feat(skills): 更新 nginx Skill 增加全自动部署流程
This commit is contained in:
+134
-34
@@ -1,38 +1,146 @@
|
||||
---
|
||||
name: nginx
|
||||
description: Nginx 站点配置、反向代理、SSL 证书、热重载
|
||||
description: Nginx 全自动站点部署、SSL 证书、静态网站 SPA 配置
|
||||
---
|
||||
|
||||
# Nginx 管理
|
||||
|
||||
## 快速命令
|
||||
## 全自动部署流程
|
||||
|
||||
| 命令 | 说明 |
|
||||
|------|------|
|
||||
| `sudo nginx -t` | 测试配置语法 |
|
||||
| `sudo systemctl reload nginx` | 热重载生效 |
|
||||
| `ls /etc/nginx/sites-enabled/` | 查看已启用站点 |
|
||||
| `sudo nginx -T` | 查看完整加载配置 |
|
||||
当用户要求"全自动配置 nginx"时，按以下顺序执行：
|
||||
|
||||
## 站点配置
|
||||
### 1. 构建并部署静态文件
|
||||
|
||||
站点配置放在 `/etc/nginx/sites-available/`，软链接到 `/etc/nginx/sites-enabled/` 启用。
|
||||
从项目 `run_prod.sh` 读取部署目录，通常部署到 `/www/<项目名>/`。执行：
|
||||
|
||||
### 反向代理模板
|
||||
```bash
|
||||
bash run_prod.sh
|
||||
```
|
||||
|
||||
### 2. 创建 Nginx 配置
|
||||
|
||||
根据实际目录结构选择配置方式：
|
||||
|
||||
#### Debian/Ubuntu（sites-available 方式）
|
||||
|
||||
```bash
|
||||
sudo cp <config> /etc/nginx/sites-available/<sitename>
|
||||
sudo ln -sf /etc/nginx/sites-available/<sitename> /etc/nginx/sites-enabled/<sitename>
|
||||
sudo nginx -t && sudo systemctl reload nginx
|
||||
```
|
||||
|
||||
#### RHEL/CentOS/Fedora（conf.d 方式）
|
||||
|
||||
```bash
|
||||
sudo cp <config> /etc/nginx/conf.d/<sitename>.conf
|
||||
sudo nginx -t && sudo systemctl reload nginx
|
||||
```
|
||||
|
||||
### 3. 申请 SSL 证书
|
||||
|
||||
```bash
|
||||
sudo certbot --nginx -d www.domain.com -d domain.com --non-interactive --agree-tos --email <email>
|
||||
```
|
||||
|
||||
如 certbot 未安装，先安装：
|
||||
|
||||
```bash
|
||||
# Debian/Ubuntu
|
||||
sudo apt install -y certbot python3-certbot-nginx
|
||||
|
||||
# RHEL/CentOS/Fedora（pip 安装）
|
||||
sudo pip install certbot certbot-nginx
|
||||
```
|
||||
|
||||
### 4. 配置自动续期
|
||||
|
||||
创建 systemd timer：
|
||||
|
||||
```bash
|
||||
sudo tee /etc/systemd/system/certbot-renew.timer > /dev/null << 'EOF'
|
||||
[Unit]
|
||||
Description=Run certbot renew twice daily
|
||||
|
||||
[Timer]
|
||||
OnCalendar=0/12:00,12:00
|
||||
RandomizedDelaySec=3600
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
EOF
|
||||
|
||||
sudo tee /etc/systemd/system/certbot-renew.service > /dev/null << 'EOF'
|
||||
[Unit]
|
||||
Description=Certbot renewal
|
||||
After=network-online.target
|
||||
W Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/bin/certbot renew --quiet --deploy-hook "systemctl reload nginx"
|
||||
PrivateTmp=true
|
||||
EOF
|
||||
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable --now certbot-renew.timer
|
||||
```
|
||||
|
||||
### 5. 验证部署
|
||||
|
||||
```bash
|
||||
curl -I https://www.domain.com/
|
||||
```
|
||||
|
||||
## 静态网站 SPA 配置
|
||||
|
||||
适用于 VitePress/Hugo 等静态站点，部署在 `/www/<sitename>/`：
|
||||
|
||||
### RHEL/CentOS/Fedora 完整配置
|
||||
|
||||
```nginx
|
||||
server {
|
||||
listen 80;
|
||||
server_name www.xsinfo.vip;
|
||||
server_name www.domain.com domain.com;
|
||||
root /www/domain;
|
||||
index index.html;
|
||||
|
||||
# VitePress SPA fallback
|
||||
location / {
|
||||
try_files $uri $uri.html $uri/index.html /index.html;
|
||||
}
|
||||
|
||||
# 缓存静态资源
|
||||
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||||
expires 1y;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-Frame-Options SAMEORIGIN;
|
||||
|
||||
access_log /var/log/nginx/domain_access.log;
|
||||
error_log /var/log/nginx/domain_error.log;
|
||||
}
|
||||
```
|
||||
|
||||
### 反向代理配置
|
||||
|
||||
用于代理本地服务（如 Node.js）：
|
||||
|
||||
```nginx
|
||||
server {
|
||||
listen 80;
|
||||
server_name www.domain.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name www.xsinfo.vip;
|
||||
server_name www.domain.com;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/www.xsinfo.vip/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/www.xsinfo.vip/privkey.pem;
|
||||
ssl_certificate /etc/letsencrypt/live/www.domain.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/www.domain.com/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
@@ -47,25 +155,15 @@ server {
|
||||
}
|
||||
```
|
||||
|
||||
### 启用/禁用站点
|
||||
## 快速命令
|
||||
|
||||
```bash
|
||||
sudo ln -s /etc/nginx/sites-available/mysite /etc/nginx/sites-enabled/mysite
|
||||
sudo rm /etc/nginx/sites-enabled/mysite
|
||||
```
|
||||
|
||||
## SSL 证书
|
||||
|
||||
```bash
|
||||
# 申请 Let's Encrypt 证书
|
||||
sudo certbot --nginx -d www.xsinfo.vip
|
||||
|
||||
# 续期测试
|
||||
sudo certbot renew --dry-run
|
||||
|
||||
# 查看已有证书
|
||||
sudo certbot certificates
|
||||
```
|
||||
| 命令 | 说明 |
|
||||
|------|------|
|
||||
| `sudo nginx -t` | 测试配置语法 |
|
||||
| `sudo systemctl reload nginx` | 热重载生效 |
|
||||
| `sudo nginx -T` | 查看完整加载配置 |
|
||||
| `sudo certbot certificates` | 查看已有证书 |
|
||||
| `sudo certbot renew --dry-run` | 续期测试 |
|
||||
|
||||
## 常见问题
|
||||
|
||||
@@ -73,4 +171,6 @@ sudo certbot certificates
|
||||
|------|------|
|
||||
| 502 Bad Gateway | `curl http://127.0.0.1:1234` 确认后端运行 |
|
||||
| 配置无效 | `sudo nginx -t` 检查语法 |
|
||||
| proxy_pass 路径错 | 末尾斜杠含义不同：无斜杠保持路径，有斜杠替换路径 |
|
||||
| nginx 未启动 | `sudo systemctl start nginx` |
|
||||
| SSL 申请失败 | 确认 DNS 已解析到服务器 IP |
|
||||
| certbot 命令找不到 | pip 安装 certbot certbot-nginx |
|
||||
|
||||
Reference in New Issue
Block a user