Linux nginx代理介紹
阿新 • • 發佈：2018-06-01
linux nginxnginx作為web服務器一個重要的功能就是反向代理。nginx反向代理的指令不需要新增額外的模塊，默認自帶proxy_pass指令，只需要修改配置文件就可以實現反向代理。
proxy_pass
http://www.proxy.develop/admin/a/index.html
location /admin {
proxy_pass http://192.168.1.201:80/;
}
訪問的是真實服務器 http://192.168.1.201:80/a/index.htmlhttp://www.proxy.develop/admin/a/index.html location /admin { proxy_pass http://192.168.1.201:80; } 訪問的是真實服務器 http://192.168.1.201:80/admin/a/index.html
proxy_set_header
proxy_set_header ? 設置代理服務到真實服務器的header
沒設置代理header前：
location / { proxy_pass http://192.168.1.201:80; proxy_set_header X-Real-IP $remote_addr; #如果僅僅是一級代理，這個就可以了，key可以隨意修改 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; #這種方式比較優雅，會自動修改多級代理中的客戶端ip，這裏的key是固定的 }
set_header
設置代理服務器到客戶端的header， set_header,需要ngx_http_headers_module模塊實現
location / { proxy_pass http://192.168.1.201:80; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; add_header X-Via $server_addr; add_header X-Accel $server_name; }
緩存
緩存一定要註意使用，動態數據有時候被緩存很蠻煩。
http{
proxy_cache_path /data/nginx/cache levels=1:1:2 keys_zone=one:10m inactive=10m max_size=2g; #設置緩存結構
}
server{
proxy_cache one;
proxy_cache_key $request_uri;
proxy_cache_methods GET HEAD;
proxy_cache_min_uses 2; #指定時間內訪問2次以上的叫有效
proxy_cache_valid 200 302 304 10m; #這項必須要
proxy_cache_valid 404 1m;
proxy_cache_use_stale off; #後臺掛了，不給予緩存
}
levels 緩存目錄結構
keys_zone hash鍵名 鍵名空間大小 pcache：10mb
max_size 緩存目錄大小 2G
inactive 不活躍時間 10分鐘http://www.proxy.develop/
[root@node1 conf.d]# cat /data/nginx/cache/9/d/c7/6666cd76f96956469e7be39d750cc7d9
"5b0f9065-2f"?
KEY: /
HTTP/1.1 200 OK
Server: nginx/1.14.0
Date: Thu, 31 May 2018 06:23:13 GMT
Content-Type: text/html
Content-Length: 47
Last-Modified: Thu, 31 May 2018 06:04:21 GMT
Connection: close
ETag: "5b0f9065-2f"
Accept-Ranges: bytes
<h1>node2 -------------------------------</h1>代理php-fpm
#這兩個文件就差一個SCRIPT_FILENAME執行腳本路徑，如果是本地的php-fpm就調用 fastcgi.conf 因為$document_root$fastcgi_script_name這是就是腳本所在路徑，如果是遠程調用就用fastcgi_params，SCRIPT_FILENAME需要自己定義
[root@node1 conf]# diff fastcgi_params fastcgi.conf
1a2
> fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
#分析下變量意義
[root@node1 conf]# cat fastcgi.conf
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; /mydata/code/php/yii-test.dev/web/a/index2.php
fastcgi_param QUERY_STRING $query_string; a=pp
fastcgi_param REQUEST_METHOD $request_method; 請求方法
fastcgi_param CONTENT_TYPE $content_type; 內容類型
fastcgi_param CONTENT_LENGTH $content_length; 長度
fastcgi_param SCRIPT_NAME $fastcgi_script_name; /a/index2.php
fastcgi_param REQUEST_URI $request_uri; /a/index2.php?a=pp
fastcgi_param DOCUMENT_URI $document_uri; /a/index2.php
fastcgi_param DOCUMENT_ROOT $document_root; /www/server/source/nginx1.14.0/html
fastcgi_param SERVER_PROTOCOL $server_protocol; HTTP/1.1
fastcgi_param REQUEST_SCHEME $scheme; http
fastcgi_param HTTPS $https if_not_empty;
fastcgi_param GATEWAY_INTERFACE CGI/1.1; CGI/1.1
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; nginx/1.14.0
fastcgi_param REMOTE_ADDR $remote_addr; 客戶端地址
fastcgi_param REMOTE_PORT $remote_port; 客戶端端口
fastcgi_param SERVER_ADDR $server_addr; 服務器ip
fastcgi_param SERVER_PORT $server_port; 80
fastcgi_param SERVER_NAME $server_name; hostname www.proxy.develop
# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;
##################
http://www.proxy.develop/index2.php?a=pp
以上參數是php的 $_SERVER，入下圖所示
tcp/ip通信模式
server {
listen 80;
server_name www.proxy.develop;
index index.php;
location / {
# try_files $uri $uri /index.php?$args;
if (!-e $request_filename) {
rewrite ^/(.*) /index.php?r=$1 last;
}
}
location ~* \.php$ {
fastcgi_pass 192.168.1.201:9000; #php-fpm listen外部ip
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME /mydata/code/php/yii-test.dev/web$fastcgi_script_name;
}
}測穩定性
marvindeMacBook-Pro:webbench-1.5 marvin$ webbench -c 1000 -t 30 http://www.proxy.develop/index2.php
Webbench - Simple Web Benchmark 1.5
Copyright (c) Radim Kolar 1997-2004, GPL Open Source Software.
Benchmarking: GET http://www.proxy.develop/index2.php
1000 clients, running 30 sec.
Speed=12794 pages/min, 15557740 bytes/sec.
Requests: 6397 susceed, 0 failed.
[root@node1 conf]# cat /www/data/nginx/test/access.log |grep 200 | grep WebBench |wc -l
5906
[root@node1 conf]# cat /www/data/nginx/test/access.log |grep -v 200 | grep WebBench |wc -l
1491
200狀態 5906條
非200狀態 1491條unix通信模式
[root@node1 conf]# vim /www/server/php-fpm/etc/php-fpm.d/www.conf
listen = /dev/shm/php-cgi.sock
[root@node1 conf]# chmod 777 /dev/shm/php-cgi.sock #粗暴
nginx:
server {
listen 80;
server_name www.proxy.develop;
index index.php;
location / {
if (!-e $request_filename) {
rewrite ^/(.*) /index.php?r=$1 last;
}
}
location ~* \.php$ {
fastcgi_pass unix:/dev/shm/php-cgi.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME /mydata/code/php/yii-test.dev/web$fastcgi_script_name;
}
}測穩定性
marvindeMacBook-Pro:webbench-1.5 marvin$ webbench -c 1000 -t 30 http://www.proxy.develop/index2.php
Webbench - Simple Web Benchmark 1.5
Copyright (c) Radim Kolar 1997-2004, GPL Open Source Software.
Benchmarking: GET http://www.proxy.develop/index2.php
1000 clients, running 30 sec.
Speed=121714 pages/min, 16476704 bytes/sec.
Requests: 60854 susceed, 3 failed.
[root@node1 conf]# cat /www/data/nginx/test/access.log |grep 200 | grep WebBench |wc -l
6033
[root@node1 conf]# cat /www/data/nginx/test/access.log |grep -v 200 | grep WebBench | wc -l
54914
200狀態： 6033
非200狀態:54914實驗證明端口模式更加穩定。
緩存優化：跟proxy用法類似
fastcgi_cache_path path [levels=levels] [use_temp_path=on|off] keys_zone=name:size [inactive=time] [max_size=size] [manager_files=number] [manager_sleep=time] [manager_threshold=time] [loader_files=number] [loader_sleep=time] [loader_threshold=time] [purger=on|off] [purger_files=number] [purger_sleep=time] [purger_threshold=time];
定義fastcgi的緩存；緩存位置為磁盤上的文件系統，由path所指定路徑來定義；
levels=levels：緩存目錄的層級數量，以及每一級的目錄數量；levels=ONE:TWO:THREE
leves=1:2:2
keys_zone=name:size
k/v映射的內存空間的名稱及大小
inactive=time
非活動時長
max_size=size
磁盤上用於緩存數據的緩存空間上限
fastcgi_cache zone | off;
調用指定的緩存空間來緩存數據；http, server, location
fastcgi_cache_key string;
定義用作緩存項的key的字符串；
fastcgi_cache_methods GET | HEAD | POST ...;
為哪些請求方法使用緩存；
fastcgi_cache_min_uses number;
緩存空間中的緩存項在inactive定義的非活動時間內至少要被訪問到此處所指定的次數方可被認作活動項；
fastcgi_cache_valid [code ...] time;
不同的響應碼各自的緩存時長；
fastcgi_keep_conn on 代理到服務器長連接，比較好http-upstream
調度說明
http {
upstream webbackend {
ip_hash;
least_conn;
server 192.168.1.201:80; #
server 192.168.1.202:80; #
server 127.0.0.1:80 backup;
keepalive 32;
}
}
權重 weight=1
最大並發連接數 max_conns=numbs
健康狀態監測 最多失敗次數後不可用 max_fails=2 0:不做檢測
健康狀態監測 每隔多少時間監測一次 fail_timeout=5
監測到可以連接，會恢復
備用，所有服務都跪了的時候啟動 backup
人為標註下線 down
數據包平滑向上發送 slow_start
ip_hash 不能跟backup一起使用
hash 加變量 consistent #consistent加上比較好是一致性hash取模 32位加虛擬節點取模算法
hash $remote_addr 就是ip_hash
hash $request_uri dh算法，實現緩存命中率
keepalive 32; 在並發下保持連接是很好的選擇
least_conn ;權重不同時候防止 沒有請求配置集群組
http {
upstream webbackend {
server 192.168.1.201:80; # weight=1
server 192.168.1.202:80; #
}
upstream phpbackend {
server 192.168.1.201:9000 weight=2 fail_timeout=2 max_fails=2;
server 192.168.1.202:9000 weight=1 fail_timeout=2 max_fails=2;
server 127.0.0.1:9000 backup;
}
}
server {
listen 80;
server_name www.proxy.develop;
index index.php;
location / {
proxy_pass http://webbackend;
}
location ~* \.php$ {
fastcgi_pass phpbackend;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME /www/data/nginx/$fastcgi_script_name;
}
}
marvindeMacBook-Pro:webbench-1.5 marvin$ curl http://www.proxy.develop/index.html
<h1>node2 -------------------------------</h1>
marvindeMacBook-Pro:webbench-1.5 marvin$ curl http://www.proxy.develop/index.html
node3stream四層代理
#端口不要跟7層沖突
stream {
upstream sshsrvs {
server 192.168.1.201:22;
server 192.168.1.202:22;
}
server {
listen 22923;
proxy_pass sshsrvs;
}
server {
listen 22922;
proxy_pass 192.168.1.201:22;
}
server {
listen 8080;
proxy_pass 192.168.1.202:80;
}
}marvindeMacBook-Pro:~ marvin$ ssh -p22922 [email protected]
The authenticity of host ‘[192.168.1.200]:22922 ([192.168.1.200]:22922)‘ can‘t be established.
ECDSA key fingerprint is SHA256:DdAAXSUPsbzY8IAC/+raL8nU85KiYDMmeJpZYbgSKwU.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘[192.168.1.200]:22922‘ (ECDSA) to the list of known hosts.
[email protected]‘s password:
X11 forwarding request failed on channel 0
Last login: Fri Jun 1 08:26:25 2018 from 192.168.1.104
[root@node2 ~]#Linux nginx代理介紹