Nginx反向代理、负载均衡配置详解

· 阅读约需29分钟

前言

Nginx作为高性能的Web服务器和反向代理软件，凭借其轻量级、高并发、低资源消耗的特点，已成为现代Web架构中的核心组件。无论是静态资源服务、反向代理还是负载均衡，Nginx都能提供稳定高效的解决方案。本文将从基础到进阶，详细讲解Nginx反向代理与负载均衡的配置方法，包含可直接复制使用的配置模板。

一、Nginx基础配置

1.1 核心配置文件结构

Nginx的主配置文件通常位于/etc/nginx/nginx.conf，采用模块化的配置结构：

# 全局配置
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

# 事件模块
events {
    worker_connections 10240;
    use epoll;
    multi_accept on;
}

# HTTP模块
http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    # 日志格式
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    # 核心参数
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    client_max_body_size 20m;

    # Gzip压缩
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml text/javascript
               application/json application/javascript application/xml+rss;

    # 包含子配置文件
    include /etc/nginx/conf.d/*.conf;
}

1.2 基础性能优化参数

# worker进程数，建议设为CPU核心数
worker_processes auto;

# 单个worker进程最大连接数
worker_connections 10240;

# 隐藏Nginx版本号
server_tokens off;

# 客户端请求头超时时间
client_header_timeout 10s;

# 客户端请求体超时时间
client_body_timeout 10s;

# 发送响应超时时间
send_timeout 10s;

二、反向代理配置详解

2.1 基础反向代理配置

反向代理是Nginx最常用的功能之一，可将请求转发到后端服务：

server {
    listen 80;
    server_name example.com;

    location / {
        # 转发到后端服务
        proxy_pass http://127.0.0.1:8080;

        # 设置请求头
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 超时设置
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;

        # 缓冲区设置
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 4k;
        proxy_busy_buffers_size 8k;
    }
}

2.2 常用代理参数说明

参数作用推荐值
proxy_set_header设置转发到后端的请求头根据需要设置
proxy_connect_timeout连接后端超时时间30s
proxy_read_timeout读取后端响应超时时间30s
proxy_send_timeout发送请求到后端超时时间30s
proxy_buffering是否开启响应缓冲on
proxy_redirect重写后端返回的重定向地址default

2.3 静态资源分离配置

将静态资源直接由Nginx处理，动态请求转发到后端：

server {
    listen 80;
    server_name example.com;
    root /var/www/html;

    # 静态资源直接返回
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|eot)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    # 动态请求转发到后端
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

三、负载均衡配置详解

3.1 负载均衡基础配置

Nginx通过upstream模块定义后端服务器池，实现负载均衡：

# 定义后端服务器池
upstream backend_servers {
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://backend_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

3.2 负载均衡策略

轮询（默认）

按时间顺序逐一分配到不同的后端服务器：

upstream backend_servers {
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
}

加权轮询

权重越高，被分配的请求越多：

upstream backend_servers {
    server 192.168.1.10:8080 weight=3;
    server 192.168.1.11:8080 weight=2;
    server 192.168.1.12:8080 weight=1;
}

IP哈希（ip_hash）

按访问IP的hash结果分配，同一IP固定访问同一后端服务器，解决session问题：

upstream backend_servers {
    ip_hash;
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
}

最少连接（least_conn）

优先分配给连接数最少的后端服务器：

upstream backend_servers {
    least_conn;
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
}

最短响应时间（fair）

按后端响应时间分配，需要第三方模块：

upstream backend_servers {
    fair;
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
}

3.3 服务器状态参数

upstream backend_servers {
    # 正常服务器
    server 192.168.1.10:8080 weight=3 max_fails=3 fail_timeout=30s;

    # 备份服务器，其他服务器都不可用时才启用
    server 192.168.1.11:8080 backup;

    # 标记为不可用
    server 192.168.1.12:8080 down;

    # 永远不可用，用于调试
    server 192.168.1.13:8080 max_conns=100;
}

参数说明：

  • weight：权重，默认1
  • max_fails：允许请求失败的次数，默认1
  • fail_timeout：失败后暂停服务的时间，默认10秒
  • backup：备份服务器
  • down：标记服务器永久不可用
  • max_conns：限制最大连接数

四、高级配置

4.1 缓存配置

Nginx可缓存后端响应，减轻后端压力：

# 定义缓存区域
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m 
                 max_size=1g inactive=7d use_temp_path=off;

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://backend_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;

        # 启用缓存
        proxy_cache my_cache;
        proxy_cache_valid 200 304 12h;
        proxy_cache_valid 301 1d;
        proxy_cache_valid any 1m;
        proxy_cache_key $host$uri$is_args$args;

        # 添加缓存状态头
        add_header X-Cache-Status $upstream_cache_status;
    }
}

4.2 SSL/HTTPS配置

server {
    listen 443 ssl http2;
    server_name example.com;

    # SSL证书配置
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;

    # SSL优化
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # HSTS
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        proxy_pass http://backend_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# HTTP重定向到HTTPS
server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

4.3 WebSocket代理配置

location /ws {
    proxy_pass http://backend_servers;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_read_timeout 3600s;
}

五、完整生产环境配置示例

5.1 完整配置文件

# /etc/nginx/conf.d/example.com.conf

# 后端服务器池
upstream app_backend {
    least_conn;
    server 192.168.1.10:8080 weight=2 max_fails=3 fail_timeout=30s;
    server 192.168.1.11:8080 weight=2 max_fails=3 fail_timeout=30s;
    server 192.168.1.12:8080 weight=1 max_fails=3 fail_timeout=30s;
    server 192.168.1.13:8080 backup;
}

# 缓存配置
proxy_cache_path /var/cache/nginx/app_cache levels=1:2 
                 keys_zone=app_cache:50m max_size=2g inactive=7d;

# HTTP重定向
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

# HTTPS主配置
server {
    listen 443 ssl http2;
    server_name example.com;

    # SSL配置
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # 安全头
    add_header X-Frame-Options SAMEORIGIN always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # 静态资源
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2?|ttf|eot|svg)$ {
        root /var/www/example.com/static;
        expires 30d;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    # 动态请求
    location / {
        proxy_pass http://app_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;

        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 60s;

        proxy_buffering on;
        proxy_buffer_size 8k;
        proxy_buffers 16 8k;

        # 缓存配置
        proxy_cache app_cache;
        proxy_cache_valid 200 304 1h;
        proxy_cache_valid 404 1m;
        proxy_cache_key $host$uri$is_args$args;
        add_header X-Cache-Status $upstream_cache_status;
    }

    # WebSocket
    location /ws {
        proxy_pass http://app_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
    }
}

六、常用运维命令

# 检查配置文件语法
nginx -t

# 重新加载配置（平滑重启）
nginx -s reload

# 快速停止
nginx -s stop

# 优雅停止
nginx -s quit

# 重新打开日志文件
nginx -s reopen

# 查看版本
nginx -v

# 查看编译参数
nginx -V

# 查看连接状态
netstat -anp | grep nginx | wc -l

总结

Nginx的反向代理和负载均衡功能强大且灵活，通过合理配置可以显著提升系统的可用性和性能。本文从基础配置到高级应用，涵盖了生产环境中常用的配置场景。建议根据实际业务需求选择合适的负载均衡策略，结合缓存、SSL等功能构建完整的Web服务架构。

掌握Nginx配置是运维和后端开发的必备技能，建议在测试环境充分验证后再应用到生产环境，并配合监控系统实时关注Nginx运行状态。