摘要本文详细介绍 Nginx 在生产环境中的部署实战涵盖前端应用部署、后端服务代理、数据库管理、监控告警和故障排查。通过本文档你将掌握 Nginx 在生产环境中的最佳实践能够独立完成完整的部署流程。关键词Nginx、部署实战、前端部署、后端代理、数据库、监控、故障排查适合人群有 Nginx 基础的开发者、运维工程师、想学习生产环境部署的工程师阅读时间约 50 分钟版本信息Nginx 1.24 | 支持 Linux/Windows/macOS文章目录1. 前端应用部署1.1 Vue/React 单页应用1.2 多环境部署1.3 静态网站部署2. 后端服务代理2.1 Node.js 服务代理2.2 Python 服务代理2.3 Java 服务代理2.4 PHP 服务代理3. WebSocket 代理3.1 基础 WebSocket 代理3.2 Socket.IO 代理4. 数据库管理4.1 MySQL 代理4.2 Redis 代理5. 监控告警5.1 Nginx 状态监控5.2 Prometheus 监控5.3 日志监控6. 故障排查6.1 常见问题排查问题 1Nginx 无法启动问题 2502 Bad Gateway问题 3404 Not Found问题 4504 Gateway Timeout6.2 性能排查6.3 日志分析7. 实战案例实战 1完整的前后端分离部署实战 2微服务网关部署实战 3文件上传服务器8. 常见问题 FAQ9. 学习资源与建议学习建议官方资源推荐工具1. 前端应用部署1.1 Vue/React 单页应用部署 Vue/React 等单页应用SPA需要特殊配置支持前端路由server { listen 80; server_name example.com; # 前端构建目录 root /var/www/my-app/dist; index index.html; # SPA 路由支持 location / { try_files $uri $uri/ /index.html; } # 静态资源缓存 location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2)$ { expires 1y; add_header Cache-Control public, immutable; } # HTML 文件不缓存 location ~* \.html$ { expires -1; add_header Cache-Control no-cache, no-store, must-revalidate; } # 后端 API 代理 location /api { proxy_pass http://localhost:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } }配置说明try_files $uri $uri/ /index.html如果文件不存在返回 index.html支持前端路由静态资源缓存 1 年文件名带 hashHTML 文件不缓存确保获取最新版本1.2 多环境部署同一服务器部署多个环境# 生产环境 server { listen 80; server_name prod.example.com; root /var/www/prod/dist; index index.html; location / { try_files $uri $uri/ /index.html; } } # 测试环境 server { listen 80; server_name test.example.com; root /var/www/test/dist; index index.html; location / { try_files $uri $uri/ /index.html; } } # 开发环境 server { listen 80; server_name dev.example.com; root /var/www/dev/dist; index index.html; location / { try_files $uri $uri/ /index.html; } }1.3 静态网站部署部署纯静态网站HTML/CSS/JSserver { listen 80; server_name static.example.com; root /var/www/static-site; index index.html; # Gzip 压缩 gzip on; gzip_comp_level 5; gzip_min_length 1k; gzip_types text/plain text/css application/json application/javascript text/xml; # 静态资源缓存 location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2)$ { expires 30d; add_header Cache-Control public, immutable; } # 默认匹配 location / { try_files $uri $uri/ 404; } }2. 后端服务代理2.1 Node.js 服务代理代理 Node.js 后端服务upstream node_backend { server 127.0.0.1:3000; server 127.0.0.1:3001; server 127.0.0.1:3002; keepalive 32; } server { listen 80; server_name api.example.com; # Gzip 压缩 gzip on; gzip_types application/json text/plain; location / { proxy_pass http://node_backend; proxy_http_version 1.1; proxy_set_header Connection ; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # 超时设置 proxy_connect_timeout 60s; proxy_read_timeout 60s; proxy_send_timeout 60s; } }2.2 Python 服务代理代理 Python 后端服务Flask/FastAPIupstream python_backend { server 127.0.0.1:8000; server 127.0.0.1:8001; keepalive 32; } server { listen 80; server_name api.example.com; location / { proxy_pass http://python_backend; proxy_http_version 1.1; proxy_set_header Connection ; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } }2.3 Java 服务代理代理 Java 后端服务Spring Bootupstream java_backend { server 127.0.0.1:8080; server 127.0.0.1:8081; keepalive 32; } server { listen 80; server_name api.example.com; # 大文件上传 client_max_body_size 50m; location / { proxy_pass http://java_backend; proxy_http_version 1.1; proxy_set_header Connection ; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; # 超时设置Java 服务可能需要更长时间 proxy_connect_timeout 120s; proxy_read_timeout 120s; proxy_send_timeout 120s; } }2.4 PHP 服务代理代理 PHP 服务PHP-FPMserver { listen 80; server_name php.example.com; root /var/www/php-app; index index.php index.html; location / { try_files $uri $uri/ /index.php?$query_string; } location ~ \.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } }3. WebSocket 代理3.1 基础 WebSocket 代理配置 WebSocket 代理map $http_upgrade $connection_upgrade { default upgrade; close; } upstream websocket_backend { server 127.0.0.1:3000; } server { listen 80; server_name ws.example.com; location /ws { proxy_pass http://websocket_backend; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; # 超时设置WebSocket 需要更长时间 proxy_read_timeout 86400s; proxy_send_timeout 86400s; } }3.2 Socket.IO 代理配置 Socket.IO 代理upstream socketio_backend { ip_hash; # 会话保持 server 127.0.0.1:3000; server 127.0.0.1:3001; } server { listen 80; server_name socketio.example.com; location /socket.io/ { proxy_pass http://socketio_backend; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_read_timeout 86400s; proxy_send_timeout 86400s; } }提示Socket.IO 必须使用ip_hash或会话保持否则长连接可能断开。4. 数据库管理4.1 MySQL 代理使用 Nginx 代理 MySQL 连接不推荐但可行stream { upstream mysql_backend { server 127.0.0.1:3306; } server { listen 3307; proxy_pass mysql_backend; } }提示数据库代理通常使用专业的代理工具如 ProxySQL、MaxScaleNginx 更适合 HTTP 代理。4.2 Redis 代理使用 Nginx 代理 Redis 连接stream { upstream redis_backend { server 127.0.0.1:6379; } server { listen 6380; proxy_pass redis_backend; } }提示stream块用于 TCP/UDP 代理与http块平级。5. 监控告警5.1 Nginx 状态监控启用 Nginx 状态监控模块http { # 启用状态监控 server { listen 80; server_name status.example.com; location /nginx_status { stub_status on; access_log off; allow 127.0.0.1; allow 10.0.0.0/8; deny all; } } }访问状态curlhttp://status.example.com/nginx_status输出说明Active connections: 123 server accepts handled requests 12345 12345 67890 Reading: 1 Writing: 2 Waiting: 120指标说明Active connections当前活跃连接数accepts已接受的连接数handled已处理的连接数requests已处理的请求数Reading正在读取请求头的连接数Writing正在发送响应的连接数Waiting等待请求的空闲连接数5.2 Prometheus 监控使用 Prometheus 监控 Nginx# 安装 nginx-exporter # https://github.com/nginxinc/nginx-prometheus-exporter # 启动 exporter nginx-prometheus-exporter -nginx.scrape-uri http://localhost/nginx_statusPrometheus 配置scrape_configs:-job_name:nginxstatic_configs:-targets:[localhost:9113]5.3 日志监控使用 ELK 栈监控 Nginx 日志http { # JSON 格式日志便于 ELK 解析 log_format json escapejson { time: $time_local, remote_addr: $remote_addr, request: $request, status: $status, body_bytes_sent: $body_bytes_sent, http_referer: $http_referer, http_user_agent: $http_user_agent, request_time: $request_time, upstream_response_time: $upstream_response_time }; access_log /var/log/nginx/access.log json; }6. 故障排查6.1 常见问题排查问题 1Nginx 无法启动# 检查配置文件语法nginx-t# 查看错误日志tail-f/var/log/nginx/error.log# 检查端口占用netstat-tlnp|grep:80# 检查权限ls-l/var/log/nginx/问题 2502 Bad Gateway# 检查后端服务是否运行curlhttp://localhost:3000# 检查 Nginx 错误日志tail-f/var/log/nginx/error.log# 检查防火墙sudoufw status问题 3404 Not Found# 检查文件是否存在ls-l/var/www/html/index.html# 检查 root 路径配置cat/etc/nginx/nginx.conf# 检查权限chmod755/var/www/htmlchown-Rwww-data:www-data /var/www/html问题 4504 Gateway Timeout# 增加超时时间 location / { proxy_connect_timeout 120s; proxy_read_timeout 120s; proxy_send_timeout 120s; }6.2 性能排查# 查看当前连接数netstat-n|grep:80|wc-l# 查看各状态连接数netstat-n|grep:80|awk/^tcp/ {S[$NF]} END {for(a in S) print a, S[a]}# 查看 Nginx 进程psaux|grepnginx# 查看系统负载tophtop6.3 日志分析# 查看最近 100 条错误日志tail-n100/var/log/nginx/error.log# 查看最近 100 条访问日志tail-n100/var/log/nginx/access.log# 统计状态码分布awk{print $9}/var/log/nginx/access.log|sort|uniq-c|sort-rn# 统计 IP 访问次数awk{print $1}/var/log/nginx/access.log|sort|uniq-c|sort-rn|head-20# 统计慢请求响应时间 1sawk$NF 1 {print}/var/log/nginx/access.log7. 实战案例实战 1完整的前后端分离部署worker_processes auto; worker_cpu_affinity auto; events { worker_connections 2048; use epoll; multi_accept on; } http { include mime.types; default_type application/octet-stream; sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; # Gzip 压缩 gzip on; gzip_comp_level 5; gzip_min_length 1k; gzip_types text/plain text/css application/json application/javascript text/xml application/xml; # 限流配置 limit_req_zone $binary_remote_addr zoneapi_limit:10m rate20r/s; # 后端服务器 upstream backend { server 127.0.0.1:3000; server 127.0.0.1:3001; keepalive 32; } # HTTP 重定向到 HTTPS server { listen 80; server_name example.com www.example.com; return 301 https://$host$request_uri; } # HTTPS 服务器 server { listen 443 ssl http2; server_name example.com www.example.com; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; # 安全头 add_header X-Frame-Options SAMEORIGIN always; add_header X-Content-Type-Options nosniff always; add_header X-XSS-Protection 1; modeblock always; add_header Strict-Transport-Security max-age31536000; includeSubDomains always; # 前端静态文件 root /var/www/my-app/dist; index index.html; location / { try_files $uri $uri/ /index.html; } # 静态资源缓存 location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2)$ { expires 1y; add_header Cache-Control public, immutable; } # 后端 API 代理 location /api { limit_req zoneapi_limit burst50 nodelay; proxy_pass http://backend; proxy_http_version 1.1; proxy_set_header Connection ; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } # 日志 access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log warn; } }项目知识点工作进程优化Gzip 压缩限流配置HTTPS 配置安全头配置静态资源缓存反向代理实战 2微服务网关部署upstream user_service { server 127.0.0.1:3001; server 127.0.0.1:3002; } upstream order_service { server 127.0.0.1:4001; server 127.0.0.1:4002; } upstream product_service { server 127.0.0.1:5001; server 127.0.0.1:5002; } server { listen 80; server_name gateway.example.com; # 用户服务 location /api/users { proxy_pass http://user_service; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } # 订单服务 location /api/orders { proxy_pass http://order_service; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } # 商品服务 location /api/products { proxy_pass http://product_service; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } }实战 3文件上传服务器server { listen 80; server_name upload.example.com; client_max_body_size 100m; location /upload { root /var/www/uploads; client_body_rate 1m; client_body_timeout 120s; } location /download { root /var/www/uploads; limit_rate 500k; } }8. 常见问题 FAQQ1如何查看 Nginx 是否启动成功A使用以下命令# 查看进程psaux|grepnginx# 查看端口netstat-tlnp|grep:80# 查看错误日志tail-f/var/log/nginx/error.logQ2如何平滑重启 NginxA按以下步骤操作# 1. 测试配置语法nginx-t# 2. 平滑重启nginx-sreloadQ3如何配置 HTTPSA使用 Let’s Encrypt 免费证书# 安装 certbotsudoaptinstallcertbot python3-certbot-nginx# 获取证书sudocertbot--nginx-dexample.comQ4如何限制上传文件大小A使用client_max_body_sizeserver { client_max_body_size 10m; # 最大 10MB }Q5如何配置跨域A使用add_headerlocation /api { add_header Access-Control-Allow-Origin https://example.com always; add_header Access-Control-Allow-Methods GET, POST, PUT, DELETE, OPTIONS always; add_header Access-Control-Allow-Headers Authorization, Content-Type, Accept always; if ($request_method OPTIONS) { return 204; } }9. 学习资源与建议学习建议1.先掌握基础再学习实战确保理解基础配置后再进行实战部署2.多查看官方文档官方文档是最权威的资料3.善用测试命令每次修改配置后先用nginx -t测试语法4.查看日志排错遇到问题时查看错误日志是最快的排错方法5.使用版本控制配置文件使用 Git 管理方便回滚和对比官方资源Nginx 官方文档Nginx 部署指南Let’s Encrypt - 免费 SSL 证书Prometheus - 监控系统推荐工具SSL Labs - SSL 配置测试GTmetrix - 网站性能测试curl - HTTP 请求测试Postman - API 测试
04-Nginx部署实战完全指南（前端部署 + 后端代理 + 监控告警 + 故障排查）
摘要本文详细介绍 Nginx 在生产环境中的部署实战涵盖前端应用部署、后端服务代理、数据库管理、监控告警和故障排查。通过本文档你将掌握 Nginx 在生产环境中的最佳实践能够独立完成完整的部署流程。关键词Nginx、部署实战、前端部署、后端代理、数据库、监控、故障排查适合人群有 Nginx 基础的开发者、运维工程师、想学习生产环境部署的工程师阅读时间约 50 分钟版本信息Nginx 1.24 | 支持 Linux/Windows/macOS文章目录1. 前端应用部署1.1 Vue/React 单页应用1.2 多环境部署1.3 静态网站部署2. 后端服务代理2.1 Node.js 服务代理2.2 Python 服务代理2.3 Java 服务代理2.4 PHP 服务代理3. WebSocket 代理3.1 基础 WebSocket 代理3.2 Socket.IO 代理4. 数据库管理4.1 MySQL 代理4.2 Redis 代理5. 监控告警5.1 Nginx 状态监控5.2 Prometheus 监控5.3 日志监控6. 故障排查6.1 常见问题排查问题 1Nginx 无法启动问题 2502 Bad Gateway问题 3404 Not Found问题 4504 Gateway Timeout6.2 性能排查6.3 日志分析7. 实战案例实战 1完整的前后端分离部署实战 2微服务网关部署实战 3文件上传服务器8. 常见问题 FAQ9. 学习资源与建议学习建议官方资源推荐工具1. 前端应用部署1.1 Vue/React 单页应用部署 Vue/React 等单页应用SPA需要特殊配置支持前端路由server { listen 80; server_name example.com; # 前端构建目录 root /var/www/my-app/dist; index index.html; # SPA 路由支持 location / { try_files $uri $uri/ /index.html; } # 静态资源缓存 location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2)$ { expires 1y; add_header Cache-Control public, immutable; } # HTML 文件不缓存 location ~* \.html$ { expires -1; add_header Cache-Control no-cache, no-store, must-revalidate; } # 后端 API 代理 location /api { proxy_pass http://localhost:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } }配置说明try_files $uri $uri/ /index.html如果文件不存在返回 index.html支持前端路由静态资源缓存 1 年文件名带 hashHTML 文件不缓存确保获取最新版本1.2 多环境部署同一服务器部署多个环境# 生产环境 server { listen 80; server_name prod.example.com; root /var/www/prod/dist; index index.html; location / { try_files $uri $uri/ /index.html; } } # 测试环境 server { listen 80; server_name test.example.com; root /var/www/test/dist; index index.html; location / { try_files $uri $uri/ /index.html; } } # 开发环境 server { listen 80; server_name dev.example.com; root /var/www/dev/dist; index index.html; location / { try_files $uri $uri/ /index.html; } }1.3 静态网站部署部署纯静态网站HTML/CSS/JSserver { listen 80; server_name static.example.com; root /var/www/static-site; index index.html; # Gzip 压缩 gzip on; gzip_comp_level 5; gzip_min_length 1k; gzip_types text/plain text/css application/json application/javascript text/xml; # 静态资源缓存 location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2)$ { expires 30d; add_header Cache-Control public, immutable; } # 默认匹配 location / { try_files $uri $uri/ 404; } }2. 后端服务代理2.1 Node.js 服务代理代理 Node.js 后端服务upstream node_backend { server 127.0.0.1:3000; server 127.0.0.1:3001; server 127.0.0.1:3002; keepalive 32; } server { listen 80; server_name api.example.com; # Gzip 压缩 gzip on; gzip_types application/json text/plain; location / { proxy_pass http://node_backend; proxy_http_version 1.1; proxy_set_header Connection ; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # 超时设置 proxy_connect_timeout 60s; proxy_read_timeout 60s; proxy_send_timeout 60s; } }2.2 Python 服务代理代理 Python 后端服务Flask/FastAPIupstream python_backend { server 127.0.0.1:8000; server 127.0.0.1:8001; keepalive 32; } server { listen 80; server_name api.example.com; location / { proxy_pass http://python_backend; proxy_http_version 1.1; proxy_set_header Connection ; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } }2.3 Java 服务代理代理 Java 后端服务Spring Bootupstream java_backend { server 127.0.0.1:8080; server 127.0.0.1:8081; keepalive 32; } server { listen 80; server_name api.example.com; # 大文件上传 client_max_body_size 50m; location / { proxy_pass http://java_backend; proxy_http_version 1.1; proxy_set_header Connection ; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; # 超时设置Java 服务可能需要更长时间 proxy_connect_timeout 120s; proxy_read_timeout 120s; proxy_send_timeout 120s; } }2.4 PHP 服务代理代理 PHP 服务PHP-FPMserver { listen 80; server_name php.example.com; root /var/www/php-app; index index.php index.html; location / { try_files $uri $uri/ /index.php?$query_string; } location ~ \.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } }3. WebSocket 代理3.1 基础 WebSocket 代理配置 WebSocket 代理map $http_upgrade $connection_upgrade { default upgrade; close; } upstream websocket_backend { server 127.0.0.1:3000; } server { listen 80; server_name ws.example.com; location /ws { proxy_pass http://websocket_backend; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; # 超时设置WebSocket 需要更长时间 proxy_read_timeout 86400s; proxy_send_timeout 86400s; } }3.2 Socket.IO 代理配置 Socket.IO 代理upstream socketio_backend { ip_hash; # 会话保持 server 127.0.0.1:3000; server 127.0.0.1:3001; } server { listen 80; server_name socketio.example.com; location /socket.io/ { proxy_pass http://socketio_backend; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_read_timeout 86400s; proxy_send_timeout 86400s; } }提示Socket.IO 必须使用ip_hash或会话保持否则长连接可能断开。4. 数据库管理4.1 MySQL 代理使用 Nginx 代理 MySQL 连接不推荐但可行stream { upstream mysql_backend { server 127.0.0.1:3306; } server { listen 3307; proxy_pass mysql_backend; } }提示数据库代理通常使用专业的代理工具如 ProxySQL、MaxScaleNginx 更适合 HTTP 代理。4.2 Redis 代理使用 Nginx 代理 Redis 连接stream { upstream redis_backend { server 127.0.0.1:6379; } server { listen 6380; proxy_pass redis_backend; } }提示stream块用于 TCP/UDP 代理与http块平级。5. 监控告警5.1 Nginx 状态监控启用 Nginx 状态监控模块http { # 启用状态监控 server { listen 80; server_name status.example.com; location /nginx_status { stub_status on; access_log off; allow 127.0.0.1; allow 10.0.0.0/8; deny all; } } }访问状态curlhttp://status.example.com/nginx_status输出说明Active connections: 123 server accepts handled requests 12345 12345 67890 Reading: 1 Writing: 2 Waiting: 120指标说明Active connections当前活跃连接数accepts已接受的连接数handled已处理的连接数requests已处理的请求数Reading正在读取请求头的连接数Writing正在发送响应的连接数Waiting等待请求的空闲连接数5.2 Prometheus 监控使用 Prometheus 监控 Nginx# 安装 nginx-exporter # https://github.com/nginxinc/nginx-prometheus-exporter # 启动 exporter nginx-prometheus-exporter -nginx.scrape-uri http://localhost/nginx_statusPrometheus 配置scrape_configs:-job_name:nginxstatic_configs:-targets:[localhost:9113]5.3 日志监控使用 ELK 栈监控 Nginx 日志http { # JSON 格式日志便于 ELK 解析 log_format json escapejson { time: $time_local, remote_addr: $remote_addr, request: $request, status: $status, body_bytes_sent: $body_bytes_sent, http_referer: $http_referer, http_user_agent: $http_user_agent, request_time: $request_time, upstream_response_time: $upstream_response_time }; access_log /var/log/nginx/access.log json; }6. 故障排查6.1 常见问题排查问题 1Nginx 无法启动# 检查配置文件语法nginx-t# 查看错误日志tail-f/var/log/nginx/error.log# 检查端口占用netstat-tlnp|grep:80# 检查权限ls-l/var/log/nginx/问题 2502 Bad Gateway# 检查后端服务是否运行curlhttp://localhost:3000# 检查 Nginx 错误日志tail-f/var/log/nginx/error.log# 检查防火墙sudoufw status问题 3404 Not Found# 检查文件是否存在ls-l/var/www/html/index.html# 检查 root 路径配置cat/etc/nginx/nginx.conf# 检查权限chmod755/var/www/htmlchown-Rwww-data:www-data /var/www/html问题 4504 Gateway Timeout# 增加超时时间 location / { proxy_connect_timeout 120s; proxy_read_timeout 120s; proxy_send_timeout 120s; }6.2 性能排查# 查看当前连接数netstat-n|grep:80|wc-l# 查看各状态连接数netstat-n|grep:80|awk/^tcp/ {S[$NF]} END {for(a in S) print a, S[a]}# 查看 Nginx 进程psaux|grepnginx# 查看系统负载tophtop6.3 日志分析# 查看最近 100 条错误日志tail-n100/var/log/nginx/error.log# 查看最近 100 条访问日志tail-n100/var/log/nginx/access.log# 统计状态码分布awk{print $9}/var/log/nginx/access.log|sort|uniq-c|sort-rn# 统计 IP 访问次数awk{print $1}/var/log/nginx/access.log|sort|uniq-c|sort-rn|head-20# 统计慢请求响应时间 1sawk$NF 1 {print}/var/log/nginx/access.log7. 实战案例实战 1完整的前后端分离部署worker_processes auto; worker_cpu_affinity auto; events { worker_connections 2048; use epoll; multi_accept on; } http { include mime.types; default_type application/octet-stream; sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; # Gzip 压缩 gzip on; gzip_comp_level 5; gzip_min_length 1k; gzip_types text/plain text/css application/json application/javascript text/xml application/xml; # 限流配置 limit_req_zone $binary_remote_addr zoneapi_limit:10m rate20r/s; # 后端服务器 upstream backend { server 127.0.0.1:3000; server 127.0.0.1:3001; keepalive 32; } # HTTP 重定向到 HTTPS server { listen 80; server_name example.com www.example.com; return 301 https://$host$request_uri; } # HTTPS 服务器 server { listen 443 ssl http2; server_name example.com www.example.com; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; # 安全头 add_header X-Frame-Options SAMEORIGIN always; add_header X-Content-Type-Options nosniff always; add_header X-XSS-Protection 1; modeblock always; add_header Strict-Transport-Security max-age31536000; includeSubDomains always; # 前端静态文件 root /var/www/my-app/dist; index index.html; location / { try_files $uri $uri/ /index.html; } # 静态资源缓存 location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2)$ { expires 1y; add_header Cache-Control public, immutable; } # 后端 API 代理 location /api { limit_req zoneapi_limit burst50 nodelay; proxy_pass http://backend; proxy_http_version 1.1; proxy_set_header Connection ; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } # 日志 access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log warn; } }项目知识点工作进程优化Gzip 压缩限流配置HTTPS 配置安全头配置静态资源缓存反向代理实战 2微服务网关部署upstream user_service { server 127.0.0.1:3001; server 127.0.0.1:3002; } upstream order_service { server 127.0.0.1:4001; server 127.0.0.1:4002; } upstream product_service { server 127.0.0.1:5001; server 127.0.0.1:5002; } server { listen 80; server_name gateway.example.com; # 用户服务 location /api/users { proxy_pass http://user_service; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } # 订单服务 location /api/orders { proxy_pass http://order_service; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } # 商品服务 location /api/products { proxy_pass http://product_service; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } }实战 3文件上传服务器server { listen 80; server_name upload.example.com; client_max_body_size 100m; location /upload { root /var/www/uploads; client_body_rate 1m; client_body_timeout 120s; } location /download { root /var/www/uploads; limit_rate 500k; } }8. 常见问题 FAQQ1如何查看 Nginx 是否启动成功A使用以下命令# 查看进程psaux|grepnginx# 查看端口netstat-tlnp|grep:80# 查看错误日志tail-f/var/log/nginx/error.logQ2如何平滑重启 NginxA按以下步骤操作# 1. 测试配置语法nginx-t# 2. 平滑重启nginx-sreloadQ3如何配置 HTTPSA使用 Let’s Encrypt 免费证书# 安装 certbotsudoaptinstallcertbot python3-certbot-nginx# 获取证书sudocertbot--nginx-dexample.comQ4如何限制上传文件大小A使用client_max_body_sizeserver { client_max_body_size 10m; # 最大 10MB }Q5如何配置跨域A使用add_headerlocation /api { add_header Access-Control-Allow-Origin https://example.com always; add_header Access-Control-Allow-Methods GET, POST, PUT, DELETE, OPTIONS always; add_header Access-Control-Allow-Headers Authorization, Content-Type, Accept always; if ($request_method OPTIONS) { return 204; } }9. 学习资源与建议学习建议1.先掌握基础再学习实战确保理解基础配置后再进行实战部署2.多查看官方文档官方文档是最权威的资料3.善用测试命令每次修改配置后先用nginx -t测试语法4.查看日志排错遇到问题时查看错误日志是最快的排错方法5.使用版本控制配置文件使用 Git 管理方便回滚和对比官方资源Nginx 官方文档Nginx 部署指南Let’s Encrypt - 免费 SSL 证书Prometheus - 监控系统推荐工具SSL Labs - SSL 配置测试GTmetrix - 网站性能测试curl - HTTP 请求测试Postman - API 测试
