nginx reverse proxy

Nginx configuration details

nginx overview

nginx is a free, open source, high-performance HTTP server and reverse proxy server; it is also an IMAP, POP3, SMTP proxy server; nginx can be used as an HTTP server for website publishing, and nginx can be used as a reverse The proxy implements load balancing.

Here is a brief introduction to nginx mainly through three aspects

• reverse proxy
• load balancing
• nginx features

1. Reverse proxy

About the agent

When it comes to agency, first of all we have to clarify a concept. The so-called agency is a representative and a channel;

At this time, two roles are designed, one is the agent role, and the other is the target role. The process of the agent role accessing the target role through this agent to complete some tasks is called the agent operation process; just like a specialty store in life ~ guests go to adidas The store bought a pair of shoes, the store is the agent, the role of the agent is the adidas manufacturer, and the target role is the user

forward proxy

Before talking about the reverse proxy, let's look at the forward proxy first. The forward proxy is also the proxy mode that everyone comes into contact with the most. We will talk about the processing mode of the forward proxy from two aspects, from the software aspect and the life. To explain what is a forward proxy

The biggest feature of forward proxy is that the client is very clear about the server address to be accessed; the server only knows which proxy server the request comes from, but not which specific client it comes from; the forward proxy mode shields or hides the real client information.

For example, picture review, but everyone understands it by yourself

reverse proxy

Understand what a forward proxy is, let’s continue to look at the processing method of reverse proxy, for example, a certain treasure website, the number of visitors who connect to the website at the same time every day has exploded, and a single server is far from satisfying people’s growing desire to buy, At this time, a familiar term appeared: distributed deployment; that is, by deploying multiple servers to solve the problem of limited number of visitors; most of the functions in a certain treasure website are also directly implemented by nginx for reverse proxy, and through After encapsulating nginx and other components, it has a tall name: Tengine. Interested children's shoes can visit Tengine's official website to view the specific information: The Tengine Web Server
So how does the reverse proxy achieve distributed distribution? Let's look at a schematic diagram first:

From the above diagram, you can see clearly that the requests sent by multiple clients to the server are received by the nginx server and distributed to the back-end business processing server for processing according to certain rules. At this point ~ the source of the request, that is, the client, is clear, but it is not clear which server handles the request. nginx plays the role of a reverse proxy.

Reverse proxy, mainly used in the case of distributed deployment of server clusters, reverse proxy hides server information!

Project scene

Usually, when we operate the actual project, the forward proxy and the reverse proxy are likely to exist in an application scenario. The forward proxy proxy client's request to access the target server, and the target server is a reverse simple profit server. , reverse proxying multiple real business processing servers. The specific topology diagram is as follows:

2. Load Balancing

We have clarified the concept of the so-called proxy server. Next, nginx plays the role of a reverse proxy server. What rules does it distribute requests according to? Can the distribution rules be controlled for different project application scenarios?

The number of requests sent by the client and received by the nginx reverse proxy server mentioned here is what we call the load

The rule that the number of requests are distributed to different servers for processing according to certain rules is a kind of balancing rule

Therefore, the process of distributing the requests received by the server according to the rules is called load balancing.

Load balancing In the actual project operation process, there are hardware load balancing and software load balancing. Hardware load balancing is also called hard load, such as F5 load balancing, which is relatively expensive and expensive, but data stability and security, etc. There is a very good guarantee, companies such as China Mobile and China Unicom will choose hard load for operation; more companies will choose to use software load balancing considering cost reasons. Software load balancing is the use of existing technology combined with host hardware. Implemented a message queue distribution mechanism

The load balancing scheduling algorithm supported by nginx is as follows:

1. Weight polling (default): Received requests are allocated to different back-end servers one by one in order. Even if a back-end server goes down during use, nginx will automatically remove the server from the queue, and the request acceptance status will not be affected in any way. In this way, a weight value (weight) can be set for different back-end servers to adjust the allocation rate of requests on different servers; the larger the weight data, the greater the probability of being allocated to the request; the weight value, It is mainly adjusted for different back-end server hardware configurations in the actual working environment.

2. ip_hash: Each request is matched according to the hash result of the ip of the initiating client. Under this algorithm, the client with a fixed ip address will always access the same backend server, which also solves the problem of session in the cluster deployment environment to a certain extent. shared problem.

3. fair: intelligently adjusts the scheduling algorithm, and dynamically allocates it dynamically according to the time between the request processing and the response of the back-end server. The server with short response time and high processing efficiency has a high probability of being allocated to the request, and the server with long response time and low processing efficiency is allocated. Fewer requests; a scheduling algorithm that combines the advantages of the first two. However, it should be noted that nginx does not support the fair algorithm by default. If you want to use this scheduling algorithm, please install the upstream_fair module

4. url_hash: Allocate requests according to the hash result of the accessed url. The url of each request will point to a fixed server in the backend, which can improve the cache efficiency when nginx is used as a static server. Also note that nginx does not support this scheduling algorithm by default. If you want to use it, you need to install the nginx hash package

Nginx installation

1. Windows installation

Official website download address:

https://nginx.org/en/download.html

As shown in the figure below, download the corresponding version of the nginx compressed package and unzip it to the folder where the software is stored on your computer.

After decompression is complete, the file directory structure is as follows:

start nginx

1) Double-click nginx.exe in this directory to start the nginx server

2) The command line is included in this folder, and executing the nginx command will also directly start the nginx server

D:/resp_application/nginx-1.13.5> nginx

access nginx

Open the browser, enter the address: http://localhost, visit the page, the following page appears, indicating that the visit is successful

stop nginx

Enter the nginx root directory from the command line and execute the following command to stop the server:

# 强制停止nginx服务器，如果有未处理的数据，丢弃
D:/resp_application/nginx-1.13.5> nginx -s stop

# 优雅的停止nginx服务器，如果有未处理的数据，等待处理完成之后停止
D:/resp_application/nginx-1.13.5> nginx -s quit

2. ubuntu installation

According to the normal software installation method, install it directly through the following command:

$ sudo apt-get install nginx

The installation is complete. In the /usr/sbin/ directory is the directory where the nginx command is located, and in the /etc/nginx/ directory are all the configuration files of nginx, which are used to configure the nginx server and load balancing information.

Check whether the nginx process is started

$ ps -ef|grep nginx

Nginx will automatically create the corresponding number of processes according to the number of cores of the CPU of the current host (the current ubuntu host is configured with 2 cores and 4 threads)

Remarks: The service processes started here are actually 4 processes, because when the nginx process is started, a daemon process will be attached to protect the official process from being terminated abnormally; if the daemon process returns once the nginx inheritance is terminated, it will Automatically restart the process.

The daemon process is generally called the master process, and the business process is called the worker process

start nginx server command

Directly executing nginx will start the server according to the default configuration file

$ nginx

stop nginx service command

Like the Windows system execution process, there are two ways to stop

$ nginx -s stop
or
$ nginx -s quit

restart loading

The commands restart and reload can also be used to restart nginx or to reload associated files.

3. mac os installation

It is possible to install nginx directly through brew, or download the tar.gz compressed package.

Install directly through brew

brew install nginx

After the installation is complete, the subsequent command operations, starting the server, viewing the process, stopping the server, restarting the server, and loading files are all consistent.

nginx configuration

Nginx is a very powerful web server plus a reverse proxy server, as well as a mail server, etc.

In project use, the three most used core functions are reverse proxy, load balancing and static server

The use of these three different functions is closely related to the configuration of nginx. The configuration information of the nginx server is mainly concentrated in the configuration file nginx.conf, and all the configurable options are roughly divided into the following parts

main                                # 全局配置

events {                            # nginx工作模式配置

}

http {                                # http设置
    ....

    server {                        # 服务器主机配置
        ....
        location {                    # 路由配置
            ....
        }

        location path {
            ....
        }

        location otherpath {
            ....
        }
    }

    server {
        ....

        location {
            ....
        }
    }

    upstream name {                    # 负载均衡配置
        ....
    }
}

As shown in the above configuration file, it mainly consists of 6 parts:

1. main: used to configure nginx global information
2. events: configuration for nginx working mode
3. http: some configuration for http protocol information
4. server: configuration for server access information
5. location: configuration for access routing
6. upstream: configuration for load balancing

main module

Observe the configuration code below

# user nobody nobody;
worker_processes 2;
# error_log logs/error.log
# error_log logs/error.log notice
# error_log logs/error.log info
# pid logs/nginx.pid
worker_rlimit_nofile 1024;

The above configurations are all configuration items stored in the main global configuration module.

• user is used to specify the running user and user group of the nginx worker process. By default, the nobody account runs.
• worker_processes specifies the number of sub-processes to be opened by nginx. During the running process, monitor the memory consumption of each process (usually ranging from a few M to dozens of M) and adjust it according to the actual situation, usually the number is an integer multiple of the number of CPU cores
• error_log defines the location and output level of the error log file [debug / info / notice / warn / error / crit]
• pid is used to specify the location of the process id storage file
• worker_rlimit_nofile is used to specify the description of the maximum number of files a process can open

event module

dry goods

event {
    worker_connections 1024;
    multi_accept on;
    use epoll;
}

The above configuration is some operation configuration for the working mode of the nginx server

• worker_connections specifies the maximum number of connections that can be received at the same time. It must be noted here that the maximum number of connections is determined jointly with worker processes.
• The multi_accept configuration specifies that nginx accepts as many connections as possible after receiving a new connection notification
• The use epoll configuration specifies the method of thread polling. If it is linux2.6+, use epoll. If it is BSD such as Mac, please use Kqueue

http module

As a web server, the http module is the core module of nginx, and there are many configuration items. Many actual business scenarios will be set in the project, which needs to be properly configured according to the hardware information. Under normal circumstances, the default configuration can be used. !

http {
    ##
    # 基础配置
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL证书配置
    ##

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    ##
    # 日志配置
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip 压缩配置
    ##

    gzip on;
    gzip_disable "msie6";

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript
 text/xml application/xml application/xml+rss text/javascript;

    ##
    # 虚拟主机配置
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;

1) Basic configuration

sendfile on：配置on让sendfile发挥作用，将文件的回写过程交给数据缓冲去去完成，而不是放在应用中完成，这样的话在性能提升有有好处
tc_nopush on：让nginx在一个数据包中发送所有的头文件，而不是一个一个单独发
tcp_nodelay on：让nginx不要缓存数据，而是一段一段发送，如果数据的传输有实时性的要求的话可以配置它，发送完一小段数据就立刻能得到返回值，但是不要滥用哦

keepalive_timeout 10：给客户端分配连接超时时间，服务器会在这个时间过后关闭连接。一般设置时间较短，可以让nginx工作持续性更好
client_header_timeout 10：设置请求头的超时时间
client_body_timeout 10:设置请求体的超时时间
send_timeout 10：指定客户端响应超时时间，如果客户端两次操作间隔超过这个时间，服务器就会关闭这个链接

limit_conn_zone $binary_remote_addr zone=addr:5m ：设置用于保存各种key的共享内存的参数，
limit_conn addr 100: 给定的key设置最大连接数

server_tokens：虽然不会让nginx执行速度更快，但是可以在错误页面关闭nginx版本提示，对于网站安全性的提升有好处哦
include /etc/nginx/mime.types：指定在当前文件中包含另一个文件的指令
default_type application/octet-stream：指定默认处理的文件类型可以是二进制
type_hash_max_size 2048：混淆数据，影响三列冲突率，值越大消耗内存越多，散列key冲突率会降低，检索速度更快；值越小key，占用内存较少，冲突率越高，检索速度变慢

2) Log configuration

access_log logs/access.log：设置存储访问记录的日志
error_log logs/error.log：设置存储记录错误发生的日志

3) SSL certificate encryption

ssl_protocols：指令用于启动特定的加密协议，nginx在1.1.13和1.0.12版本后默认是ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2，TLSv1.1与TLSv1.2要确保OpenSSL >= 1.0.1 ，SSLv3 现在还有很多地方在用但有不少被攻击的漏洞。
ssl prefer server ciphers：设置协商加密算法时，优先使用我们服务端的加密套件，而不是客户端浏览器的加密套件

4) Compression configuration

gzip 是告诉nginx采用gzip压缩的形式发送数据。这将会减少我们发送的数据量。
gzip_disable 为指定的客户端禁用gzip功能。我们设置成IE6或者更低版本以使我们的方案能够广泛兼容。
gzip_static 告诉nginx在压缩资源之前，先查找是否有预先gzip处理过的资源。这要求你预先压缩你的文件（在这个例子中被注释掉了），从而允许你使用最高压缩比，这样nginx就不用再压缩这些文件了（想要更详尽的gzip_static的信息，请点击这里）。
gzip_proxied 允许或者禁止压缩基于请求和响应的响应流。我们设置为any，意味着将会压缩所有的请求。
gzip_min_length 设置对数据启用压缩的最少字节数。如果一个请求小于1000字节，我们最好不要压缩它，因为压缩这些小的数据会降低处理此请求的所有进程的速度。
gzip_comp_level 设置数据的压缩等级。这个等级可以是1-9之间的任意数值，9是最慢但是压缩比最大的。我们设置为4，这是一个比较折中的设置。
gzip_type 设置需要压缩的数据格式。上面例子中已经有一些了，你也可以再添加更多的格式。

5) File cache configuration

open_file_cache 打开缓存的同时也指定了缓存最大数目，以及缓存的时间。我们可以设置一个相对高的最大时间，这样我们可以在它们不活动超过20秒后清除掉。
open_file_cache_valid 在open_file_cache中指定检测正确信息的间隔时间。
open_file_cache_min_uses 定义了open_file_cache中指令参数不活动时间期间里最小的文件数。
open_file_cache_errors 指定了当搜索一个文件时是否缓存错误信息，也包括再次给配置中添加文件。我们也包括了服务器模块，这些是在不同文件中定义的。如果你的服务器模块不在这些位置，你就得修改这一行来指定正确的位置。

server module

The srever module configuration is a sub-module in the http module, which is used to define a virtual access host, that is, the configuration information of a virtual server

server {
    listen        80;
    server_name localhost    192.168.1.100;
    root        /nginx/www;
    index        index.php index.html index.html;
    charset        utf-8;
    access_log    logs/access.log;
    error_log    logs/error.log;
    ......
}

The core configuration information is as follows:

• server: configuration of a virtual host, multiple servers can be configured in one http

• server_name: Use force to specify the ip address or domain name, and separate multiple configurations with spaces

• root: Indicates the root directory in the entire server virtual host, the root directory of all web projects in the current host

• index: the global home page when a user visits a web site

• charset: used to set the default encoding format of web pages configured in the www/ path

• access_log: used to specify the storage path of the access log in the virtual host server

• error_log: used to specify the storage path of the access error log in the virtual host server

location module

The location module is the most common configuration in the nginx configuration, mainly used to configure routing access information

In the configuration of routing access information, it is associated with functions such as reverse proxy, load balancing, etc., so the location module is also a very important configuration module.

basic configuration

location / {
    root    /nginx/www;
    index    index.php index.html index.htm;
}

location /: indicates matching access to the root directory

root: used to specify the web directory of the virtual host when accessing the root directory

index: The list of resource files displayed by default when accessing specific resources is not specified

Reverse proxy configuration

Through the reverse proxy proxy server access mode, the client access is transparent through proxy_set configuration

location / {
    proxy_pass http://localhost:8888;
    proxy_set_header X-real-ip $remote_addr;
    proxy_set_header Host $http_host;
}

uwsgi-config

Server configuration access mode in wsgi mode

location / {
    include uwsgi_params;
    uwsgi_pass localhost:8888
}

upstream module

The upstream module is mainly responsible for the configuration of load balancing, and distributes requests to the backend server through the default round-robin scheduling method

The simple configuration is as follows

upstream name {
    ip_hash;
    server 192.168.1.100:8000;
    server 192.168.1.100:8001 down;
    server 192.168.1.100:8002 max_fails=3;
    server 192.168.1.100:8003 fail_timeout=20s;
    server 192.168.1.100:8004 max_fails=3 fail_timeout=20s;
}

The core configuration information is as follows

• ip_hash: Specifies the request scheduling algorithm. The default is weighted round-robin scheduling, which can be specified

• server host:port: List configuration of the distribution server

• -- down: Indicates that the host is suspended from service

• -- max_fails: Indicates the maximum number of failures, and if the maximum number of failures exceeds the maximum number of failures, the service will be suspended

• -- fail_timeout: Indicates that if the request fails to be accepted, the request will be restarted after the specified time is suspended