy_set_header Connectionupgrade;}}}配置了http请求的代理、websocket代理http{include mime.types;default_type application/octet-stream;sendfile on;tcp_nodelay on;tcp_nopush off;server_tokens off;ssl_session_timeout 5m;client_header_timeout 300s;client_body_timeout 300s;proxy_connect_timeout 300s;proxy_read_timeout 300s;proxy_send_timeout 300s;client_header_buffer_size 16k;client_body_buffer_size 256k;client_max_body_size 256m;proxy_busy_buffers_size 16k;proxy_buffer_size 16k;ssl_buffer_size 16k;max_size10g;access_log off;error_log logs/http_error.log error;#配置日志#添加负载均衡可选upstream myapp1{server192.168.1.98:8080weight3;#设置权重 权重越大 访问几率越大此处98访问的概率比99大三倍,默认权重为1server192.168.1.99:8080;server192.168.1.100:8080 down;# 标记为不可用server192.168.1.101:8080 backup;# 备份服务器}# 定义变量兼容HTTP和WebSocket两种请求协议map$http_upgrade$connection_upgrade{default keep-alive;websocketupgrade;}server{listen0.0.0.0:8080 reuseportbacklog2048so_keepaliveonipv6onlyoff;#定义websocket请求路径location /websocket{proxy_pass http://127.0.0.1:8080;#改为服务ip端口 如果是负载均衡此处需要替换成 http://myapp1;proxy_read_timeout 20s;# 设置超时时间默认是60sproxy_http_version1.1;proxy_set_header Host$host;#将客户端请求中的Host头部信息转发给后端服务器proxy_set_header Upgrade$http_upgrade;#将客户端请求中的Upgrade头部信息转发给后端服务器proxy_set_header Connection$connection_upgrade;}#定义/请求路径location /{proxy_set_header real_ip$remote_addr;proxy_pass http://127.0.0.1:8080;#需要替换具体ip端口 如果是负载均衡此处需要替换成 http://myapp1;proxy_set_header Host$host:$server_port;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;#增加客户端ip到X-Forwarded-Forproxy_set_header X-Forwarded-Proto$scheme;#提供客户端请求使用的协议proxy_set_header X-Forwarded-Port$server_port;#获取nginx监听端口proxy_pass_header Set-Cookie;client_max_body_size 5120m;}}}配置了stream请求的代理stream{tcp_nodelay on;ssl_handshake_timeout 300s;proxy_timeout 10m;proxy_connect_timeout 300s;proxy_buffer_size 256k;preread_timeout 300s;preread_buffer_size 256k;log_format proxy$remote_addr [$time_local] $protocol $status $bytes_sent $bytes_received $session_time $upstream_addr $upstream_bytes_sent $upstream_bytes_received $upstream_connect_time;access_log logs/tcp_access.log proxy;error_log logs/tcp_error.log debug;server{listen0.0.0.0:7788 reuseportbacklog2048so_keepaliveonipv6onlyoff;proxy_pass127.0.0.1:7788;}}在server下配置 include IP.conf;# 需要过滤的ip内容案例1 allow1.1.1.1;#允许1.1.1.1 通过 其他拒绝deny all;内容案例2 deny1.1.1.1;#不允许1.1.1.1访问 其他默认允许其他案例参考1.下载必要组件 yum-yinstallgcc zlib zlib-devel pcre-devel openssl openssl-devel2.生成证书 openssl req-x509-nodes-days3650-newkeyrsa:2048\-keyout server.key-outserver.crt\-config ssl.conf3.下载nginx:https://nginx.org/en/download.htmlwgethttps://nginx.org/download/nginx1.16.0.tar.gz 解压tar-zxvfnginx1.16.0.tar.gz4.安装 linux安装cdnginx-1.9.9/ ./configure--prefix/home/yunpay/nginx --with-stream --with-http_ssl_modulemakemakeinstalldocker安装dockerrun--namenginx-p16379:6379-p443:443-p80:80\-v/data/nginx/data:/usr/share/nginx/html\-v/data/nginx/config/nginx.conf:/etc/nginx/nginx.conf\-v/data/nginx/config/conf.d/default.conf:/etc/nginx/conf.d/default.conf\-v/data/nginx/logs:/var/log/nginx\-v/data/nginx/ssl:/ssl\-dnginx:1.21.35. 案例一配置https和证书 server{# listen 80; #此处仅演示了证书功能未引入80端口listen443ssl;server_name localhost;#这里也可以用你的域名# rewrite ^(.*)$ https://$host$1; #如果需要把http重定向到https尝试以下方法# return 301 https://$host$request_uri; #如果需要把http重定向到https尝试以下方法ssl_certificate /ssl/xxx.com.pem;# xxx.com.pem 这名称根据实际做修改ssl_certificate_key /ssl/xxx.com.key;# xxx.com.key 这名称根据实际做修改ssl_session_timeout 5m;# 指定密码为openssl支持的格式ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;ssl_prefer_server_ciphers on;#依赖SSLv3和TLSv1协议的服务器密码将优先于客户端密码location /{proxy_pass http://192.168.1.1:8080;#需要代理的内网主机IP以及8080端口号根据实际需要做调整}error_page500502503504/50x.html;location/50x.html{root /usr/share/nginx/html;}}案例二配置https和证书# 以下就是复制上边的内容然后把域名和需要代理的内网主机做修改就可以了server{listen443ssl;server_name2.xxx.com;#这里用你的第2个域名ssl_certificate /ssl/xxx.com.pem;ssl_certificate_key /ssl/xxx.com.key;ssl_session_timeout 5m;ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;ssl_prefer_server_ciphers on;location /{proxy_pass http://192.168.1.2:8080;}error_page500502503504/50x.html;location/50x.html{root /usr/share/nginx/html;}}案例三配置stream调用redis stream{upstream redis{server *主机IP地址或容器地址*:6379;# server *主机IP地址或容器地址*:6379;再加一个是轮询同主机同服务的不同端口也可}server{listen6379;proxy_connect_timeout 1s;proxy_timeout 3s;proxy_pass redis;# ssl_certificate /ssl/server.crt;# ssl_certificate_key /ssl/server.key;# ssl_session_timeout 45s;#没有数据传输时45s踢掉这个会话# ssl_protocols TLSv1 TLSv1.1 TLSv1.2;# ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;# ssl_prefer_server_ciphers on;}}案例四配置http和websocket map$http_upgrade$connection_upgrade{default upgrade;# close;}server{# 多个域名多个服务可以多写几个serverkeepalive_requests150;listen80;server_name test.test.com;#监听地址client_max_body_size 1000M;location /{proxy_http_version1.1;proxy_set_header Connection;proxy_pass http://192.168.1.100:8080;}location /ws{# /ws后边是否带“/”有本质上的区别带“/”表示引用ws下一级路径#proxy_next_upstream error timeout invalid_header http_500 http_503 http_404;proxy_pass http://192.168.1.100:61624;proxy_set_header Upgrade$http_upgrade;proxy_set_header Connectionupgrade;}}案例五配置stream调用rabbitmq user nginx;worker_processes auto;error_log /var/log/nginx/error.log notice;pid /var/run/nginx.pid;events{worker_connections10240;}stream{log_format proxy$remote_addr [$time_local] $protocol $status $bytes_sent $bytes_received $session_time $upstream_addr $upstream_bytes_sent $upstream_bytes_received $upstream_connect_time;upstream rabbitmq8883{# server 192.168.0.137:1883;server192.168.0.137:8884;server192.168.0.137:8885;server192.168.0.137:8886;server192.168.0.137:8887;server192.168.0.137:8888;server192.168.0.137:8889;server192.168.0.137:8890;server192.168.0.137:8891;server192.168.0.137:8892;server192.168.0.137:8893;}server{error_log /var/log/nginx/rabbitmq8883__error.log;#这里是容器内路径根据自己持久化路径找对应主机路径access_log /var/log/nginx/rabbitmq8883__access.log proxy;#这里是容器内路径根据自己持久化路径找对应主机路径listen8883;# listen 8883 ssl;proxy_connect_timeout 45s;proxy_timeout 45s;proxy_pass rabbitmq8883;# ssl_certificate /ssl/server.crt;# ssl_certificate_key /ssl/server.key;# #ssl_session_timeout 45s;# ssl_protocols TLSv1 TLSv1.1 TLSv1.2;# ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;# ssl_prefer_server_ciphers on;}案例六配置stream调用ftp stream{upstream ftp{hash$remote_addrconsistent;server10.14.168.32:2121;}server{listen8003;proxy_connect_timeout 300s;proxy_timeout 300s;proxy_passftp;}}案例七http upstream web{server domain.com:80;}server{# 监听 tcp4listen80;# 监听 tcp6listen[::]:80;# 无效域名 _ 匹配任意域名优先级最低server_name _;# 访问日志access_log /var/log/nginx/access.log main;# 错误日志error_log /var/log/nginx/error.log notice;# 客户端请求体大小避免大文件上传 413client_max_body_size 1024m;# X-Frame-Options 标头add_header X-Frame-Options sameorigin;# 内容安全策略 (CSP)add_header Content-Security-Policyframe-ancestors self;# 前端静态文件location /{root /data/www/web_frontend;try_files$uri$uri/ /index.html last;}# 后端 API注意 proxy_pass 后的 /携带 / 转发请求时会去掉匹配前缀location /api/{# 代理转发目标注意需要添加请求协议proxy_pass http://web/;# Host 主机名proxy_set_header Host$host;# X-Real-IP 将真实访问者的远端 IP 地址转发给代理服务器proxy_set_header X-Real-IP$remote_addr;# X-Forwarded-For 标记客户端通过代理连接到服务器的源 IPproxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# X-Forwarded-Host 标记客户端通过代理连接到服务器的原始主机proxy_set_header X-Forwarded-Host$host:$server_port;# X-Forwarded-Server 代理服务器的主机名proxy_set_header X-Forwarded-Server$host;# X-Forwarded-Port 定义客户端请求的原始端口proxy_set_header X-Forwarded-Port$server_port;# X-Forwarded-Proto 标记客户端通过代理连接到服务器的协议proxy_set_header X-Forwarded-Proto$scheme;# proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;}}案例八https upstream web{server domain.com:443;}server{# 监听 tcp4 并开启 http2listen443ssl http2;# 监听 tcp6 并开启 http2listen[::]:443 ssl http2;# 无效域名 _ 匹配任意域名优先级最低server_name _;# 访问日志access_log /var/log/nginx/access.log main;# 错误日志error_log /var/log/nginx/error.log notice;# 服务器证书文件ssl_certificate /data/www/domain.com/certs/server.crt;# 服务器证书密钥文件ssl_certificate_key /data/www/domain.com/certs/server.key;# 支持的 ssl 或 tls 的版本ssl_protocols TLSv1.2 TLSv1.3;# 是否由服务器决定采用哪种算法默认 off如果 ssl 协议支持 tlsv1、tlsv1.1 老协议设置为 on 并配合 ssl_ciphers 使用如果 ssl 协议为 tlsv1.2、tlsv1.3 新协议设置为 off新协议不再采纳该参数ssl_prefer_server_ciphers off;# 支持 ssl 协议的加密套件ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;# 启用 ssl session 缓存占用 10m 内存缓存时间由 ssl_session_timeout 决定ssl_session_cache shared:SSL:10m;# 客户端可以重用会话的时间ssl_session_timeout 10m;# 客户端请求体大小避免大文件上传 413client_max_body_size 1024m;# HSTS: HTTP 严格传输安全add_header Strict-Transport-Securitymax-age31536000; includeSubDomainsalways;# X-Frame-Options 标头add_header X-Frame-Options sameorigin;# 内容安全策略 (CSP)add_header Content-Security-Policyframe-ancestors self;# HTTPS 通过 HTTP 访问时 Nginx 触发 497 状态码重定向到 HTTPSerror_page497https://$http_host$uri$is_args$args;# 前端静态文件location /{root /data/www/web_frontend;try_files$uri$uri/ /index.html last;}# 后端 API注意 proxy_pass 后的 /携带 / 转发请求时会去掉匹配前缀location /api/{# 代理转发目标注意需要添加请求协议proxy_pass http://web/;# Host 主机名proxy_set_header Host$host;# X-Real-IP 将真实访问者的远端 IP 地址转发给代理服务器proxy_set_header X-Real-IP$remote_addr;# X-Forwarded-For 标记客户端通过代理连接到服务器的源 IPproxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# X-Forwarded-Host 标记客户端通过代理连接到服务器的原始主机proxy_set_header X-Forwarded-Host$host:$server_port;# X-Forwarded-Server 代理服务器的主机名proxy_set_header X-Forwarded-Server$host;# X-Forwarded-Port 定义客户端请求的原始端口proxy_set_header X-Forwarded-Port$server_port;# X-Forwarded-Proto 标记客户端通过代理连接到服务器的协议proxy_set_header X-Forwarded-Proto$scheme;# proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;}}案例九配置ws请求http upstream web{server domain.com:80;}# map 指令根据客户端请求头中 $http_upgrade 的值构建 $connection_upgrade 的值如果 $http_upgrade 没有匹配默认值为 upgrade如果 $http_upgrade 配置空字符串值为 closemap$http_upgrade$connection_upgrade{default upgrade;close;}server{# 监听 tcp4listen80;# 监听 tcp6listen[::]:80;# 无效域名 _ 匹配任意域名优先级最低server_name _;# 访问日志access_log /var/log/nginx/access.log main;# 错误日志error_log /var/log/nginx/error.log notice;# 客户端请求体大小避免大文件上传 413client_max_body_size 1024m;# X-Frame-Options 标头add_header X-Frame-Options sameorigin;# 内容安全策略 (CSP)add_header Content-Security-Policyframe-ancestors self;# 前端静态文件location /{root /data/www/web_frontend;try_files$uri$uri/ /index.html last;}# 后端 WebSocket注意 proxy_pass 后的 /携带 / 转发请求时会去掉匹配前缀location /websocket/{# 代理转发目标proxy_pass http://web;# 请求服务器升级协议为 WebSocketproxy_http_version1.1;proxy_set_header Upgrade$http_upgrade;proxy_set_header Connection$connection_upgrade;# 设置读写超时时间默认 60s 无数据连接将会断开proxy_read_timeout 300s;proxy_send_timeout 300s;# Host 主机名proxy_set_header Host$host;# X-Real-IP 将真实访问者的远端 IP 地址转发给代理服务器proxy_set_header X-Real-IP$remote_addr;# X-Forwarded-For 标记客户端通过代理连接到服务器的源 IPproxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# X-Forwarded-Host 标记客户端通过代理连接到服务器的原始主机proxy_set_header X-Forwarded-Host$host:$server_port;# X-Forwarded-Server 代理服务器的主机名proxy_set_header X-Forwarded-Server$host;# X-Forwarded-Port 定义客户端请求的原始端口proxy_set_header X-Forwarded-Port$server_port;# X-Forwarded-Proto 标记客户端通过代理连接到服务器的协议proxy_set_header X-Forwarded-Proto$scheme;# proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;}}案例十配置ws请求https upstream web{server domain.com:443;}# map 指令根据客户端请求头中 $http_upgrade 的值构建 $connection_upgrade 的值如果 $http_upgrade 没有匹配默认值为 upgrade如果 $http_upgrade 配置空字符串值为 closemap$http_upgrade$connection_upgrade{default upgrade;close;}server{# 监听 tcp4 并开启 http2listen443ssl http2;# 监听 tcp6 并开启 http2listen[::]:443 ssl http2;# 无效域名 _ 匹配任意域名优先级最低server_name _;# 访问日志access_log /var/log/nginx/access.log main;# 错误日志error_log /var/log/nginx/error.log notice;# 服务器证书文件ssl_certificate /data/www/domain.com/certs/server.crt;# 服务器证书密钥文件ssl_certificate_key /data/www/domain.com/certs/server.key;# 支持的 ssl 或 tls 的版本ssl_protocols TLSv1.2 TLSv1.3;# 是否由服务器决定采用哪种算法默认 off如果 ssl 协议支持 tlsv1、tlsv1.1 老协议设置为 on 并配合 ssl_ciphers 使用如果 ssl 协议为 tlsv1.2、tlsv1.3 新协议设置为 off新协议不再采纳该参数ssl_prefer_server_ciphers off;# 支持 ssl 协议的加密套件ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;# 启用 ssl session 缓存占用 10m 内存缓存时间由 ssl_session_timeout 决定ssl_session_cache shared:SSL:10m;# 客户端可以重用会话的时间ssl_session_timeout 10m;# 客户端请求体大小避免大文件上传 413client_max_body_size 1024m;# HSTS: HTTP 严格传输安全add_header Strict-Transport-Securitymax-age31536000; includeSubDomainsalways;# X-Frame-Options 标头add_header X-Frame-Options sameorigin;# 内容安全策略 (CSP)add_header Content-Security-Policyframe-ancestors self;# HTTPS 通过 HTTP 访问时 Nginx 触发 497 状态码重定向到 HTTPSerror_page497https://$http_host$uri$is_args$args;# 前端静态文件location /{root /data/www/web_frontend;try_files$uri$uri/ /index.html last;}# 后端 WebSocket注意 proxy_pass 后的 /携带 / 转发请求时会去掉匹配前缀location /websocket/{# 代理转发目标proxy_pass http://web;# 请求服务器升级协议为 WebSocketproxy_http_version1.1;proxy_set_header Upgrade$http_upgrade;proxy_set_header Connection$connection_upgrade;# 设置读写超时时间默认 60s 无数据连接将会断开proxy_read_timeout 300s;proxy_send_timeout 300s;# Host 主机名proxy_set_header Host$host;# X-Real-IP 将真实访问者的远端 IP 地址转发给代理服务器proxy_set_header X-Real-IP$remote_addr;# X-Forwarded-For 标记客户端通过代理连接到服务器的源 IPproxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# X-Forwarded-Host 标记客户端通过代理连接到服务器的原始主机proxy_set_header X-Forwarded-Host$host:$server_port;# X-Forwarded-Server 代理服务器的主机名proxy_set_header X-Forwarded-Server$host;# X-Forwarded-Port 定义客户端请求的原始端口proxy_set_header X-Forwarded-Port$server_port;# X-Forwarded-Proto 标记客户端通过代理连接到服务器的协议proxy_set_header X-Forwarded-Proto$scheme;# proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;}}案例十一Stream 配置 创建/etc/nginx/stream.conf.d文件夹添加配置文件 user nginx;worker_processes auto;error_log /var/log/nginx/error.log notice;pid /var/run/nginx.pid;events{worker_connections1024;}http{include /etc/nginx/mime.types;default_type application/octet-stream;log_format main$remote_addr - $remote_user [$time_local] $request $status $body_bytes_sent $http_referer $http_user_agent $http_x_forwarded_for;access_log /var/log/nginx/access.log main;sendfile on;keepalive_timeout65;include /etc/nginx/conf.d/*.conf;}# stream 相关配置文件stream{include /etc/nginx/stream.conf.d/*.conf;}stream.conf upstreamssh{server domain.com:22;}server{listen22;proxy_connect_timeout 10s;proxy_timeout 3600s;proxy_passssh;# 访问日志access_log /var/log/nginx/access.log main;# 错误日志error_log /var/log/nginx/error.log notice;}通用代理 location /_proxy/{# 配置 DNS 服务器proxy_pass 采用变量时需要指定resolver114.114.114.114valid3600s;# 通过正则截取路由中的 sub urlif($request_uri~*/_proxy/(.*)){set$proxy_url$1;}# 解析请求地址并进行反向代理set$is_matched0;if($proxy_url~*^(http|ws)(s?):\/\/?([a-zA-Z0-9\-\.]:?\d*)([^\?]*)){set$is_matched1;set$proxy_protocolhttp$2;set$proxy_host$3;set$proxy_uri$4;set$proxy_url$proxy_protocol://$proxy_host$proxy_uri;proxy_pass$proxy_url$is_args$args;}# 请求服务器升级协议为 WebSocketproxy_http_version1.1;proxy_set_header Upgrade$http_upgrade;proxy_set_header Connection$connection_upgrade;# 设置读写超时时间默认 60s 无数据连接将会断开proxy_read_timeout 300s;proxy_send_timeout 300s;# Host 主机名为了避免目标服务做限制此处采用目标地址的 Hostproxy_set_header Host$proxy_host;# X-Real-IP 将真实访问者的远端 IP 地址转发给代理服务器proxy_set_header X-Real-IP$remote_addr;# X-Forwarded-For 标记客户端通过代理连接到服务器的源 IPproxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# X-Forwarded-Host 标记客户端通过代理连接到服务器的原始主机proxy_set_header X-Forwarded-Host$host:$server_port;# X-Forwarded-Server 代理服务器的主机名proxy_set_header X-Forwarded-Server$host;# X-Forwarded-Port 定义客户端请求的原始端口proxy_set_header X-Forwarded-Port$server_port;# X-Forwarded-Proto 标记客户端通过代理连接到服务器的协议proxy_set_header X-Forwarded-Proto$scheme;# proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;# 如果目标地址为非 http、https、ws、wss 请求提示错误信息default_type application/json;if($is_matched0){return200{code: 404, message: The proxy url is invalid!, proxy_url: $proxy_url};}# 调试输出# return 200 {code: 200, proxy_url: $proxy_url$is_args$args, proxy_host: $proxy_host, request_uri: $request_uri};} nginx配置http和https和stream
1、安装nginx ./configure--prefix/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-stream --with-stream_ssl_preread_module --with-stream_ssl_module--usernginx--groupnginx2、配置nginx#user nobody;worker_processes1;#error_log logs/error.log;#error_log logs/error.log notice;#error_log logs/error.log info;#pid logs/nginx.pid;events{worker_connections1024;}#stream配置stream{upstream adr1{server127.0.0.1:8110;}server{listen82;proxy_pass adr1;}}http{include mime.types;default_type application/octet-stream;sendfile on;#tcp_nopush on;#keepalive_timeout 0;keepalive_timeout65;#gzip on;server{listen80;server_name localhost;#charset koi8-r;#access_log logs/host.access.log main;location /{root html;index index.html index.htm;}#error_page 404 /404.html;# redirect server error pages to the static page /50x.html#error_page500502503504/50x.html;location/50x.html{root html;}}# HTTPS serverserver{listen443ssl;server_name www.baidu.com;ssl_certificate /usr/local/nginx/cert/www.baidu.com/www.baidu.com.pem;ssl_certificate_key /usr/local/nginx/cert/www.baidu.com/www.baidu.com.key;ssl_session_timeout 10m;ssl_session_cache shared:SSL:10m;ssl_protocols SSLv3 SSLv2 TLSv1 TLSv1.1 TLSv1.2;#按照这个协议配置ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location /{root html;index index.html index.htm;}location /java/rehab/{proxy_pass http://127.0.0.1:8993/;proxy_http_version1.1;proxy_set_header Upgrade ℎ;ℎ;ℎ−−remote_addr;proxy_set_header X-Forwarded-For$remote_addr;}}server{listen81;server_name www.baidu.com;client_max_body_size 500M;location /{proxy_pass http://127.0.0.1:8110;proxy_http_version1.1;proxy_set_header Upgrade$http_upgrade;proxy_set_header Connectionupgrade;}}}配置了http请求的代理、websocket代理http{include mime.types;default_type application/octet-stream;sendfile on;tcp_nodelay on;tcp_nopush off;server_tokens off;ssl_session_timeout 5m;client_header_timeout 300s;client_body_timeout 300s;proxy_connect_timeout 300s;proxy_read_timeout 300s;proxy_send_timeout 300s;client_header_buffer_size 16k;client_body_buffer_size 256k;client_max_body_size 256m;proxy_busy_buffers_size 16k;proxy_buffer_size 16k;ssl_buffer_size 16k;max_size10g;access_log off;error_log logs/http_error.log error;#配置日志#添加负载均衡可选upstream myapp1{server192.168.1.98:8080weight3;#设置权重 权重越大 访问几率越大此处98访问的概率比99大三倍,默认权重为1server192.168.1.99:8080;server192.168.1.100:8080 down;# 标记为不可用server192.168.1.101:8080 backup;# 备份服务器}# 定义变量兼容HTTP和WebSocket两种请求协议map$http_upgrade$connection_upgrade{default keep-alive;websocketupgrade;}server{listen0.0.0.0:8080 reuseportbacklog2048so_keepaliveonipv6onlyoff;#定义websocket请求路径location /websocket{proxy_pass http://127.0.0.1:8080;#改为服务ip端口 如果是负载均衡此处需要替换成 http://myapp1;proxy_read_timeout 20s;# 设置超时时间默认是60sproxy_http_version1.1;proxy_set_header Host$host;#将客户端请求中的Host头部信息转发给后端服务器proxy_set_header Upgrade$http_upgrade;#将客户端请求中的Upgrade头部信息转发给后端服务器proxy_set_header Connection$connection_upgrade;}#定义/请求路径location /{proxy_set_header real_ip$remote_addr;proxy_pass http://127.0.0.1:8080;#需要替换具体ip端口 如果是负载均衡此处需要替换成 http://myapp1;proxy_set_header Host$host:$server_port;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;#增加客户端ip到X-Forwarded-Forproxy_set_header X-Forwarded-Proto$scheme;#提供客户端请求使用的协议proxy_set_header X-Forwarded-Port$server_port;#获取nginx监听端口proxy_pass_header Set-Cookie;client_max_body_size 5120m;}}}配置了stream请求的代理stream{tcp_nodelay on;ssl_handshake_timeout 300s;proxy_timeout 10m;proxy_connect_timeout 300s;proxy_buffer_size 256k;preread_timeout 300s;preread_buffer_size 256k;log_format proxy$remote_addr [$time_local] $protocol $status $bytes_sent $bytes_received $session_time $upstream_addr $upstream_bytes_sent $upstream_bytes_received $upstream_connect_time;access_log logs/tcp_access.log proxy;error_log logs/tcp_error.log debug;server{listen0.0.0.0:7788 reuseportbacklog2048so_keepaliveonipv6onlyoff;proxy_pass127.0.0.1:7788;}}在server下配置 include IP.conf;# 需要过滤的ip内容案例1 allow1.1.1.1;#允许1.1.1.1 通过 其他拒绝deny all;内容案例2 deny1.1.1.1;#不允许1.1.1.1访问 其他默认允许其他案例参考1.下载必要组件 yum-yinstallgcc zlib zlib-devel pcre-devel openssl openssl-devel2.生成证书 openssl req-x509-nodes-days3650-newkeyrsa:2048\-keyout server.key-outserver.crt\-config ssl.conf3.下载nginx:https://nginx.org/en/download.htmlwgethttps://nginx.org/download/nginx1.16.0.tar.gz 解压tar-zxvfnginx1.16.0.tar.gz4.安装 linux安装cdnginx-1.9.9/ ./configure--prefix/home/yunpay/nginx --with-stream --with-http_ssl_modulemakemakeinstalldocker安装dockerrun--namenginx-p16379:6379-p443:443-p80:80\-v/data/nginx/data:/usr/share/nginx/html\-v/data/nginx/config/nginx.conf:/etc/nginx/nginx.conf\-v/data/nginx/config/conf.d/default.conf:/etc/nginx/conf.d/default.conf\-v/data/nginx/logs:/var/log/nginx\-v/data/nginx/ssl:/ssl\-dnginx:1.21.35. 案例一配置https和证书 server{# listen 80; #此处仅演示了证书功能未引入80端口listen443ssl;server_name localhost;#这里也可以用你的域名# rewrite ^(.*)$ https://$host$1; #如果需要把http重定向到https尝试以下方法# return 301 https://$host$request_uri; #如果需要把http重定向到https尝试以下方法ssl_certificate /ssl/xxx.com.pem;# xxx.com.pem 这名称根据实际做修改ssl_certificate_key /ssl/xxx.com.key;# xxx.com.key 这名称根据实际做修改ssl_session_timeout 5m;# 指定密码为openssl支持的格式ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;ssl_prefer_server_ciphers on;#依赖SSLv3和TLSv1协议的服务器密码将优先于客户端密码location /{proxy_pass http://192.168.1.1:8080;#需要代理的内网主机IP以及8080端口号根据实际需要做调整}error_page500502503504/50x.html;location/50x.html{root /usr/share/nginx/html;}}案例二配置https和证书# 以下就是复制上边的内容然后把域名和需要代理的内网主机做修改就可以了server{listen443ssl;server_name2.xxx.com;#这里用你的第2个域名ssl_certificate /ssl/xxx.com.pem;ssl_certificate_key /ssl/xxx.com.key;ssl_session_timeout 5m;ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;ssl_prefer_server_ciphers on;location /{proxy_pass http://192.168.1.2:8080;}error_page500502503504/50x.html;location/50x.html{root /usr/share/nginx/html;}}案例三配置stream调用redis stream{upstream redis{server *主机IP地址或容器地址*:6379;# server *主机IP地址或容器地址*:6379;再加一个是轮询同主机同服务的不同端口也可}server{listen6379;proxy_connect_timeout 1s;proxy_timeout 3s;proxy_pass redis;# ssl_certificate /ssl/server.crt;# ssl_certificate_key /ssl/server.key;# ssl_session_timeout 45s;#没有数据传输时45s踢掉这个会话# ssl_protocols TLSv1 TLSv1.1 TLSv1.2;# ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;# ssl_prefer_server_ciphers on;}}案例四配置http和websocket map$http_upgrade$connection_upgrade{default upgrade;# close;}server{# 多个域名多个服务可以多写几个serverkeepalive_requests150;listen80;server_name test.test.com;#监听地址client_max_body_size 1000M;location /{proxy_http_version1.1;proxy_set_header Connection;proxy_pass http://192.168.1.100:8080;}location /ws{# /ws后边是否带“/”有本质上的区别带“/”表示引用ws下一级路径#proxy_next_upstream error timeout invalid_header http_500 http_503 http_404;proxy_pass http://192.168.1.100:61624;proxy_set_header Upgrade$http_upgrade;proxy_set_header Connectionupgrade;}}案例五配置stream调用rabbitmq user nginx;worker_processes auto;error_log /var/log/nginx/error.log notice;pid /var/run/nginx.pid;events{worker_connections10240;}stream{log_format proxy$remote_addr [$time_local] $protocol $status $bytes_sent $bytes_received $session_time $upstream_addr $upstream_bytes_sent $upstream_bytes_received $upstream_connect_time;upstream rabbitmq8883{# server 192.168.0.137:1883;server192.168.0.137:8884;server192.168.0.137:8885;server192.168.0.137:8886;server192.168.0.137:8887;server192.168.0.137:8888;server192.168.0.137:8889;server192.168.0.137:8890;server192.168.0.137:8891;server192.168.0.137:8892;server192.168.0.137:8893;}server{error_log /var/log/nginx/rabbitmq8883__error.log;#这里是容器内路径根据自己持久化路径找对应主机路径access_log /var/log/nginx/rabbitmq8883__access.log proxy;#这里是容器内路径根据自己持久化路径找对应主机路径listen8883;# listen 8883 ssl;proxy_connect_timeout 45s;proxy_timeout 45s;proxy_pass rabbitmq8883;# ssl_certificate /ssl/server.crt;# ssl_certificate_key /ssl/server.key;# #ssl_session_timeout 45s;# ssl_protocols TLSv1 TLSv1.1 TLSv1.2;# ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;# ssl_prefer_server_ciphers on;}案例六配置stream调用ftp stream{upstream ftp{hash$remote_addrconsistent;server10.14.168.32:2121;}server{listen8003;proxy_connect_timeout 300s;proxy_timeout 300s;proxy_passftp;}}案例七http upstream web{server domain.com:80;}server{# 监听 tcp4listen80;# 监听 tcp6listen[::]:80;# 无效域名 _ 匹配任意域名优先级最低server_name _;# 访问日志access_log /var/log/nginx/access.log main;# 错误日志error_log /var/log/nginx/error.log notice;# 客户端请求体大小避免大文件上传 413client_max_body_size 1024m;# X-Frame-Options 标头add_header X-Frame-Options sameorigin;# 内容安全策略 (CSP)add_header Content-Security-Policyframe-ancestors self;# 前端静态文件location /{root /data/www/web_frontend;try_files$uri$uri/ /index.html last;}# 后端 API注意 proxy_pass 后的 /携带 / 转发请求时会去掉匹配前缀location /api/{# 代理转发目标注意需要添加请求协议proxy_pass http://web/;# Host 主机名proxy_set_header Host$host;# X-Real-IP 将真实访问者的远端 IP 地址转发给代理服务器proxy_set_header X-Real-IP$remote_addr;# X-Forwarded-For 标记客户端通过代理连接到服务器的源 IPproxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# X-Forwarded-Host 标记客户端通过代理连接到服务器的原始主机proxy_set_header X-Forwarded-Host$host:$server_port;# X-Forwarded-Server 代理服务器的主机名proxy_set_header X-Forwarded-Server$host;# X-Forwarded-Port 定义客户端请求的原始端口proxy_set_header X-Forwarded-Port$server_port;# X-Forwarded-Proto 标记客户端通过代理连接到服务器的协议proxy_set_header X-Forwarded-Proto$scheme;# proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;}}案例八https upstream web{server domain.com:443;}server{# 监听 tcp4 并开启 http2listen443ssl http2;# 监听 tcp6 并开启 http2listen[::]:443 ssl http2;# 无效域名 _ 匹配任意域名优先级最低server_name _;# 访问日志access_log /var/log/nginx/access.log main;# 错误日志error_log /var/log/nginx/error.log notice;# 服务器证书文件ssl_certificate /data/www/domain.com/certs/server.crt;# 服务器证书密钥文件ssl_certificate_key /data/www/domain.com/certs/server.key;# 支持的 ssl 或 tls 的版本ssl_protocols TLSv1.2 TLSv1.3;# 是否由服务器决定采用哪种算法默认 off如果 ssl 协议支持 tlsv1、tlsv1.1 老协议设置为 on 并配合 ssl_ciphers 使用如果 ssl 协议为 tlsv1.2、tlsv1.3 新协议设置为 off新协议不再采纳该参数ssl_prefer_server_ciphers off;# 支持 ssl 协议的加密套件ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;# 启用 ssl session 缓存占用 10m 内存缓存时间由 ssl_session_timeout 决定ssl_session_cache shared:SSL:10m;# 客户端可以重用会话的时间ssl_session_timeout 10m;# 客户端请求体大小避免大文件上传 413client_max_body_size 1024m;# HSTS: HTTP 严格传输安全add_header Strict-Transport-Securitymax-age31536000; includeSubDomainsalways;# X-Frame-Options 标头add_header X-Frame-Options sameorigin;# 内容安全策略 (CSP)add_header Content-Security-Policyframe-ancestors self;# HTTPS 通过 HTTP 访问时 Nginx 触发 497 状态码重定向到 HTTPSerror_page497https://$http_host$uri$is_args$args;# 前端静态文件location /{root /data/www/web_frontend;try_files$uri$uri/ /index.html last;}# 后端 API注意 proxy_pass 后的 /携带 / 转发请求时会去掉匹配前缀location /api/{# 代理转发目标注意需要添加请求协议proxy_pass http://web/;# Host 主机名proxy_set_header Host$host;# X-Real-IP 将真实访问者的远端 IP 地址转发给代理服务器proxy_set_header X-Real-IP$remote_addr;# X-Forwarded-For 标记客户端通过代理连接到服务器的源 IPproxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# X-Forwarded-Host 标记客户端通过代理连接到服务器的原始主机proxy_set_header X-Forwarded-Host$host:$server_port;# X-Forwarded-Server 代理服务器的主机名proxy_set_header X-Forwarded-Server$host;# X-Forwarded-Port 定义客户端请求的原始端口proxy_set_header X-Forwarded-Port$server_port;# X-Forwarded-Proto 标记客户端通过代理连接到服务器的协议proxy_set_header X-Forwarded-Proto$scheme;# proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;}}案例九配置ws请求http upstream web{server domain.com:80;}# map 指令根据客户端请求头中 $http_upgrade 的值构建 $connection_upgrade 的值如果 $http_upgrade 没有匹配默认值为 upgrade如果 $http_upgrade 配置空字符串值为 closemap$http_upgrade$connection_upgrade{default upgrade;close;}server{# 监听 tcp4listen80;# 监听 tcp6listen[::]:80;# 无效域名 _ 匹配任意域名优先级最低server_name _;# 访问日志access_log /var/log/nginx/access.log main;# 错误日志error_log /var/log/nginx/error.log notice;# 客户端请求体大小避免大文件上传 413client_max_body_size 1024m;# X-Frame-Options 标头add_header X-Frame-Options sameorigin;# 内容安全策略 (CSP)add_header Content-Security-Policyframe-ancestors self;# 前端静态文件location /{root /data/www/web_frontend;try_files$uri$uri/ /index.html last;}# 后端 WebSocket注意 proxy_pass 后的 /携带 / 转发请求时会去掉匹配前缀location /websocket/{# 代理转发目标proxy_pass http://web;# 请求服务器升级协议为 WebSocketproxy_http_version1.1;proxy_set_header Upgrade$http_upgrade;proxy_set_header Connection$connection_upgrade;# 设置读写超时时间默认 60s 无数据连接将会断开proxy_read_timeout 300s;proxy_send_timeout 300s;# Host 主机名proxy_set_header Host$host;# X-Real-IP 将真实访问者的远端 IP 地址转发给代理服务器proxy_set_header X-Real-IP$remote_addr;# X-Forwarded-For 标记客户端通过代理连接到服务器的源 IPproxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# X-Forwarded-Host 标记客户端通过代理连接到服务器的原始主机proxy_set_header X-Forwarded-Host$host:$server_port;# X-Forwarded-Server 代理服务器的主机名proxy_set_header X-Forwarded-Server$host;# X-Forwarded-Port 定义客户端请求的原始端口proxy_set_header X-Forwarded-Port$server_port;# X-Forwarded-Proto 标记客户端通过代理连接到服务器的协议proxy_set_header X-Forwarded-Proto$scheme;# proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;}}案例十配置ws请求https upstream web{server domain.com:443;}# map 指令根据客户端请求头中 $http_upgrade 的值构建 $connection_upgrade 的值如果 $http_upgrade 没有匹配默认值为 upgrade如果 $http_upgrade 配置空字符串值为 closemap$http_upgrade$connection_upgrade{default upgrade;close;}server{# 监听 tcp4 并开启 http2listen443ssl http2;# 监听 tcp6 并开启 http2listen[::]:443 ssl http2;# 无效域名 _ 匹配任意域名优先级最低server_name _;# 访问日志access_log /var/log/nginx/access.log main;# 错误日志error_log /var/log/nginx/error.log notice;# 服务器证书文件ssl_certificate /data/www/domain.com/certs/server.crt;# 服务器证书密钥文件ssl_certificate_key /data/www/domain.com/certs/server.key;# 支持的 ssl 或 tls 的版本ssl_protocols TLSv1.2 TLSv1.3;# 是否由服务器决定采用哪种算法默认 off如果 ssl 协议支持 tlsv1、tlsv1.1 老协议设置为 on 并配合 ssl_ciphers 使用如果 ssl 协议为 tlsv1.2、tlsv1.3 新协议设置为 off新协议不再采纳该参数ssl_prefer_server_ciphers off;# 支持 ssl 协议的加密套件ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;# 启用 ssl session 缓存占用 10m 内存缓存时间由 ssl_session_timeout 决定ssl_session_cache shared:SSL:10m;# 客户端可以重用会话的时间ssl_session_timeout 10m;# 客户端请求体大小避免大文件上传 413client_max_body_size 1024m;# HSTS: HTTP 严格传输安全add_header Strict-Transport-Securitymax-age31536000; includeSubDomainsalways;# X-Frame-Options 标头add_header X-Frame-Options sameorigin;# 内容安全策略 (CSP)add_header Content-Security-Policyframe-ancestors self;# HTTPS 通过 HTTP 访问时 Nginx 触发 497 状态码重定向到 HTTPSerror_page497https://$http_host$uri$is_args$args;# 前端静态文件location /{root /data/www/web_frontend;try_files$uri$uri/ /index.html last;}# 后端 WebSocket注意 proxy_pass 后的 /携带 / 转发请求时会去掉匹配前缀location /websocket/{# 代理转发目标proxy_pass http://web;# 请求服务器升级协议为 WebSocketproxy_http_version1.1;proxy_set_header Upgrade$http_upgrade;proxy_set_header Connection$connection_upgrade;# 设置读写超时时间默认 60s 无数据连接将会断开proxy_read_timeout 300s;proxy_send_timeout 300s;# Host 主机名proxy_set_header Host$host;# X-Real-IP 将真实访问者的远端 IP 地址转发给代理服务器proxy_set_header X-Real-IP$remote_addr;# X-Forwarded-For 标记客户端通过代理连接到服务器的源 IPproxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# X-Forwarded-Host 标记客户端通过代理连接到服务器的原始主机proxy_set_header X-Forwarded-Host$host:$server_port;# X-Forwarded-Server 代理服务器的主机名proxy_set_header X-Forwarded-Server$host;# X-Forwarded-Port 定义客户端请求的原始端口proxy_set_header X-Forwarded-Port$server_port;# X-Forwarded-Proto 标记客户端通过代理连接到服务器的协议proxy_set_header X-Forwarded-Proto$scheme;# proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;}}案例十一Stream 配置 创建/etc/nginx/stream.conf.d文件夹添加配置文件 user nginx;worker_processes auto;error_log /var/log/nginx/error.log notice;pid /var/run/nginx.pid;events{worker_connections1024;}http{include /etc/nginx/mime.types;default_type application/octet-stream;log_format main$remote_addr - $remote_user [$time_local] $request $status $body_bytes_sent $http_referer $http_user_agent $http_x_forwarded_for;access_log /var/log/nginx/access.log main;sendfile on;keepalive_timeout65;include /etc/nginx/conf.d/*.conf;}# stream 相关配置文件stream{include /etc/nginx/stream.conf.d/*.conf;}stream.conf upstreamssh{server domain.com:22;}server{listen22;proxy_connect_timeout 10s;proxy_timeout 3600s;proxy_passssh;# 访问日志access_log /var/log/nginx/access.log main;# 错误日志error_log /var/log/nginx/error.log notice;}通用代理 location /_proxy/{# 配置 DNS 服务器proxy_pass 采用变量时需要指定resolver114.114.114.114valid3600s;# 通过正则截取路由中的 sub urlif($request_uri~*/_proxy/(.*)){set$proxy_url$1;}# 解析请求地址并进行反向代理set$is_matched0;if($proxy_url~*^(http|ws)(s?):\/\/?([a-zA-Z0-9\-\.]:?\d*)([^\?]*)){set$is_matched1;set$proxy_protocolhttp$2;set$proxy_host$3;set$proxy_uri$4;set$proxy_url$proxy_protocol://$proxy_host$proxy_uri;proxy_pass$proxy_url$is_args$args;}# 请求服务器升级协议为 WebSocketproxy_http_version1.1;proxy_set_header Upgrade$http_upgrade;proxy_set_header Connection$connection_upgrade;# 设置读写超时时间默认 60s 无数据连接将会断开proxy_read_timeout 300s;proxy_send_timeout 300s;# Host 主机名为了避免目标服务做限制此处采用目标地址的 Hostproxy_set_header Host$proxy_host;# X-Real-IP 将真实访问者的远端 IP 地址转发给代理服务器proxy_set_header X-Real-IP$remote_addr;# X-Forwarded-For 标记客户端通过代理连接到服务器的源 IPproxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# X-Forwarded-Host 标记客户端通过代理连接到服务器的原始主机proxy_set_header X-Forwarded-Host$host:$server_port;# X-Forwarded-Server 代理服务器的主机名proxy_set_header X-Forwarded-Server$host;# X-Forwarded-Port 定义客户端请求的原始端口proxy_set_header X-Forwarded-Port$server_port;# X-Forwarded-Proto 标记客户端通过代理连接到服务器的协议proxy_set_header X-Forwarded-Proto$scheme;# proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;# 如果目标地址为非 http、https、ws、wss 请求提示错误信息default_type application/json;if($is_matched0){return200{code: 404, message: The proxy url is invalid!, proxy_url: $proxy_url};}# 调试输出# return 200 {code: 200, proxy_url: $proxy_url$is_args$args, proxy_host: $proxy_host, request_uri: $request_uri};}