Nginx反向代理和负载均衡实战：高并发网站必备配置

作者

Nginx作为高性能Web服务器和反向代理，是构建高并发网站的基础设施。本文将深入讲解Nginx反向代理和负载均衡的实战配置。

1. Nginx反向代理基础

基本配置

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

关键参数说明

  • proxy_pass：指定后端服务器地址
  • proxy_set_header：传递客户端真实IP和Host头
  • proxy_connect_timeout：连接后端超时时间
  • proxy_read_timeout：读取响应超时时间

2. 负载均衡配置

轮询策略（默认）

upstream backend {
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

server {
    listen 80;
    
    location / {
        proxy_pass http://backend;
    }
}

权重分配

upstream backend {
    server 192.168.1.10:8080 weight=3;
    server 192.168.1.11:8080 weight=1;
    server 192.168.1.12:8080 weight=1;
}

IP哈希（会话保持）

upstream backend {
    ip_hash;
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
}

最少连接

upstream backend {
    least_conn;
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
}

3. 健康检查

upstream backend {
    server 192.168.1.10:8080 max_fails=3 fail_timeout=30s;
    server 192.168.1.11:8080 max_fails=3 fail_timeout=30s;
    
    # 定期健康检查
    check interval=3000 rise=2 fall=3 timeout=1000;
}

4. SSL/HTTPS配置

基础SSL配置

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    location / {
        proxy_pass http://backend;
    }
}

# HTTP跳转HTTPS
server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

5. 静态资源优化

缓存配置

location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
    add_header Vary "Accept-Encoding";
    root /var/www/html;
}

Gzip压缩

gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;

Brotli压缩（需模块支持）

brotli on;
brotli_comp_level 6;
brotli_types text/plain text/css application/json application/javascript text/xml application/xml application/rss+xml text/javascript image/svg+xml;

6. 缓存策略

Proxy缓存

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=mycache:10m inactive=60m;
proxy_cache_key "$scheme$request_method$host$request_uri";

server {
    location / {
        proxy_cache mycache;
        proxy_cache_valid 200 10m;
        proxy_cache_valid 404 1m;
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
        add_header X-Cache-Status $upstream_cache_status;
    }
}

7. 限流配置

基础限流

# 定义限流区域
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

server {
    location /api/ {
        limit_req zone=api burst=20 nodelay;
        proxy_pass http://backend;
    }
}

连接数限制

limit_conn_zone $binary_remote_addr zone=addr:10m;

server {
    location / {
        limit_conn addr 10;
        proxy_pass http://backend;
    }
}

8. 安全配置

隐藏Nginx版本

server_tokens off;

限制请求体大小

client_max_body_size 10M;

防DDoS基础

limit_req_zone $binary_remote_addr zone=ddos:10m rate=30r/m;

server {
    location / {
        limit_req zone=ddos burst=5 nodelay;
    }
}

IP白名单

location /admin {
    allow 192.168.1.0/24;
    deny all;
    proxy_pass http://backend;
}

9. 动静分离

server {
    listen 80;
    server_name example.com;

    # 静态资源
    location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
        root /var/www/static;
        expires 30d;
        access_log off;
    }

    # 动态请求
    location / {
        proxy_pass http://127.0.0.1:3000;
    }
}

10. 性能调优参数

worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 4096;
    use epoll;
    multi_accept on;
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 100;
    
    # 缓冲区
    client_body_buffer_size 128k;
    client_max_body_size 10M;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 8k;
}

监控与调试

# 检查配置语法
nginx -t

# 重载配置
nginx -s reload

# 查看状态
curl http://localhost/nginx_status

# 日志分析
tail -f /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -nr | head

总结

Nginx反向代理和负载均衡是构建高可用架构的核心组件。关键要点：

  • 合理选择负载均衡策略，根据业务场景决定
  • 配置健康检查，自动剔除故障节点
  • 启用SSL，保障数据传输安全
  • 优化缓存策略，减少后端压力
  • 设置限流，防止恶意攻击
📖 进阶学习：建议学习OpenResty（Nginx + Lua）、Nginx stream模块（TCP/UDP代理）、以及Nginx Plus企业版特性。

发表评论