Nginx 入门学习笔记

目录

安装

安装依赖

yum install -y pcre-devel yum -y install gcc make gcc-c++ wgetyum -y install openssl openssl-devel

下载

wget http://nginx.org/download/nginx-1.13.3.tar.gzwget http://nginx.org/download/nginx-1.13.7.tar.gz# 如果没有安装 wget$ yum install wget# 解压压缩包tar zxf nginx-1.13.3.tar.gz

编译安装

cd nginx-1.11.5./configure....Configuration summary  + using system PCRE library  + OpenSSL library is not used  + using system zlib library  nginx path prefix:"/usr/local/nginx"  nginx binary file:"/usr/local/nginx/sbin/nginx"  nginx modules path:"/usr/local/nginx/modules"  nginx configuration prefix:"/usr/local/nginx/conf"  nginx configuration file:"/usr/local/nginx/conf/nginx.conf"  nginx pid file:"/usr/local/nginx/logs/nginx.pid"  nginx error log file:"/usr/local/nginx/logs/error.log"  nginx http access log file:"/usr/local/nginx/logs/access.log"  nginx http client request body temporary files:"client_body_temp"  nginx http proxy temporary files:"proxy_temp"  nginx http fastcgi temporary files:"fastcgi_temp"  nginx http uwsgi temporary files:"uwsgi_temp"  nginx http scgi temporary files:"scgi_temp"

makemake install

Nginx 测试

cd /usr/local/nginx/sbin/./nginx -t# nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok# nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

设置全局 Nginx 命令

vi~/.bash_profile

PATH=$PATH:$HOME/bin:/usr/local/nginx/sbin/export PATH

Mac 安装

安装nginx

brew install nginx# Updating Homebrew...# ==> Auto-updated Homebrew!# Updated 2 taps (homebrew/core, homebrew/cask).# ==> Updated Formulae# ==> Installing dependencies for nginx: openssl, pcre# ==> Installing nginx dependency: openssl# ==> Downloading https://homebrew.bintray.com/bottles/openssl-1.0.2o_1.high_sierra.bottle.tar.gz# ######################################################################## 100.0%# ==> Pouring openssl-1.0.2o_1.high_sierra.bottle.tar.gz# ==> Caveats# A CA file has been bootstrapped using certificates from the SystemRoots# keychain. To add additional certificates (e.g. the certificates added in# the System keychain), place .pem files in#   /usr/local/etc/openssl/certs## and run#   /usr/local/opt/openssl/bin/c_rehash## This formula is keg-only, which means it was not symlinked into /usr/local,# because Apple has deprecated use of OpenSSL in favor of its own TLS and crypto libraries.## If you need to have this software first in your PATH run:#   echo 'export PATH="/usr/local/opt/openssl/bin:$PATH"' >> ~/.zshrc## For compilers to find this software you may need to set:#     LDFLAGS:  -L/usr/local/opt/openssl/lib#     CPPFLAGS: -I/usr/local/opt/openssl/include# For pkg-config to find this software you may need to set:#     PKG_CONFIG_PATH: /usr/local/opt/openssl/lib/pkgconfig## ==> Summary# 🍺  /usr/local/Cellar/openssl/1.0.2o_1: 1,791 files, 12.3MB# ==> Installing nginx dependency: pcre# ==> Downloading https://homebrew.bintray.com/bottles/pcre-8.42.high_sierra.bottle.tar.gz# ######################################################################## 100.0%# ==> Pouring pcre-8.42.high_sierra.bottle.tar.gz# 🍺  /usr/local/Cellar/pcre/8.42: 204 files, 5.3MB# ==> Installing nginx# ==> Downloading https://homebrew.bintray.com/bottles/nginx-1.13.12.high_sierra.bottle.tar.gz# ######################################################################## 100.0%# ==> Pouring nginx-1.13.12.high_sierra.bottle.tar.gz# ==> Caveats# Docroot is: /usr/local/var/www## The default port has been set in /usr/local/etc/nginx/nginx.conf to 8080 so that# nginx can run without sudo.## nginx will load all files in /usr/local/etc/nginx/servers/.## To have launchd start nginx now and restart at login:#   brew services start nginx# Or, if you don't wacd /usr/local/Cellar/nginx/1.13.12/n just run:# cd /usr/local/Cellar/nginx/1.13.12/

启动服务

brew services start nginx# http://localhost:8080/

开机自启动

[Unit]Description=nginxAfter=network.target remote-fs.target nss-lookup.target[Service]Type=forkingPIDFile=/var/run/nginx.pidExecStartPre=/usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.confExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.confExecReload=/bin/kill -s HUP$MAINPIDExecStop=/bin/kill -s QUIT$MAINPIDPrivateTmp=true[Install]WantedBy=multi-user.target

# 启动nginx服务systemctl start nginx.service# 停止开机自启动systemctl disable nginx.service# 查看服务当前状态systemctl status nginx.service# 查看所有已启动的服务systemctl list-units --type=service# 重新启动服务systemctl restart nginx.service# 设置开机自启动systemctlenable nginx.service# 输出下面内容表示成功了Created symlink from /etc/systemd/system/multi-user.target.wants/nginx.service to /usr/lib/systemd/system/nginx.service.

systemctl is-enabled servicename.service# 查询服务是否开机启动systemctlenable*.service# 开机运行服务systemctl disable*.service# 取消开机运行systemctl start*.service# 启动服务systemctl stop*.service# 停止服务systemctl restart*.service# 重启服务systemctl reload*.service# 重新加载服务配置文件systemctl status*.service# 查询服务运行状态systemctl --failed# 显示启动失败的服务

vi /etc/rc.local# 在 rc.local 文件中，添加下面这条命令/usr/local/nginx/sbin/nginx start

# /etc/rc.local是/etc/rc.d/rc.local的软连接，chmod +x /etc/rc.d/rc.local

运维

服务管理

# 启动/usr/local/nginx/sbin/nginx# 重启/usr/local/nginx/sbin/nginx -s reload# 关闭进程/usr/local/nginx/sbin/nginx -s stop# 平滑关闭nginx/usr/local/nginx/sbin/nginx -s quit# 查看nginx的安装状态，/usr/local/nginx/sbin/nginx -V

service iptables stop

vi /etc/sysconfig/iptables

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

service iptables restart# 命令进行查看目前natiptables -t nat -L

重启服务防火墙报错解决

service iptables restart# Redirecting to /bin/systemctl restart  iptables.service# Failed to restart iptables.service: Unit iptables.service failed to load: No such file or directory.

# 传统命令systemctl stop firewalldsystemctl mask firewalld

# 安装命令yum install iptables-servicessystemctlenable iptables service iptables restart

Nginx 卸载

yum remove nginx

参数说明

配置

常用正则

全局变量

$host：localhost  $server_port：3000  $request_uri：/test1/test2/test.php  $document_uri：/test1/test2/test.php  $document_root：/var/www/html  $request_filename：/var/www/html/test1/test2/test.php

符号参考

配置文件

worker_processes  1;events{worker_connections1024;}http{include       mime.types;default_type  application/octet-stream;    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '    #                  '$status $body_bytes_sent "$http_referer" '    #                  '"$http_user_agent" "$http_x_forwarded_for"';    #access_log  logs/access.log  main;sendfile        on;    #tcp_nopush     on;    #keepalive_timeout  0;keepalive_timeout65;    #gzip  on;server{listen80;server_name  localhost;location /{root   html;indexindex.htmlindex.htm;}error_page500502503504  /50x.html;location = /50x.html{root   html;}}include  vhost/example.com.conf;include  vhost/gitlab.com.conf;}

server{    #侦听的80端口listen80;server_name  baidu.com app.baidu.com; # 这里指定域名indexindex.htmlindex.htm;    # 这里指定默认入口页面root /home/www/app.baidu.com;         # 这里指定目录}

内置预定义变量

反向代理

server{listen80;server_name  localhost;client_max_body_size1024M;  # 允许客户端请求的最大单文件字节数location /{proxy_passhttp://localhost:8080;proxy_set_header Host$host:$server_port;proxy_set_header X-Forwarded-For$remote_addr; # HTTP的请求端真实的IPproxy_set_header X-Forwarded-Proto$scheme;      # 为了正确地识别实际用户发出的协议是http 还是 https}}

server{    #侦听的80端口listen80;server_name  git.example.cn;location /{proxy_passhttp://localhost:3000;        #以下是一些反向代理的配置可删除proxy_redirect             off;        #后端的Web服务器可以通过X-Forwarded-For获取用户真实IPproxy_set_header           Host$host;client_max_body_size10m; #允许客户端请求的最大单文件字节数client_body_buffer_size128k; #缓冲区代理缓冲用户端请求的最大字节数proxy_connect_timeout300; #nginx跟后端服务器连接超时时间(代理连接超时)proxy_send_timeout300; #后端服务器数据回传时间(代理发送超时)proxy_read_timeout300; #连接成功后，后端服务器响应时间(代理接收超时)proxy_buffer_size4k; #设置代理服务器（nginx）保存用户头信息的缓冲区大小proxy_buffers              432k; #proxy_buffers缓冲区，网页平均在32k以下的话，这样设置proxy_busy_buffers_size64k; #高负荷下缓冲大小（proxy_buffers*2）}}

负载均衡

upstream gitlab{ip_hash;    # upstream的负载均衡，weight是权重，可以根据机器配置定义权重。weigth参数表示权值，权值越高被分配到的几率越大。server192.168.122.11:8081;server127.0.0.1:82 weight=3;server127.0.0.1:83 weight=3 down;server127.0.0.1:84 weight=3; max_fails=3  fail_timeout=20s;server127.0.0.1:85 weight=4;;keepalive32;}server{    #侦听的80端口listen80;server_name  git.example.cn;location /{proxy_passhttp://gitlab;    #在这里设置一个代理，和upstream的名字一样        #以下是一些反向代理的配置可删除proxy_redirect             off;        #后端的Web服务器可以通过X-Forwarded-For获取用户真实IPproxy_set_header           Host$host;proxy_set_header           X-Real-IP$remote_addr;proxy_set_header           X-Forwarded-For$proxy_add_x_forwarded_for;client_max_body_size10m;  #允许客户端请求的最大单文件字节数client_body_buffer_size128k; #缓冲区代理缓冲用户端请求的最大字节数proxy_connect_timeout300;  #nginx跟后端服务器连接超时时间(代理连接超时)proxy_send_timeout300;  #后端服务器数据回传时间(代理发送超时)proxy_read_timeout300;  #连接成功后，后端服务器响应时间(代理接收超时)proxy_buffer_size4k; #设置代理服务器（nginx）保存用户头信息的缓冲区大小proxy_buffers              432k;# 缓冲区，网页平均在32k以下的话，这样设置proxy_busy_buffers_size64k; #高负荷下缓冲大小（proxy_buffers*2）proxy_temp_file_write_size64k; #设定缓存文件夹大小，大于这个值，将从upstream服务器传}}

RR

upstream test{server localhost:8080;server localhost:8081;}server{listen81;server_name  localhost;client_max_body_size1024M;location /{proxy_passhttp://test;proxy_set_header Host$host:$server_port;}}

upstream test{server localhost:8080;server localhost:8081;}

权重

upstream test{server localhost:8080 weight=9;server localhost:8081 weight=1;}

ip_hash

upstream test{ip_hash;server localhost:8080;server localhost:8081;}

fair

upstream backend{    fair;server localhost:8080;server localhost:8081;}

url_hash

upstream backend{hash$request_uri;    hash_method crc32;server localhost:8080;server localhost:8081;}

屏蔽ip

include blockip.conf;

deny165.91.122.67;deny IP;   # 屏蔽单个ip访问allow IP;  # 允许单个ip访问deny all;  # 屏蔽所有ip访问allow all; # 允许所有ip访问deny123.0.0.0/8   # 屏蔽整个段即从123.0.0.1到123.255.255.254访问的命令deny124.45.0.0/16 # 屏蔽IP段即从123.45.0.1到123.45.255.254访问的命令deny123.45.6.0/24 # 屏蔽IP段即从123.45.6.1到123.45.6.254访问的命令# 如果你想实现这样的应用，除了几个IP外，其他全部拒绝allow1.1.1.1;allow1.1.1.2;deny all;

第三方模块安装方法

./configure --prefix=/你的安装目录  --add-module=/第三方模块目录

重定向

重定向整个网站

server{server_name old-site.comreturn301$scheme://new-site.com$request_uri;}

重定向单页

server{location = /oldpage.html{return301http://example.org/newpage.html;}}

重定向整个子路径

location /old-site{rewrite ^/old-site/(.*)http://example.org/new-site/$1 permanent;}

性能

内容缓存

location /static{root /data;expires max;}

location = /empty.gif{empty_gif;expires -1;}

Gzip压缩

gzip  on;gzip_buffers168k;gzip_comp_level 6;gzip_http_version 1.1;gzip_min_length256;gzip_proxied any;gzip_vary on;gzip_types    text/xml application/xml application/atom+xml application/rss+xml application/xhtml+xml image/svg+xml    text/javascript application/javascript application/x-javascript    text/x-json application/json application/x-web-app-manifest+json    text/css text/plain text/x-component    font/opentype application/x-font-ttf application/vnd.ms-fontobject    image/x-icon;gzip_disable"msie6";

打开文件缓存

open_file_cache max=1000 inactive=20s;open_file_cache_valid30s;open_file_cache_min_uses 2;open_file_cache_errors on;

SSL缓存

ssl_session_cache shared:SSL:10m;ssl_session_timeout10m;

上游Keepalive

upstream backend{server127.0.0.1:8080;keepalive32;}server{    ...location /api/{proxy_passhttp://backend;proxy_http_version 1.1;proxy_set_header Connection"";}}

监控

# 安装 ngxtoppip install ngxtop# 实时状态ngxtop# 状态为404的前10个请求的路径：ngxtop top request_path --filter'status == 404'# 发送总字节数最多的前10个请求ngxtop --order-by'avg(bytes_sent) * count'# 排名前十位的IP，例如，谁攻击你最多ngxtop --group-by remote_addr# 打印具有4xx或5xx状态的请求，以及status和http refererngxtop -i'status >= 400' print request status http_referer# 由200个请求路径响应发送的平均正文字节以'foo'开始：ngxtop avg bytes_sent --filter'status == 200 and request_path.startswith("foo")'# 使用“common”日志格式从远程机器分析apache访问日志ssh remote tail -f /var/log/apache2/access.log| ngxtop -f common

常见使用场景

跨域问题

server{listen80;server_name api.xxx.com;add_header'Access-Control-Allow-Origin' '*';add_header'Access-Control-Allow-Credentials' 'true';add_header'Access-Control-Allow-Methods' 'GET,POST,HEAD';location /{proxy_passhttp://127.0.0.1:3000;proxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;proxy_set_header Host$http_host;}}

upstream test{server127.0.0.1:8080;server localhost:8081;}server{listen80;server_name api.xxx.com;location /{root  html;                   #去请求../html文件夹里的文件indexindex.htmlindex.htm;  #首页响应地址}  # 用于拦截请求，匹配任何以 /api/开头的地址，  # 匹配符合以后，停止往下搜索正则。location ^~/api/{    # 代表重写拦截进来的请求，并且只能对域名后边的除去传递的参数外的字符串起作用，    # 例如www.a.com/proxy/api/msg?meth=1&par=2重写，只对/proxy/api/msg重写。    # rewrite后面的参数是一个简单的正则 ^/api/(.*)$，    # $1代表正则中的第一个()，$2代表第二个()的值，以此类推。rewrite ^/api/(.*)$ /$1break;    # 把请求代理到其他主机    # 其中 http://www.b.com/ 写法和 http://www.b.com写法的区别如下    # 如果你的请求地址是他 http://server/html/test.jsp    # 配置一： http://www.b.com/ 后面有“/”    #         将反向代理成 http://www.b.com/html/test.jsp 访问    # 配置一： http://www.b.com 后面没有有“/”    #         将反向代理成 http://www.b.com/test.jsp 访问proxy_passhttp://test;    # 如果 proxy_pass  URL 是 http://a.xx.com/platform/ 这种情况    # proxy_cookie_path应该设置成 /platform/ / (注意两个斜杠之间有空格)。proxy_cookie_path /platfrom/ /;    # http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass_header    # 设置 Cookie 头通过proxy_pass_header Set-Cookie;}}

跳转到带 www 的域上面

server{listen80;    # 配置正常的带www的域名server_name www.wangchujiang.com;root /home/www/wabg/download;location /{try_files$uri$uri/ /index.html =404;}}server{    # 这个要放到下面，    # 将不带www的 wangchujiang.com 永久性重定向到  https://www.wangchujiang.comserver_name wangchujiang.com;rewrite ^(.*) https://www.wangchujiang.com$1 permanent;}

代理转发

upstreamserver-api{    # api 代理服务地址server127.0.0.1:3110;}upstreamserver-resource{    # 静态资源 代理服务地址server127.0.0.1:3120;}server{listen3111;server_name  localhost;      # 这里指定域名root /home/www/server-statics;    # 匹配 api 路由的反向代理到API服务location ^~/api/{rewrite ^/(.*)$ /$1break;proxy_passhttp://server-api;}    # 假设这里验证码也在API服务中location ^~/captcha{rewrite ^/(.*)$ /$1break;proxy_passhttp://server-api;}    # 假设你的图片资源全部在另外一个服务上面location ^~/img/{rewrite ^/(.*)$ /$1break;proxy_passhttp://server-resource;}    # 路由在前端，后端没有真实路由，在路由不存在的 404状态的页面返回 /index.html    # 这个方式使用场景，你在写React或者Vue项目的时候，没有真实路由location /{try_files$uri$uri/ /index.html =404;        #                               ^ 空格很重要    }}

监控状态信息

location /nginx_status{stub_status on;access_log off;}

Active connections: 3server accepts handled requests 7 7 5 Reading: 0 Writing: 1 Waiting: 2

代理转发连接替换

location ^~/api/upload{rewrite ^/(.*)$ /wfs/v1/uploadbreak;proxy_passhttp://wfs-api;}

SSL 配置

sudo mkdir /etc/nginx/ssl# 创建了有效期100年，加密强度为RSA2048的SSL密钥key和X509证书文件。sudo openssl req -x509 -nodes -days 36500 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt# 上面命令，会有下面需要填写内容Country Name (2 letter code) [AU]:USState or Province Name (full name) [Some-State]:New YorkLocality Name (eg, city) []:New York CityOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Bouncy Castles, Inc.Organizational Unit Name (eg, section) []:Ministry of Water SlidesCommon Name (e.g. server FQDN or YOUR name) []:your_domain.comEmail Address []:admin@your_domain.com

首先，创建证书和私钥的目录# mkdir -p /etc/nginx/cert# cd /etc/nginx/cert创建服务器私钥，命令会让你输入一个口令：# openssl genrsa -des3 -out nginx.key 2048创建签名请求的证书（CSR）：# openssl req -new -key nginx.key -out nginx.csr在加载SSL支持的Nginx并使用上述私钥时除去必须的口令：# cp nginx.key nginx.key.org# openssl rsa -in nginx.key.org -out nginx.key最后标记证书使用上述私钥和CSR：# openssl x509 -req -days 365 -in nginx.csr -signkey nginx.key -out nginx.crt

sbin/nginx -V

nginx version: nginx/1.7.8built by gcc 4.4.7 20120313 (Red Hat 4.4.7-4) (GCC)TLS SNI support enabledconfigure arguments: --prefix=/usr/local/nginx-1.7.8 --with-http_ssl_module --with-http_spdy_module --with-http_stub_status_module --with-pcre

./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module

# 备份nginx的二进制文件cp -rf /usr/local/nginx/sbin/nginx　 /usr/local/nginx/sbin/nginx.bak# 覆盖nginx的二进制文件cp -rf objs/nginx   /usr/local/nginx/sbin/

server{listen443ssl;server_name  localhost;ssl_certificate /etc/nginx/ssl/nginx.crt;ssl_certificate_key /etc/nginx/ssl/nginx.key;    # 禁止在header中出现服务器版本，防止黑客利用版本漏洞攻击server_tokens off;    # 设置ssl/tls会话缓存的类型和大小。如果设置了这个参数一般是shared，buildin可能会参数内存碎片，默认是none，和off差不多，停用缓存。如shared:SSL:10m表示我所有的nginx工作进程共享ssl会话缓存，官网介绍说1M可以存放约4000个sessions。ssl_session_cache    shared:SSL:1m;    # 客户端可以重用会话缓存中ssl参数的过期时间，内网系统默认5分钟太短了，可以设成30m即30分钟甚至4h。ssl_session_timeout5m;    # 选择加密套件，不同的浏览器所支持的套件（和顺序）可能会不同。    # 这里指定的是OpenSSL库能够识别的写法，你可以通过 openssl -v cipher 'RC4:HIGH:!aNULL:!MD5'（后面是你所指定的套件加密算法） 来看所支持算法。ssl_ciphers  HIGH:!aNULL:!MD5;    # 设置协商加密算法时，优先使用我们服务端的加密套件，而不是客户端浏览器的加密套件。ssl_prefer_server_ciphers  on;location /{root   html;indexindex.htmlindex.htm;}}

强制将http重定向到https

server{listen80;server_name  example.com;rewrite ^ https://$http_host$request_uri? permanent;    # 强制将http重定向到https    # 在错误页面和“服务器”响应头字段中启用或禁用发射nginx版本。 防止黑客利用版本漏洞攻击server_tokens off;}

两个虚拟主机

http{server{listen80;server_name     www.domain1.com;access_log      logs/domain1.access.log main;location /{indexindex.html;root  /var/www/domain1.com/htdocs;}}server{listen80;server_name     www.domain2.com;access_log      logs/domain2.access.log main;location /{indexindex.html;root  /var/www/domain2.com/htdocs;}}}

虚拟主机标准配置

http{server{listen80 default;server_name     _ *;access_log      logs/default.access.log main;location /{indexindex.html;root  /var/www/default/htdocs;}}}

爬虫过滤

location /{if($http_user_agent~*"python|curl|java|wget|httpclient|okhttp"){return503;}    # 正常处理    # ...}

防盗链

location~*\.(gif|jpg|png|swf|flv)${root htmlvalid_referers none blocked *.nginxcn.com;if($invalid_referer){rewrite ^/ www.nginx.cn     #return 404;}}

虚拟目录配置

location /img/{alias /var/www/image/;}# 访问/img/目录里面的文件时，ningx会自动去/var/www/image/目录找文件location /img/{root /var/www/image;}# 访问/img/目录下的文件时，nginx会去/var/www/image/img/目录下找文件。]

防盗图配置

location~\/public\/(css|js|img)\/.*\.(js|css|gif|jpg|jpeg|png|bmp|swf){valid_referers none blocked *.jslite.io;if($invalid_referer){rewrite ^/http://wangchujiang.com/piratesp.png;}}

屏蔽.git等文件

location~(.git|.gitattributes|.gitignore|.svn){deny all;}

域名路径加不加需要都能正常访问

http://wangchujiang.com/api/index.php?a=1&name=wcj                                  ^ 有后缀http://wangchujiang.com/api/index?a=1&name=wcj                                 ^ 没有后缀

rewrite ^/(.*)/$ /index.php?/$1 permanent;if(!-d$request_filename){set$rule_1 1$rule_1;}if(!-f$request_filename){set$rule_1 2$rule_1;}if($rule_1 ="21"){rewrite ^/ /index.php last;}

cockpit

server{   listen80;   server_name cockpit.xxxxxxx.com;   return301 https://$server_name$request_uri;}server{   listen443ssl;   server_name cockpit.xxxxxxx.com;     #ssl on;   ssl_certificate /etc/nginx/cert/cockpit.xxxxxxx.com.pem;   ssl_certificate_key /etc/nginx/cert/cockpit.xxxxxxx.com.key;    location /{       root /;       indexindex.html;       proxy_redirect off;       proxy_passhttp://websocket;       proxy_http_version 1.1;       proxy_set_header Upgrade$http_upgrade;       proxy_set_header Connection"upgrade";       proxy_set_header Host$http_host;   }}

sudo vim /etc/cockpit/cockpit.conf

[WebService]Origins = https://cockpit.xxxxxxx.com https://127.0.0.1:9090ProtocolHeader = X-Forwarded-ProtoAllowUnencrypted =true

错误问题

The plain HTTP request was sent to HTTPS port

server{listen443ssl; # 注意这条规则server_name  my.domain.com;fastcgi_param HTTPS$https if_not_empty;fastcgi_param HTTPS on;ssl_certificate /etc/ssl/certs/your.pem;ssl_certificate_key /etc/ssl/private/your.key;location /{        # Your config here...}}

Nginx 模块

精品文章参考

Contributors

License