一、nginx部署必要的依赖性安装[rootserver1 ~]# yum install -y gcc pcre-devel openssl-devel[rootserver1 ~]# wget https://nginx.org/download/nginx-1.30.0.tar.gz[rootserver1 ~]# tar zxf nginx-1.30.0.tar.gz[rootserver1 ~]# cd nginx-1.30.0/[rootserver1 nginx-1.30.0]# vim auto/cc/gcc关闭调试模式安装加密、状态监控模块自行安装需要的其他模块[rootserver1 nginx-1.30.0]# ./configure --help查看需要的模块[rootserver1 nginx-1.30.0]# ./configure --with-http_ssl_module --with-http_stub_status_module[rootserver1 nginx-1.30.0]# make make install做软连接方便访问[rootserver1 nginx-1.30.0]# ln -s /usr/local/nginx/sbin/nginx /usr/local/sbin/[rootserver1 nginx-1.30.0]# nginx -t[rootserver1 nginx-1.30.0]# nginx设置开机自启浏览器访问nginx systemd site:nginx.org找到开机自启脚本[Unit]DescriptionNginx HTTP ServerAfternetwork.target[Service]TypeforkingExecStart/usr/local/nginx/sbin/nginxExecReload/usr/local/nginx/sbin/nginx -s reloadExecStop/usr/local/nginx/sbin/nginx -s quitPIDFile/usr/local/nginx/logs/nginx.pidRestarton-failure[Install]WantedBymulti-user.target修改配置文件[rootserver1 nginx-1.30.0]# vim /etc/systemd/system/nginx.service[rootserver1 nginx-1.30.0]# nginx -s reload[rootserver1 nginx-1.30.0]# nginx -s stop[rootserver1 nginx-1.30.0]# systemctl enable --now nginx[rootserver1 ~]# curl -I localhost1、nginx平滑升级目的升级时外部访问不断联1.1平滑升级确保nginx进程开启[rootserver1 ~]# ps ax[rootserver1 ~]# wget https://nginx.org/download/nginx-1.30.4.tar.gz保证配置与nginx-1.30.0一致区别在于nginx-1.30.4执行[rootserver1 nginx-1.30.4]# ./configure --with-http_ssl_module --with-http_stub_status_module后只进行编译make不进行安装make install备份用来回退[rootserver1 nginx-1.30.4]# cd /usr/local/nginx/sbin/[rootserver1 sbin]# cp nginx nginx.bak原进程正在进行使用强制覆盖[rootserver1 sbin]# cd[rootserver1 ~]# cd nginx-1.30.4/objs/[rootserver1 objs]# cp -f nginx /usr/local/nginx/sbin/nginx[rootserver1 objs]# ps ax|grep nginx关闭旧进程唤醒新进程[rootserver1 objs]# kill -USR2 8089[rootserver1 objs]# ps ax|grep nginx此时新、旧进程都在响应[rootserver1 objs]# curl -I localhost关闭但是保留旧进程为了回退[rootserver1 objs]# kill -WINCH 8089唤醒原进程[rootserver1 objs]# cd /usr/local/nginx/sbin/[rootserver1 sbin]# cp -f nginx.bak nginx[rootserver1 sbin]# kill -HUP 8089回收新进程[rootserver1 sbin]# kill -WINCH 13676[rootserver1 sbin]# kill -QUIT 136761.2隐藏nginx版本信息[rootserver1 sbin]# nginx -s stop[rootserver1 sbin]# cd[rootserver1 ~]# cd nginx-1.30.4/删去nginx版本信息[rootserver1 nginx-1.30.4]# vim src/core/nginx.h[rootserver1 nginx-1.30.4]# make clean[rootserver1 nginx-1.30.4]# ./configure --with-http_ssl_module --with-http_stub_status_module[rootserver1 nginx-1.30.4]# make[rootserver1 nginx-1.30.4]# cd objs/[rootserver1 objs]# cp -f nginx /usr/local/nginx/sbin/nginx[rootserver1 objs]# systemctl stop nginx[rootserver1 objs]# nginx[rootserver1 objs]# curl -I localhost2、nginx并发优化目的提升服务性能2.1nginx进程与cpu核心绑定[rootserver1 ~]# cd /usr/local/nginx/conf/[rootserver1 conf]# lscpu[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -s reload[rootserver1 conf]# ps ax|grep nginxworker数与cpu数保持一致[rootserver1 conf]# vim nginx.conf1个进程绑定1个核心避免混乱2.2修改nginx并发连接数[rootserver1 conf]# vim nginx.conf作为反向代理服务器时除以2查看内核参数与内存相关自动配置[rootserver1 conf]# sysctl -a |grep file[rootserver1 conf]# ulimit -a为了限制nginx现在创建用户组nginx对用户组做限制就是限制nginx[rootserver1 ~]# useradd -M -d /usr/local/nginx/ nginx[rootserver1 ~]# usermod -s /sbin/nologin nginx[rootserver1 ~]# vim /usr/local/nginx/conf/nginx.conf[rootserver1 ~]# nginx -s stop[rootserver1 ~]# nginx -t[rootserver1 ~]# nginx修改系统限制[rootserver1 ~]# vim /etc/security/limits.conf改完立即生效修改Linux下最大连接数所受的各种限制[rootserver1 ~]# sysctl -a|grep net.ipv4.ip_local_port_range[rootserver1 ~]# cd /etc/sysctl.d/[rootserver1 sysctl.d]# vim nginx.conf[rootserver1 sysctl.d]# sysctl --system开启文件高效传输模式防止网路和磁盘IO堵塞[rootserver1 ~]# vim /usr/local/nginx/conf/nginx.conf[rootserver1 ~]# nginx -s reload可以在其他机器上对server1进行压力测试[rootserver2 ~]# ab -c 10 -n 5000 http://server1/inde.html二、nginx服务管理1、负载均衡[rootserver1 ~]# cd /usr/local/nginx/conf[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -t[rootserver1 conf]# nginx -s reload[rootserver4 ~]# vim /etc/hosts[rootserver4 ~]# curl www.westos.orgnginx自带健康检测功能备用机调度注意第一个server为主机设置localhost为第一个主机否则自我访问时将一直消耗资源卡死算法使用ip_hash同一客户端IP访问永远分配同一后端RS注意注释掉backupstisky cookies配置完成后进入浏览器访问www.westos.org调用F12查看cookies2、模块编译第三方模块追求性能使用静态3、控制3.1限制并发连接数[rootserver1 ~]# cd /usr/local/nginx/conf/[rootserver1 conf]# vim nginx.conf注意参数位置默认发布目录[rootserver1 conf]# mkdir /usr/local/nginx/html/download[rootserver1 conf]# cd /usr/local/nginx/html/download放一个几百Kb文件[rootserver1 download]# lsvim.jpg注意单线程下载超出的并发连接会失败[rootserver4 ~]# ab -c 10 -n 10 http://192.168.164.132/download/vim.jpg[rootserver1 ~]# tail -f /usr/local/nginx/logs/access.log[rootserver4 ~]# ab -c 1 -n 10 http://192.168.164.132/download/vim.jpg3.2限制请求数[rootserver1 ~]# cd /usr/local/nginx/conf/[rootserver1 conf]# vim nginx.conf[rootserver4 ~]# ab -c 1 -n 10 http://192.168.164.132/download/vim.jpg[rootserver1 conf]# tail -f /usr/local/nginx/logs/access.log3.3限制速率[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -s reload测试[rootserver4 ~]# ab -c 1 -n 5 http://192.168.164.132/download/vim.jpg4、自动索引[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -s reload测试5、缓存配置[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -s reload测试[rootserver4 ~]# curl -I http://192.168.164.132/download/vim.jpg返回Expires缓存头6、禁用日志记录[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -s reload7、日志轮转[rootserver1 conf]# cd[rootserver1 ~]# vim /opt/nginx_log.sh编写脚本[rootserver1 ~]# chmod x /opt/nginx_log.sh手动测试[rootserver1 ~]# /opt/nginx_log.sh[rootserver1 ~]# cd /usr/local/nginx/logs/[rootserver1 logs]# ls[rootserver1 logs]# cd定时任务 crontab[rootserver1 ~]# crontab -e8、nginx日志可视化[rootserver1 ~]# wget https://tar.goaccess.io/goaccess-1.8.tar.gz[rootserver1 ~]# tar xf goaccess-1.8.tar.gz[rootserver1 ~]# cd goaccess-1.8/[rootserver1 ~]# yum install -y ncurses-devel GeoIP-devel[rootserver1 goaccess-1.8]# ./configure --enable-utf8 --enable-geoiplegacy[rootserver1 goaccess-1.8]# make make install[rootserver1 ~]# goaccess /usr/local/nginx/logs/access.log -o /usr/local/nginx/html/report.html --log-formatCOMBINED --real-time-html 测试[rootserver4 ~]# ab -n 10000 -c 100 http://192.168.164.132/访问http://192.168.164.132/report.html9、站点限制[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -s reload[rootserver1 conf]# curl localhost/status10、中文乱码[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -s reload测试访问http://192.168.164.132/index.html11、虚拟主机[rootserver1 conf]# cd ..[rootserver1 nginx]# mkdir /www1/[rootserver1 nginx]# echo web1 /www1/index.html[rootserver1 nginx]# vim conf/nginx.conf[rootserver1 nginx]# nginx -s reload测试[rootserver4 ~]# vim /etc/hosts192.168.164.132 server1 www1.westos.org[rootserver4 ~]# curl www1.westos.orgweb112、https配置[rootserver1 nginx]# cd conf/[rootserver1 conf]# cd /etc/pki/tls/certs[rootserver1 certs]# make cert.pem[rootserver1 certs]# mv cert.pem /usr/local/nginx/conf/[rootserver1 certs]#cd /usr/local/nginx/conf/[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -s reload测试[rootserver4 ~]# curl -k https://www1.westos.org13、重定向把80重定向到443[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -s reload测试[rootserver4 ~]# curl -I www1.westos.org/index.html[rootserver4 ~]# curl -I www1.westos.org/index.html把www1.westos.org/bbs 重定向bbs.westos.org[rootserver1 conf]# mkdir /bbs[rootserver1 conf]# echo bbs.westos.org /bbs/index.html[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -s reload测试[rootserver4 ~]# curl -I www1.westos.org/bbs[rootserver4 ~]# curl -I www1.westos.org/bbs/index.html14、防盗链server2盗链server1内容[rootserver2 ~]# cd /var/www/html/[rootserver2 html]# vim index.htmlserver1配置nginx网页防盗链[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -s reload三、php部署1、php安装浏览器下载php-8.3.32.tar.gz[rootserver1 ~]# tar zxf php-8.3.32.tar.gz[rootserver1 ~]# cd php-8.3.32/[rootserver1 php-8.3.32]# useradd -M -d /usr/local/php -s /sbin/nologin www[rootserver1 php-8.3.32]# ./configure --prefix/usr/local/php --with-config-file-path/usr/local/php/etc --enable-fpm --with-fpm-userwww --with-fpm-groupwww --enable-cli --enable-opcache --enable-mysqlnd --with-mysqlimysqlnd --with-pdo-mysqlmysqlnd --enable-mbstring --enable-xml --enable-gd --with-zip --with-curl --with-jpeg --with-freetype --with-openssl --enable-bcmath --enable-soap --enable-sockets --enable-exif --with-readline --with-zliberror需要全部解决[rootserver1 php-8.3.32]# yum search libxml[rootserver1 php-8.3.32]# yum list libxml2-devel[rootserver1 php-8.3.32]# yum install -y libxml2-devel[rootserver1 php-8.3.32]# yum install -y sqlite-devel[rootserver1 php-8.3.32]# yum install -y libcurl-devel[rootserver1 php-8.3.32]# yum install -y libpng-devel[rootserver1 php-8.3.32]# yum install -y libjpeg-turbo-devel[rootserver1 php-8.3.32]# yum install -y freetype-devel本地仓库缺少的寻找阿里云配置新仓库[rootserver1 php-8.3.32]# wget -O /etc/yum.repos.d/epel.repo https://mirrors.aliyun.com/repo/epel-7.repo[rootserver1 php-8.3.32]# yum repolist[rootserver1 php-8.3.32]# yum install -y oniguruma-devel[rootserver1 php-8.3.32]# yum install -y readline-devel浏览器寻找libziptar.gz[rootserver1 ~]# tar zxf libzip-1.9.2.tar.gz[rootserver1 ~]# cd libzip-1.9.2/[rootserver1 libzip-1.9.2]# mkdir build cd build系统自带的cmake版本过低,需要升级[rootserver1 ~]# yum list cmake[rootserver1 ~]# yum search cmake[rootserver1 ~]# yum install -y cmake3[rootserver1 ~]# ln -s /usr/bin/cmake3 /usr/bin/cmake文件放在一个路径不分散方便指向[rootserver1 ~]# cd libzip-1.9.2/build/[rootserver1 build]# cmake -DCMAKE_INSTALL_PREFIX/usr/local/libzip DBUILD_SHARED_LIBSON ..[rootserver1 build]# yum install -y bzip2-devel[rootserver1 build]# yum install -y libzstd-devel[rootserver1 build]# cmake -DCMAKE_INSTALL_PREFIX/usr/local/libzip -DBUILD_SHARED_LIBSON ..对应内核数进行启动[rootserver1 build]make -j2[rootserver1 build]# make install创建动态链接库[rootserver1 lib64]# echo /usr/local/libzip/lib64 /etc/ld.so.conf.d/libzip.conf[rootserver1 lib64]# ldconfig[rootserver1 lib64]# export PKG_CONFIG_PATH/usr/local/libzip/lib64/pkgconfig验证[rootserver1 lib64]# pkg-config --modversion libzip返回php[rootserver1 ~]# cd php-8.3.32/[rootserver1 php-8.3.32]# ./configure --prefix/usr/local/php --with-config-file-path/usr/local/php/etc --enable-fpm --with-fpm-userwww --with-fpm-groupwww --enable-cli --enable-opcache --enable-mysqlnd --with-mysqlimysqlnd --with-pdo-mysqlmysqlnd --enable-mbstring --enable-xml --enable-gd --with-zip/usr/local/libzip --with-curl --with-jpeg --with-freetype --with-openssl --enable-bcmath --enable-soap --enable-sockets --enable-exif --with-readline --with-zlib升级openssl[rootserver1 php-8.3.32]# make -j2[rootserver1 php-8.3.32]# yum remove openssl-devel[rootserver1 ~]# tar zxf openssl-1.1.1w.tar.gz[rootserver1 ~]# cd openssl-1.1.1w/[rootserver1 openssl-1.1.1w]# ./config shared zlib --prefix/usr/local/openssl[rootserver1 openssl-1.1.1w]# make -j2[rootserver1 openssl-1.1.1w]# make install创建动态链接库[rootserver1 openssl-1.1.1w]# cd /usr/local/openssl/[rootserver1 openssl]# echo /usr/local/openssl/lib /etc/ld.so.conf.d/openssl.con[rootserver1 openssl]# ldconfig[rootserver1 openssl]# cd lib/[rootserver1 lib]# export PKG_CONFIG_PATH/usr/local/openssl/lib/pkgconfig:$PKG_CONFIG_PATH[rootserver1 lib]# pkg-config --modversion openssl返回php指定路径方便指向[rootserver1 ~]# cd php-8.3.32/[rootserver1 php-8.3.32]# ./configure --prefix/usr/local/php --with-config-file-path/usr/local/php/etc --enable-fpm --with-fpm-userwww --with-fpm-groupwww --enable-cli --enable-opcache --enable-mysqlnd --with-mysqlimysqlnd --with-pdo-mysqlmysqlnd --enable-mbstring --enable-xml --enable-gd --with-zip/usr/local/libzip --with-curl --with-jpeg --with-freetype --with-openssl/usr/local/openssl --enable-bcmath --enable-soap --enable-sockets --enable-exif --with-readline --with-zlib[rootserver1 php-8.3.32]# make -j2[rootserver1 php-8.3.32]# make install2、php配置[rootserver1 php-8.3.32]# cp php.ini-production /usr/local/php/etc/拷贝主配置文件[rootserver1 php-8.3.32]# cd /usr/local/php/etc/[rootserver1 etc]# mv php.ini-production php.ini返回php-8.3.32[rootserver1 php-8.3.32]# cd sapi/[rootserver1 sapi]# cd fpm/拷贝启动文件[rootserver1 fpm]# cp php-fpm.service /etc/systemd/system[rootserver1 fpm]# cd /etc/systemd/system/编辑启动文件[rootserver1 system]# vim php-fpm.service注释掉ProtectSystem否则影响启动[rootserver1 system]# cd /usr/local/php/etc/[rootserver1 etc]# cp php-fpm.conf.default php-fpm.conf[rootserver1 etc]# cd php-fpm.d/[rootserver1 php-fpm.d]# cp www.conf.default www.conf[rootserver1 php-fpm.d]# systemctl daemon-reload[rootserver1 php-fpm.d]# systemctl enable --now php-fpm.service检验端口9000[rootserver1 php-fpm.d]# netstat -antlp|grep :9000配置环境变量[rootserver1 php-fpm.d]# cd /usr/local/php/bin/[rootserver1 ~]# vim .bash_profile[rootserver1 ~]# source .bash_profile[rootserver1 ~]# php -v[rootserver1 ~]# php -m查看pid[rootserver1 ~]# cd /usr/local/php/etc/[rootserver1 etc]# vim php-fpm.conf默认两个进程[rootserver1 etc]# cd php-fpm.d/[rootserver1 php-fpm.d]# vim www.conf修改时区[rootserver1 php-fpm.d]# cd ..[rootserver1 etc]# vim php.ini[rootserver1 etc]# systemctl reload php-fpm.service[rootserver1 etc]# systemctl restart php-fpm.service查看pid[rootserver1 etc]# cd /usr/local/php/var/run[rootserver1 run]# cat php-fpm.pid3、nginx整合php[rootserver1 ~]# cd /usr/local/nginx/conf/[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -t[rootserver1 conf]# nginx -s reload检测[rootserver1 conf]# cd ..[rootserver1 nginx]# cd html/[rootserver1 html]# vim index.php浏览器访问192.168.164.132/index.php4、php动态扩展模块https://pecl.php.net/package/Memcache[rootserver1 ~]# tar zxf memcache-8.2.tgz[rootserver1 ~]# cd memcache-8.2/[rootserver1 memcache-8.2]# phpize[rootserver1 memcache-8.2]# yum install -y autoconf[rootserver1 memcache-8.2]# phpize[rootserver1 memcache-8.2]# ./configure[rootserver1 memcache-8.2]# make[rootserver1 memcache-8.2]# make install[rootserver1 memcache-8.2]# cd /usr/local/php/lib/php/extensions/no-debug-non-zts-20230831/[rootserver1 no-debug-non-zts-20230831]# php -m |grep memcache[rootserver1 no-debug-non-zts-20230831]# vim /usr/local/php/etc/php.ini查找编辑模块Extensions[rootserver1 no-debug-non-zts-20230831]# systemctl reload php-fpm.service[rootserver1 no-debug-non-zts-20230831]# php -m |grep memcache安装服务[rootserver1 no-debug-non-zts-20230831]# yum install -y memcached所在位置[rootserver1 no-debug-non-zts-20230831]# vim /etc/sysconfig/memcached[rootserver1 no-debug-non-zts-20230831]# systemctl enable --now memcached.service[rootserver1 no-debug-non-zts-20230831]# netstat -antlp|grep :11211拷贝文件[rootserver1 no-debug-non-zts-20230831]# cd[rootserver1 ~]# cd memcache-8.2/[rootserver1 memcache-8.2]# cp memcache.php example.php /usr/local/nginx/html/[rootserver1 memcache-8.2]# cd /usr/local/nginx/html/管理页面查看缓存命中率[rootserver1 html]# vim memcache.php测试[rootserver4 ~]# ab -c10 -n1000 http://192.168.164.132/index.php[rootserver4 ~]# ab -c10 -n1000 http://192.168.164.132/example.php四、nginx高速缓存目的访问时nginx缓存直接返回效率更高原生编译[rootserver1 ~]# cd nginx-1.30.4/[rootserver1 nginx-1.30.4]# nginx -s stop[rootserver1 nginx-1.30.4]# make clean[rootserver1 nginx-1.30.4]# cdgithub下载echo-nginx-module-master.zip、srcache-nginx-module-master.zip、memc-nginx-module-master.zip[rootserver1 ~]# unzip memc-nginx-module-master.zip[rootserver1 ~]# unzip echo-nginx-module-master.zip[rootserver1 ~]# unzip srcache-nginx-module-master.zip[rootserver1 ~]# cd nginx-1.30.4/[rootserver1 nginx-1.30.4]# nginx -V[rootserver1 nginx-1.30.4]# ./configure --with-http_ssl_module --with-http_stub_status_module --add-module../echo-nginx-module-master --add-module../memc-nginx-module-master --add-module../srcache-nginx-module-master --with-cc-opt-I/usr/local/openssl/include --with-ld-opt-L/usr/local/openssl/lib -Wl,-rpath/usr/local/openssl/lib[rootserver1 nginx-1.30.4]# make 静态编译[rootserver1 nginx-1.30.4]# cd objs/[rootserver1 objs]# nginx -V1、nginx配置高效缓存[rootserver1 conf]# vim nginx.conf[rootserver1 conf]# nginx -t[rootserver1 conf]# nginx -s reload测试[rootserver4 ~]# ab -c10 -n1000 http://192.168.164.132/index.php2、openresty部署[rootserver1 ~]# systemctl stop nginx[rootserver1 ~]# curl https://openresty.org/package/rhel/openresty.repo -o /etc/yum.repos.d/openresty.repo[rootserver1 ~]# yum install -y openresty[rootserver1 ~]# cd /usr/local/openresty/nginx/conf[rootserver1 conf]# cp /usr/local/nginx/conf/nginx.conf .[rootserver1 conf]# cp /usr/local/nginx/conf/cert.pem .[rootserver1 conf]# /usr/local/openresty/nginx/sbin/nginx -t注意启动的是openresty[rootserver1 conf]# /usr/local/openresty/nginx/sbin/nginx测试
)
