本文详细介绍了如何在Nginx中配置静态页面和图片，实现动静分离，并设置了缓存策略。同时涵盖了跨域访问的多种配置方法，包括通配符允许、多域名管理和复杂请求控制。
1.nginx(静态页面，图片分离)
#vi /usr/local/nginx/conf/nginx.conf
user nginx nginx;
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
upstream webservs {
server 172.16.100.6 weight=1;
server 172.16.100.7 weight=1;
}
server {
listen 8082;
server_name localhost;
index index.html index.htm index.php;
rewrite ^/$ /zabbix/index.php permanent;
location / {
proxy_pass webservs;
proxy_set_header X-Real-IP $remote_addr;
}
location /zabbix {
root /var/www;
fastcgi_pass 127.0.0.1:8000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
#配置Nginx动静分离，定义的静态页面直接从zabbix发布目录读取（root /opt/nginx-1.4.7/html/resources;）。
location ~* ^/zabbix/.+\.(ico|gif|jpg|jpeg|html|htm|png|css|bmp|js|svg)$ {
root /var/www;
#expires定义用户浏览器缓存的时间为7天，如果静态页面不常更新，可以设置更长，这样可以节省带宽和缓解服务器的压力
expires 7d;
}
#配置静态图片页面
location ~ .*\.(gif|jpg|jpeg|png)$ {
expires 24h; #设置浏览器过期时间
root /home/picimages/; #指定图片存放路径
access_log /usr/local/nginx/logs/picimages.log; #图片日志路径
proxy_store on; #开启缓存机制
proxy_store_access user:rw group:rw all:rw; #缓存读写规则
proxy_temp_path /home/picimages/; #代理临时路径
proxy_redirect off;
proxy_set_header Host 127.0.0.1;
client_max_body_size 10m;
client_body_buffer_size 1280k;
proxy_connect_timeout 900;
proxy_send_timeout 900;
proxy_read_timeout 900;
proxy_buffer_size 40k;
proxy_buffers 40 320k;
proxy_busy_buffers_size 640k;
proxy_temp_file_write_size 640k;
if ( !-e $request_filename) ##正则表达式，匹配缓存目录中的文件与源文件是否存在,当访问的文件和目录不存在时，重定向到某个网站地址或文件
proxy_pass http://127.0.0.1:8082; #代理访问地址
}
}
location /citizen {
proxy_pass http://172.28.3.103:9081;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host:$server_port;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
}
详解说明：
其中配置静态图片页面
proxy_store on 启用缓存到本地的功能，
proxy_temp_path 指定缓存在哪个目录下，如：proxy_temp_path /var/nginx_cache;
在经过上一步配置之后，虽然文件被缓存到了本地磁盘上，但每次请求仍会向远端拉取文件，为了避免去远端拉取文件，还必须增加：
if ( !-e $request_filename) {
proxy_pass http://127.0.0.1:8082;
}
即改成有条件地去执行proxy_pass，这个条件就是当请求的文件在本地的proxy_temp_path指定的目录下不存在时，再向后端拉取。
$request_filename变量指的就是请求的资源路径
正则表达式：
= 开头表示精确匹配
^~ 开头表示uri以某个常规字符串开头，不是正则匹配
~ 开头表示区分大小写的正则匹配;
~* 开头表示不区分大小写的正则匹配
/ 通用匹配, 如果没有其它匹配,任何请求都会匹配到
flag标志位
last : 相当于Apache的[L]标记，表示完成rewrite
break : 停止执行当前虚拟主机的后续rewrite指令集
redirect : 返回302临时重定向，地址栏会显示跳转后的地址
permanent : 返回301永久重定向，地址栏会显示跳转后的地址
因为301和302不能简单的只返回状态码，还必须有重定向的URL，这就是return指令无法返回301,302的原因了。这里 last 和 break 区别有点难以理解：
last一般写在server和if中，而break一般使用在location中
last不终止重写后的url匹配，即新的url会再从server走一遍匹配流程，而break终止重写后的匹配
break和last都能组织继续执行后面的rewrite指令
if指令与全局变量
if判断指令
语法为if(condition){...}，对给定的条件condition进行判断。如果为真，大括号内的rewrite指令将被执行，if条件(conditon)可以是如下任何内容：
当表达式只是一个变量时，如果值为空或任何以0开头的字符串都会当做false
直接比较变量和内容时，使用=或!=
~正则表达式匹配，~*不区分大小写的匹配，!~区分大小写的不匹配
-f和!-f用来判断是否存在文件
-d和!-d用来判断是否存在目录
-e和!-e用来判断是否存在文件或目录
-x和!-x用来判断文件是否可执行
常用正则
. ： 匹配除换行符以外的任意字符
? ： 重复0次或1次
+ ： 重复1次或更多次
* ： 重复0次或更多次
\d ：匹配数字
^ ： 匹配字符串的开始
$ ： 匹配字符串的介绍
{n} ： 重复n次
{n,} ： 重复n次或更多次
[c] ： 匹配单个字符c
[a-z] ： 匹配a-z小写字母的任意一个
小括号()之间匹配的内容，可以在后面通过$1来引用，$2表示的是前面第二个()里的内容。正则里面容易让人困惑的是\转义特殊字符。
2.允许跨域
server {
listen 9880;
server_name localhost;
location /alarm/ {
root D:/work;
autoindex on;
add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Headers X-Requested-With;
add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
}
}
3.允许指定域名跨域访问
方案1 *：通配符，全部允许，存在安全隐患(不推荐)。
一旦启用本方法，表示任何域名皆可直接跨域请求：
server {
...
location / {
# 允许 所有头部 所有域 所有方法
add_header 'Access-Control-Allow-Origin' '*';
add_header 'Access-Control-Allow-Headers' '*';
add_header 'Access-Control-Allow-Methods' '*';
# OPTIONS 直接返回204
if ($request_method = 'OPTIONS') {
return 204;
}
}
...
}方案2：多域名配置(推荐)
配置多个域名在map中 只有配置过的允许跨域：
map $http_origin $corsHost {
default 0;
"~https://zzzmh.cn" https://zzzmh.cn;
"~https://chrome.zzzmh.cn" https://chrome.zzzmh.cn;
"~https://bz.zzzmh.cn" https://bz.zzzmh.cn;
}
server {
...
location / {
# 允许 所有头部 所有$corsHost域 所有方法
add_header 'Access-Control-Allow-Origin' $corsHost;
add_header 'Access-Control-Allow-Headers' '*';
add_header 'Access-Control-Allow-Methods' '*';
# OPTIONS 直接返回204
if ($request_method = 'OPTIONS') {
return 204;
}
}
...
}单域名配置
server
{
listen 80;
server_name corssingle.linuxds.com;
location /
{
root /usr/share/nginx/corssingle;
index index.html index.htm;
access_log /var/log/nginx/corssingle.access.log main;
error_log /var/log/nginx/corssingle.error.log warn;
#proxy_pass http://source01.odocker.com;
add_header 'Access-Control-Allow-Origin' 'http://source01.odocker.com';
add_header 'Access-Control-Allow-Credentials' 'true';
add_header 'Access-Control-Max-Age' 86400;
add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,X-Requested-With';
add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS';
}
}多域名配置方法一
1 [root@nginx01 ~]# vi /etc/nginx/conf.d/corsmulti01.conf
2 map $http_origin $corsHost {
3 default 0;
4 "~http://source01.odocker.com" http://source01.odocker.com;
5 "~http://source02.odocker.com" http://source02.odocker.com;
6 }
7 server {
8 listen 80;
9 server_name corsmulti01.linuxds.com;
10 location /
11 {
12 if ($request_method = 'OPTIONS') {
13 return 204;
14 }
15 root /usr/share/nginx/corsmulti01;
16 index index.html index.htm;
17 access_log /var/log/nginx/corsmulti01.access.log main;
18 error_log /var/log/nginx/corsmulti01.error.log warn;
19
20 add_header 'Access-Control-Allow-Origin' $corsHost;
21 add_header 'Access-Control-Max-Age' 86400;
22 add_header 'Access-Control-Allow-Credentials' 'true';
23 add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,X-Requested-With';
24 add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS';
25
26 }
27 }多域名配置方法二
1 [root@nginx01 ~]# vi /etc/nginx/conf.d/corsmulti02.conf
2 server {
3 listen 80;
4 server_name corsmulti02.linuxds.com;
5 location /
6 {
7 root /usr/share/nginx/corsmulti02;
8 index index.html index.htm;
9 access_log /var/log/nginx/corsmulti02.access.log main;
10 error_log /var/log/nginx/corsmulti02.error.log warn;
11 set $cors '';
12 if ($http_origin ~* 'https?://(localhost|source01\.odocker\.com|source01\.odocker\.com)') {
13 set $cors 'true';
14 }
15
16 if ($cors = 'true') {
17 add_header 'Access-Control-Allow-Origin' "$http_origin";
18 add_header 'Access-Control-Allow-Credentials' 'true';
19 add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS';
20 add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With';
21 }
22
23 if ($request_method = 'OPTIONS') {
24 return 204;
25 }
26 }
27 }多域名配置方法三
1 [root@nginx01 ~]# vi /etc/nginx/conf.d/corsmulti03.conf
2 server {
3 listen 80;
4 server_name corsmulti03.linuxds.com;
5 location /
6 {
7 root /usr/share/nginx/corsmulti03;
8 index index.html index.htm;
9 access_log /var/log/nginx/corsmulti03.access.log main;
10 error_log /var/log/nginx/corsmulti03.error.log warn;
11 if ( $http_origin ~ http://(.*).odocker.com){
12 set $allow_url $http_origin;
13 }
14 #CORS(Cross Orign Resource-Sharing)跨域控制配置
15 add_header 'Access-Control-Allow-Credentials' 'true'; #是否允许请求带有验证信息
16 add_header 'Access-Control-Allow-Origin' "$allow_url"; #允许跨域访问的域名,可以是一个域的列表，也可以是通配符*
17 add_header 'Access-Control-Allow-Headers' 'x-requested-with,content-type,Cache-Control,Pragma,Date,x-timestamp'; #允许脚本访问的返回头
18 add_header 'Access-Control-Allow-Methods' 'POST,GET,OPTIONS,PUT,DELETE'; #允许使用的请求方法，以逗号隔开
19 add_header 'Access-Control-Expose-Headers' 'WWW-Authenticate,Server-Authorization'; #允许自定义的头部，以逗号隔开,大小写不敏感
20 add_header P3P 'policyref="/w3c/p3p.xml", CP="NOI DSP PSAa OUR BUS IND ONL UNI COM NAV INT LOC"'; #P3P支持跨域cookie操作
21 }
22 }复杂请求配置
1 [root@nginx01 ~]# vi /etc/nginx/conf.d/corscomplex.conf
2 server
3 {
4 listen 80;
5 server_name corscomplex.linuxds.com;
6 location /
7 {
8 root /usr/share/nginx/corscomplex;
9 index index.html index.htm;
10 access_log /var/log/nginx/corscomplex.access.log main;
11 error_log /var/log/nginx/corscomplex.error.log warn;
12 #proxy_pass http://source01.odocker.com;
13
14 add_header Cache-Control private;
15 add_header 'Access-Control-Allow-Origin' 'http://source01.odocker.com';
16 add_header 'Access-Control-Allow-Credentials' 'true';
17 add_header 'Access-Control-Max-Age' 86400;
18 add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS';
19 add_header 'Access-Control-Allow-Headers' 'DNT,Content-Type,Cache-Control,User-Agent,Keep-Alive,Authorization,Accept,X-Mx-ReqToken,Origin,X-Requested-With,X-CustomHeader,If-Modified-Since,Cache-Control,If-Modified-Since';
20 if ($request_method = 'OPTIONS') {
21 add_header 'Access-Control-Allow-Origin' 'http://source01.odocker.com';
22 add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS,PUT,DELETE';
23 return 204;
24 }
25 }
26 }区分请求跨域一
1 server
2 {
3 listen 80;
4 server_name multireq01.linuxds.com;
5 root root /usr/share/nginx/multireq01;
6 access_log /var/log/nginx/multireq01.access.log main;
7 error_log /var/log/nginx/multireq01.error.log warn;
8 location /
9 {
10 if ($request_method = 'OPTIONS') {
11 add_header 'Access-Control-Allow-Origin' '*';
12 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
13 add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
14 add_header 'Access-Control-Max-Age' 1728000;
15 add_header 'Content-Type' 'text/plain charset=UTF-8';
16 add_header 'Content-Length' 0;
17 return 204;
18 }
19 if ($request_method = 'POST') {
20 add_header 'Access-Control-Allow-Origin' '*';
21 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
22 add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
23 }
24 if ($request_method = 'GET') {
25 add_header 'Access-Control-Allow-Origin' '*';
26 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
27 add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
28 }
29 }
30 }区分请求跨域二
1 server
2 {
3 listen 80;
4 server_name multireq02.linuxds.com;
5 root root /usr/share/nginx/multireq02;
6 access_log /var/log/nginx/multireq02.access.log main;
7 error_log /var/log/nginx/multireq02.error.log warn;
8 location /
9 {
10 if ($request_method = 'OPTIONS') {
11 add_header 'Access-Control-Allow-Origin' 'https://docs.domain.com';
12 add_header 'Access-Control-Allow-Credentials' 'true';
13 add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS';
14 add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,token';
15 return 204;
16 }
17 if ($request_method = 'POST') {
18 add_header 'Access-Control-Allow-Origin' 'https://docs.domain.com';
19 add_header 'Access-Control-Allow-Credentials' 'true';
20 add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS';
21 add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,token';
22 }
23 if ($request_method = 'GET') {
24 add_header 'Access-Control-Allow-Origin' 'https://docs.domain.com';
25 add_header 'Access-Control-Allow-Credentials' 'true';
26 add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS';
27 add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,token';
28 }
29 }
30 }
扫一扫
5225
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
