Nginx常用配置

一份常见的Nginx配置

涉及防盗链、限流、https访问、非www跳转

示例

worker_processes  1;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    #限速限流配置
    limit_req_zone $binary_remote_addr zone=one:10m rate=100r/s;

    upstream cms {
        server  cms:8090;
    }

    server {
       #禁止ip访问
       listen 80 default_server;
       #listen 443 ssl;
       server_name _;
       return 501;
    }

    server {
        listen 80;
        server_name www.gthree-sky.com  gthree-sky.com;
        return 301 https://$host$request_uri; #	只允许https访问
    }

    server {
       # listen       80;
        listen 443 ssl;
        server_name www.gthree-sky.com gthree-sky.com;
        ssl_certificate /usr/local/nginx/www.gthree-sky.com_bundle.crt;
        ssl_certificate_key /usr/local/nginx/www.gthree-sky.com.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;

        client_max_body_size  1024M;# 最大请求体
        client_body_buffer_size  1024M;

	    if ($host != 'www.gthree-sky.com') {
            rewrite ^/(.*)$ https://www.gthree-sky.com/$1 permanent; #	只允许www访问
        }

	    location ~ .*.(gif|jpg|jpeg|png|bmp|swf)$ {#静态资源防盗链
            valid_referers www.gthree-sky.com;
            if ($invalid_referer) {
              return 403;
        }
            
	    proxy_pass http://cms;
        }

        location / {
	      limit_req zone=one burst=5 nodelay;#访问限速限流
	      proxy_pass http://cms;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }
}