# Ubuntu/Debian - 官方仓库
curl -fsSL https://nginx.org/keys/nginx_signing.key | sudo apt-key add -
echo "deb https://nginx.org/packages/ubuntu $(lsb_release -cs) nginx" | sudo tee /etc/apt/sources.list.d/nginx.list
sudo apt update
sudo apt install nginx

# CentOS/RHEL - 官方仓库
sudo yum install epel-release
sudo yum install nginx

# 或使用官方仓库
cat > /etc/yum.repos.d/nginx.repo << 'EOF'
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
EOF
sudo yum install nginx

# macOS - Homebrew
brew install nginx

# 源码编译
wget http://nginx.org/download/nginx-1.24.0.tar.gz
tar -xzf nginx-1.24.0.tar.gz
cd nginx-1.24.0
./configure --prefix=/etc/nginx \
            --sbin-path=/usr/sbin/nginx \
            --conf-path=/etc/nginx/nginx.conf \
            --error-log-path=/var/log/nginx/error.log \
            --http-log-path=/var/log/nginx/access.log \
            --pid-path=/var/run/nginx.pid \
            --lock-path=/var/run/nginx.lock \
            --with-http_ssl_module \
            --with-http_v2_module \
            --with-http_realip_module \
            --with-http_gzip_static_module
make && sudo make install

# 设置正确的目录权限
sudo chown -R nginx:nginx /var/www/html
sudo chmod -R 755 /var/www/html
sudo chown -R nginx:nginx /var/log/nginx
sudo chmod -R 640 /var/log/nginx
sudo chown root:root /etc/nginx/nginx.conf
sudo chmod 644 /etc/nginx/nginx.conf

# 全局配置
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

# 事件配置
events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

# HTTP 配置
http {
    # 基础设置
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    # 日志格式
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    
    access_log /var/log/nginx/access.log main;
    
    # 性能优化
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    
    # Gzip 压缩
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    
    # 包含其他配置文件
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

# 系统服务管理（systemd）
sudo systemctl start nginx      # 启动服务
sudo systemctl stop nginx       # 停止服务
sudo systemctl restart nginx    # 重启服务
sudo systemctl reload nginx     # 重新加载配置
sudo systemctl enable nginx     # 开机自启
sudo systemctl disable nginx    # 禁用自启
sudo systemctl status nginx     # 查看状态

# 直接命令管理
sudo nginx                      # 启动 Nginx
sudo nginx -s reload            # 重新加载配置
sudo nginx -s reopen            # 重新打开日志文件
sudo nginx -s stop              # 快速停止
sudo nginx -s quit              # 优雅停止

# 配置测试
sudo nginx -t                   # 测试配置文件语法
sudo nginx -T                   # 测试并显示配置内容
sudo nginx -V                   # 显示版本和编译信息

http {
    # 客户端配置
    client_max_body_size 100m;          # 最大请求体大小
    client_body_timeout 60s;            # 请求体超时
    client_header_timeout 60s;          # 请求头超时
    client_body_buffer_size 128k;       # 请求体缓冲区大小
    
    # 连接配置
    keepalive_timeout 65;               # 保持连接超时
    keepalive_requests 100;             # 保持连接最大请求数
    send_timeout 60s;                   # 发送超时
    
    # 文件处理
    sendfile on;                        # 启用零拷贝
    tcp_nopush on;                      # 优化数据包发送
    tcp_nodelay on;                     # 禁用 Nagle 算法
    
    # 哈希表配置
    server_names_hash_bucket_size 64;   # 服务器名称哈希桶大小
    types_hash_max_size 2048;           # MIME 类型哈希表大小
    
    # 隐藏版本信息
    server_tokens off;                  # 隐藏 Nginx 版本
    
    # 字符集
    charset utf-8;                      # 默认字符集
}

events {
    # 事件模型（自动选择最优）
    use epoll;
    
    # 工作进程最大连接数
    worker_connections 4096;
    
    # 接受多个连接
    multi_accept on;
    
    # 接受连接的负载均衡
    accept_mutex on;
    accept_mutex_delay 500ms;
}

mail {
    server_name mail.example.com;
    auth_http localhost:9000/cgi-bin/nginxauth.cgi;
    
    proxy_pass_error_message on;
    
    # IMAP 配置
    server {
        listen 143;
        protocol imap;
        proxy on;
    }
    
    # POP3 配置
    server {
        listen 110;
        protocol pop3;
        proxy on;
    }
    
    # SMTP 配置
    server {
        listen 25;
        protocol smtp;
        proxy on;
        smtp_auth login plain;
    }
}

stream {
    # 上游服务器组
    upstream backend {
        server 192.168.1.10:3306 weight=3;
        server 192.168.1.11:3306 weight=2;
        server 192.168.1.12:3306 backup;
    }
    
    # TCP 负载均衡
    server {
        listen 3306;
        proxy_pass backend;
        proxy_timeout 1s;
        proxy_responses 1;
    }
    
    # UDP 负载均衡
    upstream dns_servers {
        server 8.8.8.8:53;
        server 8.8.4.4:53;
    }
    
    server {
        listen 53 udp;
        proxy_pass dns_servers;
        proxy_timeout 1s;
        proxy_responses 1;
    }
}

# 基本语法：指令名 参数1 参数2 ... 参数N;
directive_name parameter1 parameter2 ... parameterN;

# 块指令语法
block_directive parameter {
    directive1 value1;
    directive2 value2;
}

# 示例
server {
    listen 80;                          # 简单指令
    server_name example.com www.example.com;  # 多参数指令
    
    location / {                        # 块指令
        root /var/www/html;
        index index.html;
    }
}

server {
    # 设置自定义变量
    set $custom_var "hello";
    set $api_version "v1";
    
    location / {
        # 使用变量
        add_header X-Custom-Var $custom_var;
        add_header X-API-Version $api_version;
        
        # 变量运算
        set $full_path "${uri}?${args}";
        add_header X-Full-Path $full_path;
    }
}

server {
    # location 正则匹配
    location ~ ^/api/v[0-9]+/ {
        proxy_pass http://api_backend;
    }
    
    location ~ \.(jpg|jpeg|png|gif)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
    }
    
    # rewrite 正则重写
    rewrite ^/old-path/(.*)$ /new-path/$1 permanent;
    rewrite ^/product/([0-9]+)$ /product.php?id=$1 last;
    
    # 条件判断
    if ($http_user_agent ~* "bot|crawler|spider") {
        return 403;
    }
}

# 主站点配置
server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com;
    index index.html index.php;
    
    access_log /var/log/nginx/example.com.access.log;
    error_log /var/log/nginx/example.com.error.log;
    
    location / {
        try_files $uri $uri/ =404;
    }
    
    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }
}

# 子域名配置
server {
    listen 80;
    server_name blog.example.com;
    root /var/www/blog.example.com;
    index index.html;
    
    location / {
        try_files $uri $uri/ =404;
    }
}

# API 服务配置
server {
    listen 80;
    server_name api.example.com;
    
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# IP 1: 192.168.1.10
server {
    listen 192.168.1.10:80;
    server_name _;
    root /var/www/site1;
    
    location / {
        try_files $uri $uri/ =404;
    }
}

# IP 2: 192.168.1.11
server {
    listen 192.168.1.11:80;
    server_name _;
    root /var/www/site2;
    
    location / {
        try_files $uri $uri/ =404;
    }
}

# 端口 80 - 主站
server {
    listen 80;
    server_name example.com;
    root /var/www/main;
    
    location / {
        try_files $uri $uri/ =404;
    }
}

# 端口 8080 - 管理后台
server {
    listen 8080;
    server_name example.com;
    root /var/www/admin;
    
    # 访问控制
    allow 192.168.1.0/24;
    deny all;
    
    location / {
        try_files $uri $uri/ =404;
    }
}

# 端口 9000 - API 服务
server {
    listen 9000;
    server_name example.com;
    
    location / {
        proxy_pass http://127.0.0.1:3000;
        include proxy_params;
    }
}

# HTTP 重定向到 HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

# HTTPS 虚拟主机
server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    
    # SSL 证书配置
    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;
    
    # SSL 参数优化
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    
    # HSTS 安全头
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    
    root /var/www/example.com;
    index index.html index.php;
    
    location / {
        try_files $uri $uri/ =404;
    }
}

# 基础反向代理
server {
    listen 80;
    server_name proxy.example.com;
    
    location / {
        proxy_pass http://127.0.0.1:8080;
        
        # 基础代理头
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # 超时设置
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
        
        # 缓冲设置
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 4k;
        proxy_busy_buffers_size 8k;
    }
}

server {
    listen 80;
    server_name api.example.com;
    
    # 定义上游服务器
    location / {
        proxy_pass http://backend_servers;
        
        # 完整的代理头设置
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        
        # WebSocket 支持
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        
        # 错误处理
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
        proxy_next_upstream_tries 3;
        proxy_next_upstream_timeout 30s;
        
        # 响应处理
        proxy_intercept_errors on;
        proxy_hide_header X-Powered-By;
        proxy_hide_header Server;
    }
}

# 定义上游服务器组
upstream backend_servers {
    # 加权轮询
    server 192.168.1.10:8080 weight=3 max_fails=2 fail_timeout=30s;
    server 192.168.1.11:8080 weight=2 max_fails=2 fail_timeout=30s;
    server 192.168.1.12:8080 weight=1 max_fails=2 fail_timeout=30s;
    
    # 备用服务器
    server 192.168.1.13:8080 backup;
    
    # 负载均衡算法
    least_conn;
    
    # 会话保持
    keepalive 32;
}

# IP 哈希负载均衡
upstream session_backend {
    ip_hash;
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

# 一致性哈希
upstream cache_backend {
    hash $request_uri consistent;
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

server {
    listen 80;
    server_name lb.example.com;
    
    location / {
        proxy_pass http://backend_servers;
        include proxy_params;
    }
    
    location /api/ {
        proxy_pass http://session_backend;
        include proxy_params;
    }
}

upstream backend {
    server 192.168.1.10:8080 max_fails=3 fail_timeout=30s;
    server 192.168.1.11:8080 max_fails=3 fail_timeout=30s;
    server 192.168.1.12:8080 max_fails=3 fail_timeout=30s;
}

upstream backend {
    zone backend 64k;
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

server {
    listen 80;
    
    location / {
        proxy_pass http://backend;
        health_check interval=5s fails=3 passes=2 uri=/health;
    }
}

# 缓存路径配置
proxy_cache_path /var/cache/nginx/proxy 
                 levels=1:2 
                 keys_zone=my_cache:10m 
                 max_size=1g 
                 inactive=60m 
                 use_temp_path=off;

server {
    listen 80;
    server_name cache.example.com;
    
    location / {
        proxy_pass http://backend_servers;
        
        # 启用缓存
        proxy_cache my_cache;
        proxy_cache_valid 200 302 10m;
        proxy_cache_valid 404 1m;
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
        
        # 缓存键
        proxy_cache_key "$scheme$request_method$host$request_uri";
        
        # 缓存控制
        proxy_cache_bypass $http_pragma $http_authorization;
        proxy_no_cache $http_pragma $http_authorization;
        
        # 缓存头信息
        add_header X-Cache-Status $upstream_cache_status;
        
        include proxy_params;
    }
    
    # 缓存清理接口
    location ~ /purge(/.*) {
        allow 127.0.0.1;
        deny all;
        proxy_cache_purge my_cache "$scheme$request_method$host$1";
    }
}

server {
    listen 80;
    server_name static.example.com;
    root /var/www/static;
    index index.html index.htm;
    
    # 静态文件处理
    location / {
        try_files $uri $uri/ =404;
        
        # 安全设置
        location ~ /\. {
            deny all;
        }
    }
    
    # 图片文件优化
    location ~* \.(jpg|jpeg|png|gif|ico|svg)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
        add_header Vary Accept-Encoding;
        
        # 防盗链
        valid_referers none blocked server_names *.example.com;
        if ($invalid_referer) {
            return 403;
        }
    }
    
    # CSS/JS 文件优化
    location ~* \.(css|js)$ {
        expires 7d;
        add_header Cache-Control "public";
        gzip_static on;
    }
    
    # 字体文件
    location ~* \.(woff|woff2|ttf|eot)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        add_header Access-Control-Allow-Origin "*";
    }
}

server {
    listen 80;
    server_name files.example.com;
    root /var/www/files;
    
    location / {
        # 启用目录浏览
        autoindex on;
        autoindex_exact_size off;    # 显示文件大小（KB/MB）
        autoindex_localtime on;      # 显示本地时间
        autoindex_format html;       # 输出格式：html/xml/json/jsonp
        
        # 自定义目录页面
        add_header Content-Type "text/html; charset=utf-8";
        
        # 访问控制
        allow 192.168.1.0/24;
        deny all;
    }
    
    # 隐藏特定文件
    location ~ /\.(htaccess|htpasswd|git) {
        deny all;
    }
}

http {
    # Gzip 基础配置
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_comp_level 6;
    gzip_proxied any;
    
    # 压缩文件类型
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/javascript
        application/xml+rss
        application/json
        application/xml
        image/svg+xml;
    
    # 静态压缩文件
    gzip_static on;
    
    # Brotli 压缩（需要模块支持）
    brotli on;
    brotli_comp_level 6;
    brotli_types
        text/plain
        text/css
        application/json
        application/javascript
        text/xml
        application/xml
        application/xml+rss
        text/javascript;
}

server {
    listen 80;
    server_name compress.example.com;
    root /var/www/html;
    
    location / {
        # 预压缩文件检查顺序
        try_files $uri $uri.br $uri.gz $uri/ =404;
    }
}

server {
    listen 80;
    server_name cdn.example.com;
    root /var/www/cdn;
    
    # 不缓存的文件
    location ~* \.(html|htm)$ {
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Pragma "no-cache";
        add_header Expires "0";
    }
    
    # 短期缓存
    location ~* \.(css|js)$ {
        expires 7d;
        add_header Cache-Control "public, max-age=604800";
        
        # ETag 支持
        etag on;
        
        # 条件请求处理
        if_modified_since exact;
    }
    
    # 长期缓存
    location ~* \.(jpg|jpeg|png|gif|ico|woff|woff2)$ {
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable";
        
        # 版本化文件永不过期
        location ~* \.(jpg|jpeg|png|gif|ico|woff|woff2)\?v=[0-9]+ {
            expires max;
            add_header Cache-Control "public, max-age=31536000, immutable";
        }
    }
    
    # API 响应缓存
    location /api/ {
        proxy_pass http://api_backend;
        
        # 根据响应头设置缓存
        proxy_cache_valid 200 5m;
        proxy_cache_valid 404 1m;
        proxy_cache_valid any 1m;
        
        # 缓存键包含查询参数
        proxy_cache_key "$scheme$request_method$host$request_uri";
    }
}

server {
    listen 443 ssl http2;
    server_name secure.example.com;
    
    # SSL 证书文件
    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;
    
    # 中间证书链（如果有）
    ssl_trusted_certificate /etc/ssl/certs/example.com.chain.crt;
    
    # 基础 SSL 参数
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;
    
    # 会话缓存
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;
    
    # OCSP 装订
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    
    root /var/www/secure;
    index index.html;
    
    location / {
        try_files $uri $uri/ =404;
    }
}

# HTTP 重定向到 HTTPS
server {
    listen 80;
    server_name secure.example.com;
    return 301 https://$server_name$request_uri;
}

# SSL 配置文件 /etc/nginx/snippets/ssl-params.conf
ssl_protocols TLSv1.2 TLSv1.3;

# 现代浏览器兼容的密码套件
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

# 服务器密码套件优先
ssl_prefer_server_ciphers off;

# DH 参数（用于 DHE 密码套件）
ssl_dhparam /etc/ssl/certs/dhparam.pem;

# 会话缓存优化
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 1d;
ssl_session_tickets off;

# OCSP 装订
ssl_stapling on;
ssl_stapling_verify on;

# 安全头
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options DENY always;
add_header X-Content-Type-Options nosniff always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# 使用配置
server {
    listen 443 ssl http2;
    server_name example.com;
    
    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;
    
    include /etc/nginx/snippets/ssl-params.conf;
    
    # 网站内容...
}

# 生成强 DH 参数（需要较长时间）
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

# 或使用 4096 位（更安全但更慢）
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096

server {
    listen 443 ssl http2;
    server_name h2.example.com;
    
    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;
    include /etc/nginx/snippets/ssl-params.conf;
    
    root /var/www/h2;
    index index.html;
    
    # HTTP/2 服务器推送
    location / {
        try_files $uri $uri/ =404;
        
        # 推送关键资源
        location = /index.html {
            http2_push /css/style.css;
            http2_push /js/app.js;
            http2_push https://imgcdn.dpdns.org/images/logo.png;
        }
    }
    
    # 静态资源优化
    location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        
        # 预加载提示
        add_header Link "</css/style.css>; rel=preload; as=style" always;
        add_header Link "</js/app.js>; rel=preload; as=script" always;
    }
}

server {
    listen 443 ssl http2;
    server_name secure.example.com;
    
    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;
    include /etc/nginx/snippets/ssl-params.conf;
    
    # HSTS 配置
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    
    # 其他安全头
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    
    # CSP 内容安全策略
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https:; connect-src 'self'; frame-ancestors 'none';" always;
    
    root /var/www/secure;
    
    location / {
        try_files $uri $uri/ =404;
    }
}

# 处理 HTTP 请求
server {
    listen 80;
    server_name secure.example.com;
    
    # 永久重定向到 HTTPS
    return 301 https://$server_name$request_uri;
}

# 全局配置优化
user nginx;
worker_processes auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 65535;

events {
    # 事件模型优化
    use epoll;
    worker_connections 4096;
    multi_accept on;
    accept_mutex off;
}

http {
    # 连接优化
    keepalive_timeout 65;
    keepalive_requests 1000;
    send_timeout 30;
    client_header_timeout 30;
    client_body_timeout 30;
    
    # 缓冲区优化
    client_header_buffer_size 4k;
    large_client_header_buffers 4 16k;
    client_body_buffer_size 128k;
    client_max_body_size 100m;
    
    # 文件传输优化
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    
    # 哈希表优化
    server_names_hash_bucket_size 128;
    server_names_hash_max_size 2048;
    types_hash_max_size 2048;
    variables_hash_max_size 2048;
}

# 代理缓存配置
proxy_cache_path /var/cache/nginx/proxy
                 levels=1:2
                 keys_zone=proxy_cache:100m
                 max_size=10g
                 inactive=60m
                 use_temp_path=off;

# FastCGI 缓存配置
fastcgi_cache_path /var/cache/nginx/fastcgi
                   levels=1:2
                   keys_zone=fastcgi_cache:100m
                   max_size=5g
                   inactive=60m
                   use_temp_path=off;

server {
    listen 80;
    server_name cache.example.com;
    root /var/www/html;
    
    # 静态文件缓存
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        add_header Vary Accept-Encoding;
        
        # 浏览器缓存
        etag on;
        if_modified_since exact;
    }
    
    # 动态内容缓存
    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        fastcgi_cache fastcgi_cache;
        fastcgi_cache_valid 200 301 302 1h;
        fastcgi_cache_valid 404 10m;
        fastcgi_cache_valid any 1m;
        
        # 缓存键
        fastcgi_cache_key "$scheme$request_method$host$request_uri";
        
        # 缓存绕过条件
        fastcgi_cache_bypass $http_pragma $http_authorization $cookie_nocache $arg_nocache;
        fastcgi_no_cache $http_pragma $http_authorization $cookie_nocache $arg_nocache;
        
        # 缓存状态头
        add_header X-Cache-Status $upstream_cache_status;
        
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }
    
    # API 代理缓存
    location /api/ {
        proxy_pass http://api_backend;
        proxy_cache proxy_cache;
        proxy_cache_valid 200 5m;
        proxy_cache_valid 404 1m;
        
        # 智能缓存更新
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
        proxy_cache_background_update on;
        proxy_cache_lock on;
        
        include proxy_params;
    }
}

http {
    # Gzip 压缩优化
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_comp_level 6;
    gzip_proxied any;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    
    # 压缩文件类型
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        text/csv
        application/javascript
        application/json
        application/xml
        application/xml+rss
        application/atom+xml
        image/svg+xml
        font/truetype
        font/opentype
        application/font-woff
        application/font-woff2;
    
    # Brotli 压缩（需要模块）
    brotli on;
    brotli_comp_level 6;
    brotli_min_length 1024;
    brotli_types
        text/plain
        text/css
        application/json
        application/javascript
        text/xml
        application/xml
        application/xml+rss
        text/javascript
        image/svg+xml;
    
    # 预压缩文件支持
    gzip_static on;
    brotli_static on;
}

server {
    listen 80;
    server_name compress.example.com;
    root /var/www/html;
    
    location / {
        # 检查预压缩文件
        try_files $uri $uri.br $uri.gz $uri/ =404;
    }
    
    # 实时压缩 API 响应
    location /api/ {
        proxy_pass http://api_backend;
        
        # 强制压缩
        gzip_proxied any;
        gzip_min_length 1;
        
        include proxy_params;
    }
}

# /etc/sysctl.conf
# 网络优化
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 5000
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_max_tw_buckets = 6000

# 文件描述符限制
fs.file-max = 2097152

# 应用生效
sudo sysctl -p

# /etc/security/limits.conf
nginx soft nofile 65535
nginx hard nofile 65535

# 或在 systemd 服务文件中
# /etc/systemd/system/nginx.service.d/limits.conf
[Service]
LimitNOFILE=65535

#!/bin/bash
# nginx-performance.sh

echo "=== Nginx 性能监控 ==="

# 连接统计
echo "当前连接数："
ss -tuln | grep :80 | wc -l

# 进程状态
echo -e "\nNginx 进程状态："
ps aux | grep nginx | grep -v grep

# 内存使用
echo -e "\n内存使用情况："
free -h

# 负载情况
echo -e "\n系统负载："
uptime

# 网络连接状态
echo -e "\n网络连接状态："
ss -s

# 磁盘 I/O
echo -e "\n磁盘 I/O："
iostat -x 1 1 | grep -E "(Device|sda|nvme)"

# IP 访问控制
server {
    listen 80;
    server_name admin.example.com;
    
    # 允许特定 IP
    allow 192.168.1.0/24;
    allow 10.0.0.0/8;
    deny all;
    
    # 基于地理位置的访问控制（需要 GeoIP 模块）
    if ($geoip_country_code != CN) {
        return 403;
    }
    
    location / {
        root /var/www/admin;
        index index.html;
    }
    
    # 敏感目录保护
    location /admin/ {
        allow 192.168.1.100;
        deny all;
        
        auth_basic "Admin Area";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }
}

# 基于用户代理的访问控制
server {
    listen 80;
    server_name api.example.com;
    
    # 阻止恶意爬虫
    if ($http_user_agent ~* (bot|crawler|spider|scraper)) {
        return 403;
    }
    
    # 阻止空用户代理
    if ($http_user_agent = "") {
        return 403;
    }
    
    location / {
        proxy_pass http://api_backend;
        include proxy_params;
    }
}

# 创建密码文件
sudo htpasswd -c /etc/nginx/.htpasswd admin
sudo htpasswd /etc/nginx/.htpasswd user1

# 设置权限
sudo chown root:nginx /etc/nginx/.htpasswd
sudo chmod 640 /etc/nginx/.htpasswd

# 安全配置文件 /etc/nginx/snippets/security.conf
# 隐藏 Nginx 版本
server_tokens off;

# 限制请求方法
if ($request_method !~ ^(GET|HEAD|POST|PUT|DELETE|OPTIONS)$) {
    return 405;
}

# 防止点击劫持
add_header X-Frame-Options "SAMEORIGIN" always;

# 防止 MIME 类型嗅探
add_header X-Content-Type-Options "nosniff" always;

# XSS 保护
add_header X-XSS-Protection "1; mode=block" always;

# 引用策略
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# 权限策略
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

server {
    listen 80;
    server_name secure.example.com;
    
    include /etc/nginx/snippets/security.conf;
    
    # 请求大小限制
    client_max_body_size 10m;
    client_body_buffer_size 128k;
    
    # 请求频率限制
    limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
    
    # 连接数限制
    limit_conn_zone $binary_remote_addr zone=conn:10m;
    limit_conn conn 10;
    
    location /login {
        limit_req zone=login burst=3 nodelay;
        proxy_pass http://auth_backend;
        include proxy_params;
    }
    
    location /api/ {
        limit_req zone=api burst=20 nodelay;
        proxy_pass http://api_backend;
        include proxy_params;
    }
    
    # 阻止访问敏感文件
    location ~ /\.(ht|git|svn) {
        deny all;
    }
    
    location ~ \.(sql|bak|backup|log)$ {
        deny all;
    }
}

# DDoS 防护
http {
    # 连接限制
    limit_conn_zone $binary_remote_addr zone=perip:10m;
    limit_conn_zone $server_name zone=perserver:10m;
    
    # 请求限制
    limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=5r/s;
    
    server {
        listen 80;
        server_name protected.example.com;
        
        # 应用限制
        limit_conn perip 10;
        limit_conn perserver 100;
        limit_req zone=req_limit_per_ip burst=10 nodelay;
        
        # 慢速攻击防护
        client_body_timeout 10s;
        client_header_timeout 10s;
        send_timeout 10s;
        
        location / {
            # 检查请求频率
            if ($request_time > 10) {
                return 444;
            }
            
            proxy_pass http://backend;
            include proxy_params;
        }
    }
}

http {
    # 安全日志格式
    log_format security '$remote_addr - $remote_user [$time_local] '
                       '"$request" $status $body_bytes_sent '
                       '"$http_referer" "$http_user_agent" '
                       '$request_time $upstream_response_time '
                       '$geoip_country_code';
    
    # 访问日志
    access_log /var/log/nginx/access.log main;
    access_log /var/log/nginx/security.log security;
    
    # 错误日志
    error_log /var/log/nginx/error.log warn;
    
    server {
        listen 80;
        server_name log.example.com;
        
        # 记录可疑请求
        location / {
            # 记录长 URI
            if ($request_uri ~ ".{255,}") {
                access_log /var/log/nginx/suspicious.log security;
            }
            
            # 记录 SQL 注入尝试
            if ($args ~ "(union|select|insert|delete|update|drop|create|alter)") {
                access_log /var/log/nginx/sqli.log security;
                return 403;
            }
            
            # 记录 XSS 尝试
            if ($args ~ "(<script|javascript:|vbscript:|onload=|onerror=)") {
                access_log /var/log/nginx/xss.log security;
                return 403;
            }
            
            proxy_pass http://backend;
            include proxy_params;
        }
    }
}

#!/bin/bash
# security-analysis.sh

LOG_FILE="/var/log/nginx/access.log"
DATE=$(date +%Y-%m-%d)

echo "=== Nginx 安全日志分析 ($DATE) ==="

# 统计访问最多的 IP
echo "访问最多的 IP："
awk '{print $1}' $LOG_FILE | sort | uniq -c | sort -nr | head -10

# 统计 404 错误
echo -e "\n404 错误统计："
awk '$9==404 {print $7}' $LOG_FILE | sort | uniq -c | sort -nr | head -10

# 统计可疑的 User-Agent
echo -e "\n可疑 User-Agent："
awk -F'"' '$6 ~ /(bot|crawler|scanner|exploit)/ {print $6}' $LOG_FILE | sort | uniq -c | sort -nr

# 统计大文件请求
echo -e "\n大文件请求（>10MB）："
awk '$10>10485760 {print $1, $7, $10}' $LOG_FILE | sort -k3 -nr | head -10

# 统计慢请求
echo -e "\n慢请求（>5秒）："
awk '$NF>5 {print $1, $7, $NF}' $LOG_FILE | sort -k3 -nr | head -10

server {
    listen 80;
    server_name secure.example.com;
    
    # 防止路径遍历
    location ~ \.\./  {
        return 403;
    }
    
    # 防止 NULL 字节攻击
    location ~ \x00 {
        return 403;
    }
    
    # 防止 HTTP 请求走私
    if ($http_transfer_encoding ~* chunked) {
        return 400;
    }
    
    # 防止 HTTP 头注入
    if ($http_host !~ ^[a-zA-Z0-9.-]+$) {
        return 400;
    }
    
    # 防止大 Cookie 攻击
    if ($http_cookie ~ ".{4096,}") {
        return 400;
    }
    
    # 文件上传安全
    location /upload {
        client_max_body_size 50m;
        
        # 限制文件类型
        if ($request_filename ~* \.(php|jsp|asp|sh|py|pl)$) {
            return 403;
        }
        
        proxy_pass http://upload_backend;
        include proxy_params;
    }
    
    # API 安全
    location /api/ {
        # 验证 Content-Type
        if ($content_type !~ "^application/(json|x-www-form-urlencoded)") {
            return 415;
        }
        
        # CORS 安全配置
        add_header Access-Control-Allow-Origin "https://trusted-domain.com" always;
        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
        add_header Access-Control-Max-Age "86400" always;
        
        proxy_pass http://api_backend;
        include proxy_params;
    }
}

http {
    # 标准日志格式
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    
    # 详细日志格式
    log_format detailed '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for" '
                       'rt=$request_time uct="$upstream_connect_time" '
                       'uht="$upstream_header_time" urt="$upstream_response_time"';
    
    # JSON 格式日志
    log_format json escape=json '{'
                               '"timestamp":"$time_iso8601",'
                               '"remote_addr":"$remote_addr",'
                               '"request":"$request",'
                               '"status":$status,'
                               '"body_bytes_sent":$body_bytes_sent,'
                               '"http_referer":"$http_referer",'
                               '"http_user_agent":"$http_user_agent",'
                               '"request_time":$request_time,'
                               '"upstream_response_time":"$upstream_response_time"'
                               '}';
    
    # 性能分析格式
    log_format performance '$remote_addr [$time_local] "$request" '
                          '$status $body_bytes_sent '
                          'rt=$request_time '
                          'uct=$upstream_connect_time '
                          'uht=$upstream_header_time '
                          'urt=$upstream_response_time';
    
    server {
        listen 80;
        server_name monitor.example.com;
        
        # 多种日志记录
        access_log /var/log/nginx/access.log main;
        access_log /var/log/nginx/performance.log performance;
        access_log /var/log/nginx/json.log json;
        
        # 条件日志记录
        map $status $log_4xx_5xx {
            ~^[45] 1;
            default 0;
        }
        
        access_log /var/log/nginx/errors.log main if=$log_4xx_5xx;
        
        location / {
            proxy_pass http://backend;
            include proxy_params;
        }
    }
}

# 全局错误日志
error_log /var/log/nginx/error.log warn;

# 调试日志（仅在需要时启用）
error_log /var/log/nginx/debug.log debug;

server {
    listen 80;
    server_name debug.example.com;
    
    # 服务器级错误日志
    error_log /var/log/nginx/debug.example.com.error.log info;
    
    location / {
        # 位置级错误日志
        error_log /var/log/nginx/location.error.log debug;
        
        proxy_pass http://backend;
        include proxy_params;
    }
}

# 启用状态模块
server {
    listen 80;
    server_name status.example.com;
    
    # 基础状态页面
    location /nginx_status {
        stub_status on;
        access_log off;
        
        # 访问控制
        allow 127.0.0.1;
        allow 192.168.1.0/24;
        deny all;
    }
    
    # 详细状态信息（需要第三方模块）
    location /status {
        vhost_traffic_status_display;
        vhost_traffic_status_display_format html;
        access_log off;
        
        allow 127.0.0.1;
        allow 192.168.1.0/24;
        deny all;
    }
    
    # Prometheus 指标
    location /metrics {
        prometheus;
        access_log off;
        
        allow 127.0.0.1;
        deny all;
    }
}

#!/bin/bash
# nginx-status.sh

STATUS_URL="http://localhost/nginx_status"

# 获取状态信息
STATUS=$(curl -s $STATUS_URL)

if [ $? -eq 0 ]; then
    echo "=== Nginx 状态监控 ==="
    echo "$STATUS"
    
    # 解析状态信息
    ACTIVE=$(echo "$STATUS" | grep "Active connections" | awk '{print $3}')
    ACCEPTS=$(echo "$STATUS" | grep "server accepts" | awk '{print $1}')
    HANDLED=$(echo "$STATUS" | grep "server accepts" | awk '{print $2}')
    REQUESTS=$(echo "$STATUS" | grep "server accepts" | awk '{print $3}')
    READING=$(echo "$STATUS" | grep "Reading" | awk '{print $2}')
    WRITING=$(echo "$STATUS" | grep "Reading" | awk '{print $4}')
    WAITING=$(echo "$STATUS" | grep "Reading" | awk '{print $6}')
    
    echo -e "\n=== 解析结果 ==="
    echo "活跃连接数: $ACTIVE"
    echo "总接受连接: $ACCEPTS"
    echo "总处理连接: $HANDLED"
    echo "总请求数: $REQUESTS"
    echo "正在读取: $READING"
    echo "正在写入: $WRITING"
    echo "等待连接: $WAITING"
    
    # 计算连接处理率
    if [ "$ACCEPTS" -gt 0 ]; then
        HANDLE_RATE=$(echo "scale=2; $HANDLED * 100 / $ACCEPTS" | bc)
        echo "连接处理率: ${HANDLE_RATE}%"
    fi
    
else
    echo "无法获取 Nginx 状态信息"
    exit 1
fi

#!/bin/bash
# nginx-performance-analysis.sh

LOG_FILE="/var/log/nginx/performance.log"
TEMP_DIR="/tmp/nginx_analysis"
mkdir -p $TEMP_DIR

echo "=== Nginx 性能分析报告 ==="

# 响应时间分析
echo "1. 响应时间分析："
awk '{
    if ($NF > 5) slow++;
    else if ($NF > 1) medium++;
    else fast++;
    total++;
    sum += $NF;
} END {
    printf "快速响应 (<1s): %d (%.2f%%)\n", fast, fast*100/total;
    printf "中等响应 (1-5s): %d (%.2f%%)\n", medium, medium*100/total;
    printf "慢速响应 (>5s): %d (%.2f%%)\n", slow, slow*100/total;
    printf "平均响应时间: %.3fs\n", sum/total;
}' $LOG_FILE

# 状态码分析
echo -e "\n2. HTTP 状态码分析："
awk '{print $6}' $LOG_FILE | sort | uniq -c | sort -nr | head -10

# 最慢的请求
echo -e "\n3. 最慢的请求 (Top 10)："
awk '{print $NF, $5}' $LOG_FILE | sort -nr | head -10

# 访问最多的页面
echo -e "\n4. 访问最多的页面："
awk '{print $5}' $LOG_FILE | sort | uniq -c | sort -nr | head -10

# 每小时请求量
echo -e "\n5. 每小时请求量："
awk '{
    hour = substr($4, 14, 2);
    count[hour]++;
} END {
    for (h in count) {
        printf "%s:00 - %d requests\n", h, count[h];
    }
}' $LOG_FILE | sort

# 生成性能报告
cat > $TEMP_DIR/performance_report.html << 'EOF'
<!DOCTYPE html>
<html>
<head>
    <title>Nginx Performance Report</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        .metric { margin: 20px 0; padding: 10px; border: 1px solid #ddd; }
        .good { background-color: #d4edda; }
        .warning { background-color: #fff3cd; }
        .danger { background-color: #f8d7da; }
    </style>
</head>
<body>
    <h1>Nginx Performance Report</h1>
    <div id="metrics"></div>
    
    <script>
        // 这里可以添加 JavaScript 来动态生成图表
        console.log("Performance report generated");
    </script>
</body>
</html>
EOF

echo -e "\n性能报告已生成: $TEMP_DIR/performance_report.html"

server {
    listen 80;
    server_name rewrite.example.com;
    root /var/www/html;
    
    # 基础重写规则
    rewrite ^/old-path/(.*)$ /new-path/$1 permanent;
    rewrite ^/product/([0-9]+)$ /product.php?id=$1 last;
    rewrite ^/category/([a-zA-Z0-9-]+)$ /category.php?name=$1 last;
    
    # 条件重写
    if ($args ~ "^id=([0-9]+)") {
        set $product_id $1;
        rewrite ^/product$ /product/$product_id? permanent;
    }
    
    # 移动端重定向
    if ($http_user_agent ~* "(mobile|android|iphone|ipad)") {
        rewrite ^(.*)$ https://m.example.com$1 redirect;
    }
    
    # HTTPS 重定向
    if ($scheme = http) {
        return 301 https://$server_name$request_uri;
    }
    
    # 去除 www 前缀
    if ($host ~* ^www\.(.+)$) {
        return 301 $scheme://$1$request_uri;
    }
    
    # 尾部斜杠处理
    rewrite ^([^.]*[^/])$ $1/ permanent;
    
    location / {
        try_files $uri $uri/ @fallback;
    }
    
    location @fallback {
        rewrite ^.*$ /index.php last;
    }
}

server {
    listen 80;
    server_name location.example.com;
    root /var/www/html;
    
    # 精确匹配
    location = / {
        return 200 "Exact match for root";
    }
    
    location = /favicon.ico {
        expires 1y;
        access_log off;
    }
    
    # 前缀匹配（优先级高）
    location ^~ /admin/ {
        auth_basic "Admin Area";
        auth_basic_user_file /etc/nginx/.htpasswd;
        try_files $uri $uri/ =404;
    }
    
    # 正则匹配（区分大小写）
    location ~ \.(jpg|jpeg|png|gif)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
    }
    
    # 正则匹配（不区分大小写）
    location ~* \.(css|js)$ {
        expires 7d;
        gzip_static on;
    }
    
    # 前缀匹配
    location /api/ {
        proxy_pass http://api_backend/;
        include proxy_params;
    }
    
    location /static/ {
        alias /var/www/static/;
        autoindex on;
    }
    
    # 嵌套 location
    location /app/ {
        location ~ \.php$ {
            fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
            include fastcgi_params;
        }
        
        location ~ \.(css|js)$ {
            expires 1h;
        }
        
        try_files $uri $uri/ =404;
    }
    
    # 默认匹配
    location / {
        try_files $uri $uri/ @fallback;
    }
    
    location @fallback {
        proxy_pass http://app_backend;
        include proxy_params;
    }
}

# 安装 nginx-module-vts（流量统计）
sudo apt install nginx-module-vts

# 或编译安装
wget https://github.com/vozlt/nginx-module-vts/archive/v0.1.18.tar.gz
tar -xzf v0.1.18.tar.gz

# 重新编译 Nginx
./configure --add-module=../nginx-module-vts-0.1.18
make && sudo make install

# 加载模块
load_module modules/ngx_http_vhost_traffic_status_module.so;

http {
    # 启用流量统计
    vhost_traffic_status_zone;
    
    server {
        listen 80;
        server_name stats.example.com;
        
        location /status {
            vhost_traffic_status_display;
            vhost_traffic_status_display_format html;
            access_log off;
        }
    }
}