我的 Nginx 安装与使用实践

758 字

4 分钟

我的 Nginx 安装与使用实践

2026-03-03

Linux

1）安装 Nginx 和 Certbot#

1
sudo apt update
2
sudo apt install -y nginx certbot
3
sudo systemctl enable --now nginx

检查是否启动成功：

1
systemctl status nginx --no-pager

2）写 Nginx 配置文件#

我把这一阶段的配置放在同一个点完成，核心是三部分：

主配置：/etc/nginx/nginx.conf
ACME 验证入口：/etc/nginx/conf.d/acme.conf
可复用片段：/etc/nginx/snippets/*.conf

先把运行时需要的目录一次性创建好：

1
sudo mkdir -p /var/cache/nginx/assets_cache
2
sudo chown -R www-data:www-data /var/cache/nginx/assets_cache
3

4
sudo mkdir -p /var/www/acme/.well-known/acme-challenge
5
sudo chown -R www-data:www-data /var/www/acme

如果你是 Ubuntu 默认安装，建议先移除默认站点链接，避免和 default_server 冲突：

1
sudo unlink /etc/nginx/sites-enabled/default

2.1 主配置 `/etc/nginx/nginx.conf`#

1
user www-data;
2
worker_processes auto;
3
pid /run/nginx.pid;
4
include /etc/nginx/modules-enabled/*.conf;
5

6
events {
7
    worker_connections 768;
8
}
9

10
http {
11
    sendfile on;
12
    tcp_nopush on;
13
    types_hash_max_size 2048;
14
    server_tokens off;
15

16
    include /etc/nginx/mime.types;
17
    default_type application/octet-stream;
18

19
    map $http_upgrade $connection_upgrade {
20
        default upgrade;
21
        ''      close;
22
    }
23

24
    proxy_cache_path /var/cache/nginx/assets_cache
25
        levels=1:2
26
        keys_zone=assets_cache:200m
27
        max_size=1g
28
        inactive=7d
29
        use_temp_path=off;
30

31
    ssl_protocols TLSv1.2 TLSv1.3;
32
    ssl_prefer_server_ciphers on;
33

34
    access_log /var/log/nginx/access.log;
35
    error_log /var/log/nginx/error.log;
36

37
    gzip on;
38

39
    include /etc/nginx/conf.d/*.conf;
40
    include /etc/nginx/sites-enabled/*;
41
}

2.2 ACME 验证入口 `/etc/nginx/conf.d/acme.conf`#

1
server {
2
    listen 80 default_server;
3
    server_name _;
4

5
    location ^~ /.well-known/acme-challenge/ {
6
        root /var/www/acme;
7
        try_files $uri =404;
8
    }
9

10
    location / { return 404; }
11
}

2.3 复用 snippets（按需 include）#

我这里一共维护 7 个片段，按职责拆开，站点里按需 include：

acme-webroot.conf（ACME challenge）
redirect-https-308.conf（80 -> HTTPS 308）
security-headers.conf（HSTS / 基础安全头）
proxy-common.conf（反代通用头 + WebSocket + timeout）
cache-assets.optional.conf（浏览器缓存头，可选）
proxy-cache-assets.optional.conf（Nginx proxy_cache，可选）
block-common-exploits.optional.conf（常见探测拦截，可选）

/etc/nginx/snippets/acme-webroot.conf：

1
location ^~ /.well-known/acme-challenge/ {
2
    root /var/www/acme;
3
    try_files $uri =404;
4
}

/etc/nginx/snippets/redirect-https-308.conf：

1
location / {
2
    return 308 https://$host$request_uri;
3
}

/etc/nginx/snippets/security-headers.conf：

1
add_header Strict-Transport-Security "max-age=63072000" always;
2
add_header X-Content-Type-Options nosniff always;
3
add_header X-Frame-Options DENY always;
4
add_header Referrer-Policy no-referrer always;

/etc/nginx/snippets/proxy-common.conf：

1
proxy_http_version 1.1;
2

3
proxy_set_header Host              $host;
4
proxy_set_header X-Real-IP         $remote_addr;
5
proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
6
proxy_set_header X-Forwarded-Proto $scheme;
7

8
proxy_set_header Upgrade $http_upgrade;
9
proxy_set_header Connection $connection_upgrade;
10

11
proxy_read_timeout  300;
12
proxy_send_timeout  300;

/etc/nginx/snippets/cache-assets.optional.conf：

1
expires 30d;
2
add_header Cache-Control "public, max-age=2592000, immutable" always;
3
access_log off;

/etc/nginx/snippets/proxy-cache-assets.optional.conf：

1
proxy_cache assets_cache;
2
proxy_cache_key "$scheme$request_method$host$request_uri";
3
proxy_cache_valid 200 206 301 302 30m;
4
proxy_cache_valid 404 1m;
5
proxy_cache_lock on;
6
proxy_cache_revalidate on;
7
proxy_cache_min_uses 1;
8
proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
9
add_header X-Proxy-Cache $upstream_cache_status always;

/etc/nginx/snippets/block-common-exploits.optional.conf：

1
location ~ /\.(?!well-known) {
2
    deny all;
3
}
4
location ~* \.(?:bak|conf|dist|ini|log|old|orig|save|sql|swp)$ {
5
    deny all;
6
}

配置写完后，先检查语法再重载：

1
sudo nginx -t
2
sudo systemctl reload nginx

3）准备 `/etc/letsencrypt` TLS 参数文件#

因为后面的 HTTPS 站点配置会引用这两个文件，我会先把目录和文件准备好。

先创建目录：

1
sudo mkdir -p /etc/letsencrypt

创建 /etc/letsencrypt/options-ssl-nginx.conf：

1
sudo nano /etc/letsencrypt/options-ssl-nginx.conf

写入以下内容：

1
ssl_session_cache shared:le_nginx_SSL:10m;
2
ssl_session_timeout 1440m;
3
ssl_session_tickets off;
4

5
ssl_protocols TLSv1.2 TLSv1.3;
6
ssl_prefer_server_ciphers off;
7

8
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";

创建 /etc/letsencrypt/ssl-dhparams.pem：

1
sudo nano /etc/letsencrypt/ssl-dhparams.pem

写入以下内容：

1
-----BEGIN DH PARAMETERS-----
2
MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
3
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
4
87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
5
YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
6
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
7
ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
8
-----END DH PARAMETERS-----

4）创建反向代理站点配置（`/etc/nginx/sites-available/example`）#

先写站点文件，但这一步先不启用：

1
sudo nano /etc/nginx/sites-available/example

写入以下完整配置（示例上游是 127.0.0.1:3001，按你的实际服务端口调整）：

1
upstream example_upstream {
2
    server 127.0.0.1:3001;
3
    keepalive 32;
4
}
5

6
server {
7
    listen 80;
8
    server_name www.example.com;
9

10
    include /etc/nginx/snippets/acme-webroot.conf;
11
    include /etc/nginx/snippets/redirect-https-308.conf;
12
}
13

14
server {
15
    listen 443 ssl http2;
16
    server_name www.example.com;
17

18
    ssl_certificate     /etc/letsencrypt/live/www.example.com/fullchain.pem;
19
    ssl_certificate_key /etc/letsencrypt/live/www.example.com/privkey.pem;
20
    include /etc/letsencrypt/options-ssl-nginx.conf;
21
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
22

23
    include /etc/nginx/snippets/security-headers.conf;
24
    include /etc/nginx/snippets/acme-webroot.conf;
25

26
    location / {
27
        proxy_pass http://example_upstream;
28
        include /etc/nginx/snippets/proxy-common.conf;
29
    }
30

31
    # Optional:
32
    # include /etc/nginx/snippets/block-common-exploits.optional.conf;
33
}

先申请证书（这里不要先启用站点）：

1
sudo certbot certonly --webroot -w /var/www/acme -d www.example.com

证书申请成功后，再启用站点并重载 Nginx：

1
sudo ln -s /etc/nginx/sites-available/example /etc/nginx/sites-enabled/example
2
sudo nginx -t
3
sudo systemctl reload nginx

最后做一次续期演练，确认自动续期流程没有问题：

1
sudo certbot renew --dry-run

到这里，整套流程就完成了。只要你的反向代理后端服务正常运行（在我的例子里是 127.0.0.1:3001），就可以直接访问你的域名，验证服务是否已经正常对外提供。

我的 Nginx 安装与使用实践

https://blog.cetaceang.de/posts/nginx-install-and-usage-practice/

作者

cetaceang

发布于

2026-03-03

许可协议

CC BY-NC-SA 4.0

RackNerd 2c2g VPS 测评留档

dedirock 年付 $6.75 VPS 测评留档

2.1 主配置 /etc/nginx/nginx.conf

2.2 ACME 验证入口 /etc/nginx/conf.d/acme.conf

2.3 复用 snippets（按需 include）

3

3）准备 /etc/letsencrypt TLS 参数文件

4

4）创建反向代理站点配置（/etc/nginx/sites-available/example）

1）安装 Nginx 和 Certbot#

2）写 Nginx 配置文件#

2.1 主配置 /etc/nginx/nginx.conf#

2.2 ACME 验证入口 /etc/nginx/conf.d/acme.conf#

2.3 复用 snippets（按需 include）#

3）准备 /etc/letsencrypt TLS 参数文件#

4）创建反向代理站点配置（/etc/nginx/sites-available/example）#

2.1 主配置 `/etc/nginx/nginx.conf`#

2.2 ACME 验证入口 `/etc/nginx/conf.d/acme.conf`#

3）准备 `/etc/letsencrypt` TLS 参数文件#

4）创建反向代理站点配置（`/etc/nginx/sites-available/example`）#