飞
文章
9
分类
9
评论
0

Nginx编译安装及SSL证书自动部署、续签

| 部署 •
字数总计 9520 | 阅读时长 23分钟 | 阅读量 61

创建工作目录

/workspace/                 --工作目录
├── download                --下载目录
├── data                    --数据目录
│   ├── ssl                 	--ssl文件目录
├── etc                     --配置目录
│   └── nginx                   --nginx配置
├── logs                    --日志目录
│   └── nginx                   --nginx日志
├── nginx                    --nginx应用
    └── conf                    --nginx默认配置目录

安装依赖

# ubuntu
sudo apt-get install libpcre3-dev openssl libssl-dev -y

# centos 7.9
yum -y install gcc gcc-c++ make automake autoconf pcre pcre-devel zlib zlib-devel openssl openssl-devel libtool

编译安装

cd /workspace/download
wget https://nginx.org/download/nginx-1.24.0.tar.gz
tar -zxvf nginx-1.24.0.tar.gz
cd nginx-1.24.0

# 编译配置
sudo ./configure --prefix=/workspace/nginx --user=work --group=work --with-http_ssl_module --with-http_realip_module  --with-http_stub_status_module --with-stream

# 编译安装
sudo make
sudo make install

环境配置

sudo ln -s /workspace/nginx/sbin/nginx /usr/bin/nginx
sudo ln -s /workspace/nginx/conf/ /etc/nginx

Nginx基本配置

mkdir /workspace/etc/nginx/conf.d -p
mkdir /workspace/logs/nginx

cd /workspace/nginx/conf
cp nginx.conf nginx.conf.bak
vim nginx.conf
# nginx.conf
user  work work;
worker_processes  auto;

error_log  /workspace/logs/nginx/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

pid        /workspace/logs/nginx/nginx.pid;


events {
    use epoll;
    worker_connections 65535;
}



http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /workspace/logs/nginx/access.log  main;

    # server_names_hash_bucket_size 512;
    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    gzip on;
    gzip_http_version 1.0;
    gzip_disable 'MSIE[1-6].';
    gzip_types text/css text/javascript application/javascript image/jpeg image/png image/gif;
    gzip_buffers 4 8k;
    gzip_min_length 1k;
    gzip_comp_level 9;
    gzip_vary on;
    gzip_proxied off;

    types_hash_max_size 2048;

    include /workspace/etc/nginx/conf.d/*.conf;

    #server {
    #    listen       80;
    #    server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
    #    error_page   500 502 503 504  /50x.html;
    #    location = /50x.html {
    #        root   html;
    #    }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    #}


    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    #server {
    #    listen       8000;
    #    listen       somename:8080;
    #    server_name  somename  alias  another.alias;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}


    # HTTPS server
    #
    #server {
    #    listen       443 ssl;
    #    server_name  localhost;

    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_cache    shared:SSL:1m;
    #    ssl_session_timeout  5m;

    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers  on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}

}

Nginx日志归档

归档配置

sudo vim /etc/logrotate.d/nginx

# 设置如下内容，并保存
/workspace/logs/nginx/*.log
{
    daily
    rotate 90
    missingok
    dateext
    compress
    delaycompress
    notifempty
    sharedscripts
    postrotate
        if [ -f /workspace/logs/nginx/nginx.pid ]; then
            kill -USR1 `cat /workspace/logs/nginx/nginx.pid`
        fi
    endscript
}

定时任务

# 添加定时任务
sudo crontab -u root -e

# 添加如下内容，并保存
# rotate nginx log erery day
0 0 * * * /usr/sbin/logrotate -f /etc/logrotate.d/nginx

相关命令

# 调试脚本，测试脚本是否正确
/usr/sbin/logrotate -d -f /etc/logrotate.d/nginx

# 手动运行脚本分割日志
/usr/sbin/logrotate -f /etc/logrotate.d/nginx

Nginx自启动

自启动配置文件

sudo vim /usr/lib/systemd/system/nginx.service

# 添加如下内容，并保存
[Unit]
Description=nginx service
After=network.target

[Service]
Type=forking
ExecStartPre=/usr/bin/nginx -t -c /workspace/nginx/conf/nginx.conf
ExecStart=/usr/bin/nginx -c /workspace/nginx/conf/nginx.conf
ExecReload=/usr/bin/nginx -s reload
ExecStop=/usr/bin/nginx -s quit
PrivateTmp=true

[Install]
WantedBy=multi-user.target

重启配置服务

systemctl daemon-reload

配置nginx开机自启

systemctl enable nginx

相关命令

# 查看nginx状态
systemctl status nginx
# 启动nginx
systemctl start nginx
# 停止nginx
systemctl stop nginx
# 平滑启动nginx
systemctl reload nginx
# 重启nginx
systemctl restart nginx

Nginx相关命令

# 查看nginx是否在运行
ps -ef | grep nginx
# 检查配置
sudo nginx -t
# 启动nginx
sudo nginx -c /workspace/nginx/conf/nginx.conf
# 平滑启动nginx（有时候不生效，不生效请启动用systemctl restart nginx）
sudo nginx -s reload

使用ssl给nginx配置https（示例）

server {
    listen 80;
    server_name test.com; #需要将yourdomain.com替换成证书绑定的域名。
    rewrite ^(.*)$ https://$host$1; #将所有HTTP请求通过rewrite指令重定向到HTTPS。
    location / {
        index index.html index.htm;
    }
}

server {
    listen       443 ssl;
    server_name  test.com;

    ssl_certificate /workspace/data/ssl/server.crt;
    ssl_certificate_key /workspace/data/ssl/server.key;
    ssl_session_timeout 5m;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    location / {
        root   html;
        index  index.html index.htm;
    }
}

SSL证书自动部署、续签

Certbot工具

https://certbot.eff.org/

安装snapd

sudo apt install snapd -y

安装certbot

# 安装certbot，该步骤需要一定时间
sudo snap install --classic certbot

sudo ln -s /snap/bin/certbot /usr/bin/certbot

certbot配置nginx关联

# 该步骤需要输入邮箱，设置邮箱后一直同意，然后到选择域名的界面，按回车即可。
sudo certbot --nginx
# 如果nginx没有在默认目录中时可以用nginx-server-root指定
sudo certbot --nginx --nginx-server-root=/www/server/nginx/conf/

定时更新证书

定时更新脚本

vim /workspace/scripts/renew_ssl_cert.sh

# 添加如下内容并保存
sudo certbot renew --force-renewal

定时更新任务


# 添加定时任务
crontab -e

# renew ssl cert
0 0 1 3,6,9,12 * sh /workspace/scripts/renew_ssl_cert.sh

文章作者： 飞
本文链接：
版权声明： 本站所有文章除特别声明外，均采用 CC BY-NC-SA 4.0 许可协议。转载请注明来自 飞的博客！
部署 SSL Nginx Liunx
喜欢就支持一下吧