NGINX 상용 설정

1
2
3

http {
  server_tokens off;
}

1

htpasswd -c /usr/local/nginx/conf/nginx.passwd.db admin

1

htpasswd /usr/local/nginx/conf/nginx.passwd.db admin

1
2
3
4

location / {
    auth_basic "View is cheap,show me the password!";
    auth_basic_user_file nginx.passwd.db;
}

1
2
3
4
5
6
7
8
9
10

set $allow false;
if ($http_x_forwarded_for = "185.199.111.153") {
  set $allow true;
}
if ($http_x_forwarded_for ~ "10.0.0.*") {
 set $allow true;
}
if ($allow = false) {
 return 404;
}

1
2
3

if ($request_method !~ ^(GET|POST)$ ) {
    return 405;
}

1
2
3
4
5
6
7
8
9
10
11
12
13

location /images/ {
    valid_referers none blocked lengyuewusheng.com www.lengyuewusheng.com;
    if ($invalid_referer) {
        return  403;
    }
}
 
location /images/ {
 valid_referers blocked lengyuewusheng.com www.lengyuewusheng.com;
 if ($invalid_referer) {
 rewrite ^/images/.*\.(gif|jpg|jpeg|png)$ /error.html last;
 }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

http {

...

  upstream realservers {
 server 10.0.0.1:8080 weight=3;
 server 10.0.0.2:8080 weight=7;
 }

 server {
 location /admin/ { 
 proxy_pass http://realserver;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 }
 }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

upstream realserver {
    server 10.0.0.1:8080;
    keepalive 10;
    keepalive_timeout 60s;    # This directive appeared in version 1.15.3.
    keepalive_requests 100;   # This directive appeared in version 1.15.3.
}
http {
 keepalive_timeout 75s;
 server {
 location / {
 proxy_http_version 1.1;
 proxy_set_header Connection "";
 proxy_pass http://realserver;
 ...
 }
 }
}

1
2
3
4
5
6
7

server {
    location /download/ {
        autoindex on;
        autoindex_exact_size off;
        autoindex_localtime on;
 }
}

1
2
3

if ($request_filename ~* ^.*?\.(txt|pdf)$) {
    add_header Content-Disposition 'attachment';
}

1
2
3
4
5
6
7

set_real_ip_from  10.0.0.0/8;               #           IP    IP ,     。
set_real_ip_from  192.168.0.0/16;
real_ip_header    X-Forwarded-For;          #   header      IP  。
real_ip_recursive on;                       #            IP。
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

1
2
3
4
5
6
7

if ( $scheme = http ){
    return 301 https://$server_name$request_uri;
}
 
if ( $scheme = http ){
 rewrite ^(.*)$ https://$host$1 permanent;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

http {
    geo $limited
    {
        default 1;
        10.0.0.0/8 0;
 123.207.144.220/32 0;
 36.110.170.248/30 0;
 118.184.170.248/30 0;
 }

 map $limited $limit {
 1 $binary_remote_addr;
 0 "";
 }
 limit_req_zone $limit zone=reqids:100m rate=10r/s;

 server {
 limit_req zone=reqids burst=2 nodelay;
 }
}

1
2
3

server:
    default_type 'text/html';
    charset utf-8,gbk;

1
2
3
4

location / {
    autoindex on;
    autoindex_localtime on;
}

1
2
3
4

rewrite_log on;
proxy_ignore_client_abort on;

expires epoch;