一些常用的Nginx+Passenger配置

server {
      listen       80;
      server_name  test.jibing57.com;
      root         /opt/app/web/hexo;
      auth_basic  "Administrator’s Area";
      auth_basic_user_file .htpasswd;
      location /images/ {
          auth_basic off;
      }
}

server {
      listen	   443 ssl;
      listen	   [::]:443 ssl;
      server_name  test.jibing57.com;
      ssl_session_cache   shared:SSL:10m;
      ssl_session_timeout 10m;
      keepalive_timeout   70;
      ssl_certificate     cert/www.jibing57.com.pem;
      ssl_certificate_key cert/www.jibing57.com.key;
      ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers         HIGH:!aNULL:!MD5;
      ...
}

$ nginx -V
...
TLS SNI support enabled
...

server {
  ...
  error_page 500 502 503 504 =444 @blackhole;
  location @blackhole {
    return 444;
  }
  ...
}

server {
    listen 80;
    server_name www.fake.com;
    if ($request_method = POST) {
        return 307 https://www.fakesite.com$request_uri;
    }
    return 301 https://www.fakesite.com$request_uri;
}

http {
  ...
  server {
    ...
    # gzip module
    gzip on;  # 是否开启gzip模块，on表示开启，off表示关闭；
    gzip_buffers 16 8k;
    gzip_min_length 1024;
    gzip_http_version 1.1;
    gzip_comp_level 6;
    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript application/vnd.ms-fontobject application/x-font-ttf font/opentype image/svg+xml image/x-icon;
    gzip_vary on;
    gzip_proxied any;
    gzip_disable "msie6";
    ...
  }
  ...
}

http {
  ...
  server {
    ...
    location ~ "^/assets/.+-[0-9a-f]{32}.*" {
      gzip_static on;
      expires     30d;
      add_header  Cache-Control public;
    }
    ...
  }

http {
  ...
  server {
    ...
    client_max_body_size 100m;
    client_body_buffer_size 256k;
    ...
  }
  ...
}

http {
  ...
  log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
  log_format  timer  '$remote_addr - $remote_user [$time_local] "$request" '
                     '$status $body_bytes_sent "$http_user_agent" request_time $request_time (s)';
  ...
  server {
    ...
    access_log  /var/log/nginx/access.log  main;
    error_log  /var/log/nginx/error.log  notice;
    ...
  }
  ...
}

location /movieticket {
    alias /opt/app/movieticket/current/public/;
    # do not include "$uri/" in try_files, otherwise @my-app not work
    try_files $uri @movieticket_app;
}
location @movieticket_app {
    passenger_ruby /usr/local/rvm/wrappers/ruby-2.3.3/ruby;
    passenger_enabled on;
    root /opt/app/movieticket/current/public;
}

# vi /lib/systemd/system/nginx.service
--------------------------------
[Unit]
Description=The nginx HTTP and reverse proxy server
After=syslog.target network.target remote-fs.target nss-lookup.target
[Service]
Type=forking
PIDFile=/var/run/nginx.pid
ExecStartPre=/opt/nginx/sbin/nginx -t
ExecStart=/opt/nginx/sbin/nginx -c /opt/nginx/conf/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true
[Install]
WantedBy=multi-user.target
--------------------------------

# systemctl enable nginx.service
# systemctl start nginx.service

$ cat /etc/init.d/nginx
#!/bin/sh
#
# nginx - this script starts and stops the nginx daemon
#
# chkconfig:   - 85 15
# description:  Nginx is an HTTP(S) server, HTTP(S) reverse \
#               proxy and IMAP/POP3 proxy server
# processname: nginx
# config:      /opt/nginx/conf/nginx.conf
# config:      /etc/sysconfig/nginx
# pidfile:     /var/run/nginx.pid
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
# Check that networking is up.
[ "$NETWORKING" = "no" ] && exit 0
nginx="/opt/nginx/sbin/nginx"
prog=$(basename $nginx)
NGINX_CONF_FILE="/opt/nginx/conf/nginx.conf"
[ -f /etc/sysconfig/nginx ] && . /etc/sysconfig/nginx
lockfile=/var/lock/subsys/nginx
#make_dirs() {
#   # make required directories
#   user=`$nginx -V 2>&1 | grep "configure arguments:" | sed 's/[^*]*--user=\([^ ]*\).*/\1/g' -`
#   if [ -z "`grep $user /etc/passwd`" ]; then
#       useradd -M -s /bin/nologin $user
#   fi
#   options=`$nginx -V 2>&1 | grep 'configure arguments:'`
#   for opt in $options; do
#       if [ `echo $opt | grep '.*-temp-path'` ]; then
#           value=`echo $opt | cut -d "=" -f 2`
#           if [ ! -d "$value" ]; then
#               # echo "creating" $value
#               mkdir -p $value && chown -R $user $value
#           fi
#       fi
#   done
#}
start() {
    [ -x $nginx ] || exit 5
    [ -f $NGINX_CONF_FILE ] || exit 6
#    make_dirs
    echo -n $"Starting $prog: "
    daemon $nginx -c $NGINX_CONF_FILE
    retval=$?
    echo
    [ $retval -eq 0 ] && touch $lockfile
    return $retval
}
stop() {
    echo -n $"Stopping $prog: "
    killproc $prog -QUIT
    retval=$?
    echo
    [ $retval -eq 0 ] && rm -f $lockfile
    return $retval
}
restart() {
    configtest || return $?
    stop
    sleep 1
    start
}
reload() {
    configtest || return $?
    echo -n $"Reloading $prog: "
    killproc $nginx -HUP
    RETVAL=$?
    echo
}
force_reload() {
    restart
}
configtest() {
  $nginx -t -c $NGINX_CONF_FILE
}
rh_status() {
    status $prog
}
rh_status_q() {
    rh_status >/dev/null 2>&1
}
case "$1" in
    start)
        rh_status_q && exit 0
        $1
        ;;
    stop)
        rh_status_q || exit 0
        $1
        ;;
    restart|configtest)
        $1
        ;;
    reload)
        rh_status_q || exit 7
        $1
        ;;
    force-reload)
        force_reload
        ;;
    status)
        rh_status
        ;;
    condrestart|try-restart)
        rh_status_q || exit 0
            ;;
    *)
        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload|configtest}"
        exit 2
esac

server {
    listen      80 default_server;
    server_name _;
    return      444;
}
server {
    listen      443 default_server;
    server_name _;
    ssl_certificate      cert/xxxxx.pem;
    ssl_certificate_key  cert/xxxxx.key;
    return      404;
}

wget https://github.com/openresty/headers-more-nginx-module/archive/v0.33.tar.gz
tar xzvf v0.33.tar.gz
cd headers-more-nginx-module-0.33/
passenger-install-nginx-module --extra-configure-flags=' --add-module=$HOME/headers-more-nginx-module-0.33/'

去掉指定header  --  more_clear_headers  'Server' 'X-Powered-By';
替换指定header -- more_set_headers

http {
  ...
  passenger_max_pool_size 40;
  passenger_pool_idle_time 600;
  passenger_max_preloader_idle_time 600;
  server {
    ...
 passenger_min_instances 16;
 passenger_max_request_queue_size 1000;
    ...
  }
  ...
}

http {
    ...
    server {
        ...
        location / {
            proxy_pass  http://web_production;
            proxy_redirect     off;
            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }
        ...
    }
    ...
}

Syntax:	    proxy_redirect default;
            proxy_redirect off;
            proxy_redirect redirect replacement;
Default:	proxy_redirect default;
Context:	http, server, location`

proxy_redirect http://localhost:8000/two/ http://frontend/one/;`

upstream xxxx {
    server example.com:443;
}
# xxxxxx
location ^~ /xxxxxx/ {
    proxy_pass  https://xxxx;
    proxy_redirect     off;
    proxy_set_header   Host             $host;
    proxy_set_header   X-Real-IP        $remote_addr;
    proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
}

upstream xxxx {
    server example.com:443;
}
# xxxxxx
location ^~ /xxxxxx/ {
    proxy_pass  https://xxxx/;
    proxy_redirect     off;
    proxy_set_header   Host             $host;
    proxy_set_header   X-Real-IP        $remote_addr;
    proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
}

upstream xxxx {
    server example.com:443;
}
# xxxxxx
location ^~ /xxxxxx/ {
    proxy_pass  https://xxxx;
    proxy_redirect     off;
    proxy_set_header   Host             $host;
    proxy_set_header   X-Real-IP        $remote_addr;
    proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    rewrite "^/xxxxxx/(.*)$" /$1 break;
}

server {
  ...
  server_name test.com;
  ...
  location / {
      if ($arg_flag = dk) {
          return 301 https://staging.com/?flag=dk;
      }
  ...
}

server {
    listen 80 default_server;
    server_name _;
    return 301 https://$host$request_uri;
}

http {
    ...
    server {
        listen 80;
        server_name test.domain.com;
        # gzip module
        gzip on;
        gzip_buffers 16 8k;
        gzip_min_length 1024;
        gzip_http_version 1.1;
        gzip_comp_level 6;
        gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript application/vnd.ms-fontobject application/x-font-ttf font/opentype image/svg+xml image/x-icon;
        gzip_vary on;
        gzip_proxied any;
        gzip_disable "msie6";
        # Turn on Passenger
        passenger_enabled on;
        access_log  /var/log/nginx/access.log  main;
        error_log  /var/log/nginx/error.log  notice;
        # Tell Passenger that your app is a Node.js app
        passenger_app_type node;
        passenger_app_root /app/appname/current;
        passenger_startup_file /app/appname/current/dist/app.js;
        passenger_force_max_concurrent_requests_per_process 100;
        passenger_max_request_queue_size 4000;
    }
    passenger_pre_start http://test.domain.com/health;
    ...
}

server {
    ...
    passenger_set_header X-Forwarded-Proto https;
    passenger_set_header X-Forwarded-For app.examples.com;
    passenger_set_header X-Forwarded-Host app.examples.com;
    ...
}

server {
    server_name old_example.com;
    ...
     location /old_path {
         rewrite ^(/old_path)(.*)$   https://new_examples.com/new_path$2 permanent;
     }
     ...
 }

rewrite ^(/old_path|/old_path_second)(.*)$   https://new_examples.com/new_path$2 permanent;

# Don't forward auth to Tomcat
proxy_set_header   Authorization "";

location / {
    proxy_pass  http://jenkins_app;
    proxy_redirect     off;
    proxy_set_header   Host             $host;
    proxy_set_header   X-Real-IP        $remote_addr;
    proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    # Don't forward auth to Tomcat
    proxy_set_header   Authorization "";
}