177 lines
4.0 KiB
Markdown
177 lines
4.0 KiB
Markdown
---
|
||
name: nginx
|
||
description: Nginx 全自动站点部署、SSL 证书、静态网站 SPA 配置
|
||
---
|
||
|
||
# Nginx 管理
|
||
|
||
## 全自动部署流程
|
||
|
||
当用户要求"全自动配置 nginx"时，按以下顺序执行：
|
||
|
||
### 1. 构建并部署静态文件
|
||
|
||
从项目 `run_prod.sh` 读取部署目录，通常部署到 `/www/<项目名>/`。执行：
|
||
|
||
```bash
|
||
bash run_prod.sh
|
||
```
|
||
|
||
### 2. 创建 Nginx 配置
|
||
|
||
根据实际目录结构选择配置方式：
|
||
|
||
#### Debian/Ubuntu（sites-available 方式）
|
||
|
||
```bash
|
||
sudo cp <config> /etc/nginx/sites-available/<sitename>
|
||
sudo ln -sf /etc/nginx/sites-available/<sitename> /etc/nginx/sites-enabled/<sitename>
|
||
sudo nginx -t && sudo systemctl reload nginx
|
||
```
|
||
|
||
#### RHEL/CentOS/Fedora（conf.d 方式）
|
||
|
||
```bash
|
||
sudo cp <config> /etc/nginx/conf.d/<sitename>.conf
|
||
sudo nginx -t && sudo systemctl reload nginx
|
||
```
|
||
|
||
### 3. 申请 SSL 证书
|
||
|
||
```bash
|
||
sudo certbot --nginx -d www.domain.com -d domain.com --non-interactive --agree-tos --email <email>
|
||
```
|
||
|
||
如 certbot 未安装，先安装：
|
||
|
||
```bash
|
||
# Debian/Ubuntu
|
||
sudo apt install -y certbot python3-certbot-nginx
|
||
|
||
# RHEL/CentOS/Fedora（pip 安装）
|
||
sudo pip install certbot certbot-nginx
|
||
```
|
||
|
||
### 4. 配置自动续期
|
||
|
||
创建 systemd timer：
|
||
|
||
```bash
|
||
sudo tee /etc/systemd/system/certbot-renew.timer > /dev/null << 'EOF'
|
||
[Unit]
|
||
Description=Run certbot renew twice daily
|
||
|
||
[Timer]
|
||
OnCalendar=0/12:00,12:00
|
||
RandomizedDelaySec=3600
|
||
Persistent=true
|
||
|
||
[Install]
|
||
WantedBy=timers.target
|
||
EOF
|
||
|
||
sudo tee /etc/systemd/system/certbot-renew.service > /dev/null << 'EOF'
|
||
[Unit]
|
||
Description=Certbot renewal
|
||
After=network-online.target
|
||
W Wants=network-online.target
|
||
|
||
[Service]
|
||
Type=oneshot
|
||
ExecStart=/usr/bin/certbot renew --quiet --deploy-hook "systemctl reload nginx"
|
||
PrivateTmp=true
|
||
EOF
|
||
|
||
sudo systemctl daemon-reload
|
||
sudo systemctl enable --now certbot-renew.timer
|
||
```
|
||
|
||
### 5. 验证部署
|
||
|
||
```bash
|
||
curl -I https://www.domain.com/
|
||
```
|
||
|
||
## 静态网站 SPA 配置
|
||
|
||
适用于 VitePress/Hugo 等静态站点，部署在 `/www/<sitename>/`：
|
||
|
||
### RHEL/CentOS/Fedora 完整配置
|
||
|
||
```nginx
|
||
server {
|
||
listen 80;
|
||
server_name www.domain.com domain.com;
|
||
root /www/domain;
|
||
index index.html;
|
||
|
||
# VitePress SPA fallback
|
||
location / {
|
||
try_files $uri $uri.html $uri/index.html /index.html;
|
||
}
|
||
|
||
# 缓存静态资源
|
||
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||
expires 1y;
|
||
add_header Cache-Control "public, immutable";
|
||
}
|
||
|
||
add_header X-Content-Type-Options nosniff;
|
||
add_header X-Frame-Options SAMEORIGIN;
|
||
|
||
access_log /var/log/nginx/domain_access.log;
|
||
error_log /var/log/nginx/domain_error.log;
|
||
}
|
||
```
|
||
|
||
### 反向代理配置
|
||
|
||
用于代理本地服务（如 Node.js）：
|
||
|
||
```nginx
|
||
server {
|
||
listen 80;
|
||
server_name www.domain.com;
|
||
return 301 https://$host$request_uri;
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl http2;
|
||
server_name www.domain.com;
|
||
|
||
ssl_certificate /etc/letsencrypt/live/www.domain.com/fullchain.pem;
|
||
ssl_certificate_key /etc/letsencrypt/live/www.domain.com/privkey.pem;
|
||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||
|
||
location / {
|
||
proxy_pass http://127.0.0.1:1234;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
}
|
||
}
|
||
```
|
||
|
||
## 快速命令
|
||
|
||
| 命令 | 说明 |
|
||
|------|------|
|
||
| `sudo nginx -t` | 测试配置语法 |
|
||
| `sudo systemctl reload nginx` | 热重载生效 |
|
||
| `sudo nginx -T` | 查看完整加载配置 |
|
||
| `sudo certbot certificates` | 查看已有证书 |
|
||
| `sudo certbot renew --dry-run` | 续期测试 |
|
||
|
||
## 常见问题
|
||
|
||
| 问题 | 排查 |
|
||
|------|------|
|
||
| 502 Bad Gateway | `curl http://127.0.0.1:1234` 确认后端运行 |
|
||
| 配置无效 | `sudo nginx -t` 检查语法 |
|
||
| nginx 未启动 | `sudo systemctl start nginx` |
|
||
| SSL 申请失败 | 确认 DNS 已解析到服务器 IP |
|
||
| certbot 命令找不到 | pip 安装 certbot certbot-nginx |
|