nginx配置实践

./configure \
--prefix=/usr/local/nginx \
--pid-path=/var/run/nginx.pid \
--lock-path=/var/lock/nginx.lock \
--user=nobody \
--group=nobody \
--error-log-path=/data/log/nginx/error.log \
--http-log-path=/data/log/nginx/access.log \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_realip_module \
--with-http_gzip_static_module \
--with-http_stub_status_module \
--with-pcre \
--with-file-aio \
--add-module=/usr/local/src/nginx-http-concat \
--add-module=/usr/local/src/lua-nginx-module \
--add-module=/usr/local/src/ngx_devel_kit \
--add-module=/usr/local/src/ngx_brotli \
--with-http_image_filter_module \
--with-openssl=/usr/local/src/openssl

server {
    listen 80;
    server_name www.tool.lu tool.lu;

    access_log off;
    error_log /dev/null crit;

    return 301 https://tool.lu$request_uri;
}

server {
    listen 443 ssl http2;
    server_name www.tool.lu;

    ssl_certificate vhosts/***.crt;
    ssl_certificate_key vhosts/***.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 1d;

    access_log off;
    error_log /dev/null crit;

    return 301 https://tool.lu$request_uri;
}

http {
    # ...
    brotli on;
    brotli_comp_level 6;
    brotli_buffers 16 8k;
    brotli_min_length 20;
    brotli_types *;
    # ...
}

upstream php_sever {
    server 127.0.0.1:9000 weight=10;
}

server {
    listen 443 ssl http2 reuseport; # fastopen=3
    server_name tool.lu;

    ssl_certificate ***.crt;
    ssl_certificate_key ***.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 1d;

    root /path/to/public/directory;
    index index.html index.php;

    fastcgi_intercept_errors on;
    error_page 404 /404.html;
    error_page 429 /429.html;
    # error_page 500 502 503 504 /500.html;

    access_log /data/log/nginx/tool.lu.access.log;
    error_log /data/log/nginx/tool.lu.error.log;

    add_header Content-Security-Policy upgrade-insecure-requests;
    add_header Content-Security-Policy-Report-Only "default-src *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.tool.lu *.baidu.com; object-src 'none'; style-src 'self' 'unsafe-inline' 'unsafe-eval' *.tool.lu *.baidu.com; img-src 'self' data: *.tool.lu *.href.lu *.baidu.com; media-src 'none'; child-src 'self' *.tool.lu; font-src *.tool.lu *.alicdn.com; connect-src 'self' *.tool.lu *.baidu.com *.alicdn.com; report-uri //analytics.tool.lu/csp";

    # add_header X-Frame-Options SAMEORIGIN; # coderunner embed cannot
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    # HSTS
    add_header Strict-Transport-Security max-age=15768000;

    add_header X-UA-Compatible "IE=Edge";
    add_header X-Request-Id $request_id;
    add_header X-Request-Start $msec;
    add_header X-Backend-Server $hostname;

    if ($request_method !~ ^(GET|HEAD|POST|OPTIONS)$ ) {
        return 405;
    }

    access_by_lua_file script/detect_blacklist.lua;

    location / {
        try_files $uri $uri/ /index.php$is_args$query_string;
    }

    location ~ \.php$ {
        try_files $uri =404;

        include fastcgi_params;
        fastcgi_pass php_sever;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_param DOCUMENT_ROOT $realpath_root;
        # fastcgi_param HTTP_HOST $host
    }

    location ~ /\.(ht|git|svn) {
        deny all;
    }

    location ~ ^/status$ {
        access_log off;
        allow 127.0.0.0/24;
        deny all;
        include fastcgi_params;
        fastcgi_pass php_sever;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_param DOCUMENT_ROOT $realpath_root;
    }

    location ~ ^/nginx_status$ {
        stub_status on;
    }

    # ...

}

nginx: master process
 \_ nginx: worker process
 \_ nginx: worker process
 \_ nginx: worker process
 \_ nginx: worker process