Configuration avancée de Nginx - Guide complet de l'installation aux fonctions avancées

Compilation et installation de Nginx depuis les sources

# Téléchargement du code source
wget https://nginx.org/download/nginx-1.28.1.tar.gz

# Extraction
tar zxf nginx-1.28.1.tar.gz
cd nginx-1.28.1/

# Installation des dépendances
dnf install gcc openssl-devel.x86_64 pcre2-devel.x86_64 zlib-devel -y

# Vérification de l'environnement
./configure --prefix=/usr/local/nginx --user=nginx --group=nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module

# Compilation et installation
make
make install

# Configuration des variables d'environnement
echo 'export PATH=$PATH:/usr/local/nginx/sbin' >> ~/.bash_profile
source ~/.bash_profile

# Création de l'utilisateur système et démarrage
useradd -s /sbin/nologin -M nginx
nginx

# Vérification du processus
ps aux | grep nginx

Règles de correspondance Location

2.1 Correspondance normale (sans modificateur)

server {
    listen 80;
    server_name lee.timinglee.org;
    location /null {
        return 200 "/null-1";
    }
}

Test : curl lee.timinglee.org/null/ → "/null-1"

2.2 Correspondance exacte (=)

location /null {
    return 200 "null-1";
}
location = /null {
    return 200 "null-2";
}

Test : curl lee.timinglee.org/null → "null-2" (priorité maximale)

2.3 Correspondance préfixée (^~)

location ^~ /lee {
    return 200 "lee";
}

Test : curl lee.timinglee.org/lee/test → "lee"

2.4 Correspondance regex (~)

location ~ /timing/ {
    return 200 "timing";
}

Test : curl lee.timinglee.org/a/timing/ → "timing"

2.5 Correspondance regex insensible à la casse (~*)

location ~* /timinglee {
    return 200 "timinglee";
}

Test : curl lee.timinglee.org/Timinglee/ → "timinglee"

2.6 Correspondance sur l'extension de fichier

location ~* \.(img|php|jsp)$ {
    return 200 "app";
}

Test : curl lee.timinglee.org/test.php → "app"

Authentification utilisateur

3.1 Création du fichier d'authentification

htpasswd -cmb /usr/local/nginx/conf/.htpasswd admin lee

3.2 Configuration de l'authentification

server {
    listen 80;
    server_name lee.timinglee.org;
    location /admin {
        root /usr/local/nginx/html;
        auth_basic "login passwd";
        auth_basic_user_file "/usr/local/nginx/conf/.htpasswd";
    }
}

3.3 Test

curl -uadmin:lee http://lee.timinglee.org/admin/

Pages d'erreur personnalisées

4.1 Création des répertoires

mkdir -p /usr/local/nginx/logs/timinglee.org/
mkdir -p /usr/local/nginx/errorpage/errormessage
echo "Page non trouvée" > /usr/local/nginx/errorpage/errormessage/error.html

4.2 Configuration

server {
    listen 80;
    server_name lee.timinglee.org;
    error_page 404 405 503 502 /error.html;
    error_log logs/timinglee.org/lee.error error;
    location /lee {
        root /usr/local/nginx/html;
    }
    location /error.html {
        alias /usr/local/nginx/errorpage/errormessage/error.html;
    }
}

Serveur de téléchargement de fichiers

5.1 Création du répertoire

mkdir -p /usr/local/nginx/download
cp /etc/passwd /usr/local/nginx/download/
dd if=/dev/zero of=/usr/local/nginx/download/bigfile bs=1M count=100

5.2 Configuration de base

location /download {
    root /usr/local/nginx;
}

5.3 Activation de la liste des répertoires

location /download {
    root /usr/local/nginx;
    autoindex on;
}

5.4 Limitation de la vitesse de téléchargement

location /download {
    root /usr/local/nginx;
    autoindex on;
    limit_rate 1024k;
}

5.5 Optimisation de l'affichage des tailles

location /download {
    root /usr/local/nginx;
    autoindex on;
    limit_rate 1024k;
    autoindex_exact_size off;
    autoindex_localtime on;
}

try_files - Vérification des fichiers

server {
    listen 80;
    server_name lee.timinglee.org;
    root /usr/local/nginx/errorpage;
    try_files $uri $uri.html $uri/index.html /default.html;
}

Page d'état Nginx

location /nginx_status {
    stub_status;
    auth_basic "auth login";
    auth_basic_user_file /usr/local/nginx/conf/.htpasswd;
    allow 172.25.254.0/24;
    deny all;
}

Test : curl -uadmin:lee lee.timinglee.org/nginx_status

Compression Gzip

# Dans nginx.conf
gzip on;
gzip_comp_level 4;
gzip_min_length 1024k;
gzip_types text/plain application/javascript text/css application/xml image/png;
gzip_vary on;
gzip_static on;

Variables Nginx

9.1 Installation du module echo

./configure --prefix=/usr/local/nginx ... --add-module=/root/echo-nginx-module-0.64
make && make install

9.2 Utilisation des variables

location /vars {
    default_type text/html;
    echo "remote_addr: $remote_addr";
    echo "args: $args";
    echo "host: $host";
    echo "request_uri: $request_uri";
}

Proxy inverse de base

server {
    listen 80;
    server_name lee.timinglee.org;
    location / {
        proxy_pass http://192.168.58.10:80;
    }
    location /web {
        proxy_pass http://192.168.58.20:80;
    }
}

Configuration avancée du proxy inverse

11.1 Masquage des en-têtes

proxy_hide_header ETag;

11.2 Transmission des en-têtes

proxy_pass_header Server;

11.3 Transmission de l'adresse IP du client

proxy_set_header X-Forwarded-For $remote_addr;

Séparation statique/dynamique

location / {
    proxy_pass http://192.168.58.20:80;
}
location ~* \.(php|js)$ {
    proxy_pass http://192.168.58.10:80;
}

Accélération par cache

# Dans nginx.conf
proxy_cache_path /usr/local/nginx/proxy_cache levels=1:2:2 keys_zone=proxycache:20m inactive=120s max_size=1g;

# Utilisation
proxy_cache proxycache;
proxy_cache_key $request_uri;
proxy_cache_valid 200 302 301 10m;
proxy_cache_valid any 1m;

Équilibrage de charge

upstream webserver {
    server 192.168.58.10:80 weight=1 fail_timeout=15s max_fails=3;
    server 192.168.58.20:80 weight=1 fail_timeout=15s max_fails=3;
    server 192.168.58.3:8888 backup;
}

server {
    listen 80;
    server_name www.timinglee.org;
    location / {
        proxy_pass http://webserver;
    }
}

Algorithmes d'équilibrage

Round Robin (par défaut)

upstream webserver {
    server 192.168.58.10:80;
    server 192.168.58.20:80;
}

IP Hash

upstream webserver {
    ip_hash;
    server 192.168.58.10:80;
    server 192.168.58.20:80;
}

Least Connections

upstream webserver {
    least_conn;
    server 192.168.58.10:80;
    server 192.168.58.20:80;
}

Hash URI

upstream webserver {
    hash $request_uri consistent;
    server 192.168.58.10:80;
    server 192.168.58.20:80;
}

Hash Cookie

upstream webserver {
    hash $cookie_lee;
    server 192.168.58.10:80;
    server 192.168.58.20:80;
}

Compilation de PHP depuis les sources

./configure \
--prefix=/usr/local/php \
--with-config-file-path=/usr/local/php/etc \
--enable-fpm \
--with-fpm-user=nginx \
--with-fpm-group=nginx \
--with-curl \
--with-openssl \
--enable-mysqlnd \
--with-mysqli \
--with-pdo-mysql \
--disable-debug \
--enable-sockets \
--enable-soap \
--enable-xml \
--enable-mbstring \
--enable-bcmath \
--with-fpm-systemd

make && make install

Intégration Nginx avec PHP

server {
    listen 80;
    server_name php.timinglee.org;
    root /webdir/timinglee.org/php/html;
    location ~ \.php$ {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        include fastcgi.conf;
    }
}

Cache Memcache (couche PHP)

18.1 Installation

dnf install memcached -y
systemctl enable --now memcached

# Extension PHP
cd /root/php-8.3.30/ext/memcache
/usr/local/php/bin/phpize
./configure --with-php-config=/usr/local/php/bin/php-config
make && make install

18.2 Configuration

# Dans php.ini
extension=memcache.so
session.save_handler = memcache
session.save_path = "tcp://127.0.0.1:11211"

Équilibrage de charge couche 4 (Stream)

19.1 MySQL Load Balancing

stream {
    upstream mysql_backend {
        server 192.168.58.10:3306 weight=5;
        server 192.168.58.20:3306 weight=5;
    }
    server {
        listen 3306;
        proxy_pass mysql_backend;
        proxy_connect_timeout 1s;
        proxy_timeout 3s;
    }
}

19.2 Redis Load Balancing

stream {
    upstream redis_backend {
        server 192.168.58.10:6379 weight=5;
        server 192.168.58.20:6379 weight=5;
    }
    server {
        listen 6379;
        proxy_pass redis_backend;
        proxy_connect_timeout 1s;
        proxy_timeout 3s;
    }
}

Paramètres de configuraton courants

Paramètres globaux

worker_processes auto;
worker_connections 1024;
use epoll;
accept_mutex on;
multi_accept on;

Paramètres HTTP

keepalive_timeout 65;
client_max_body_size 20M;
gzip on;
server_tokens off;

Paramètres du module Stream

proxy_connect_timeout 1s;
proxy_timeout 3s;
proxy_buffer_size 16k;

Étiquettes: nginx http-server load-balancing reverse-proxy php-fpm

Publié le 13 juillet à 22h18

L'Atelier Monstre