CentOS 7 上安装 nginx 作为反向代理

Question

检查系统信息

[vagrant@bogon vagrant]$ uname -a
Linux bogon 3.10.0-1062.1.2.el7.x86_64 #1 SMP Mon Sep 30 14:19:46 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
[vagrant@bogon vagrant]$ cat /etc/centos-release
CentOS Linux release 7.7.1908 (Core)

下载最新的稳定版本的安装包

• 从 nginx: download 查找最新的 Stable version
• Linux 包信息 nginx: Linux packages，找到里面的baseurl的前面部分http://nginx.org/packages/centos/，在浏览器中打开这个链接，根据服务器信息和 nginx 版本信息，浏览查找对应的 rpm 包，准备下载： curl -o http://nginx.org/packages/centos/7/x86_64/RPMS/nginx-1.16.1-1.el7.ngx.x86_64.rpm

安装

检查清空已有包

[vagrant@bogon nginx]$ rpm -qa |grep nginx
nginx-1.16.1-1.el7.ngx.x86_64
[vagrant@bogon nginx]$ sudo rpm -e --nodeps nginx-1.16.1-1.el7.ngx.x86_64
warning: /etc/nginx/nginx.conf saved as /etc/nginx/nginx.conf.rpmsave
[vagrant@bogon nginx]$ rpm -qa |grep nginx
[vagrant@bogon nginx]$

开始安装

[vagrant@bogon vagrant]$ sudo rpm -ivh nginx-1.16.1-1.el7.ngx.x86_64.rpm
warning: nginx-1.16.1-1.el7.ngx.x86_64.rpm: Header V4 RSA/SHA1 Signature, key ID 7bd9bf62: NOKEY
Preparing...                          ################################# [100%]

Updating / installing...
   1:nginx-1:1.16.1-1.el7.ngx         ################################# [100%]
----------------------------------------------------------------------

Thanks for using nginx!

配置

添加虚拟服务配置，增加文件 /etc/nginx/conf.d/hello.conf，内容如下所示

[vagrant@bogon nginx]$ more /etc/nginx/conf.d/hello.conf
server_tokens off;  # 隐藏Nginx返回头中的Server部分的版本号，Server: nginx	  	

upstream hello-server {
    server 127.0.0.1:9901;
}

server {
    listen 8801;

    location / {
        charset utf-8;
        proxy_connect_timeout 20;
        proxy_send_timeout 20;
        proxy_read_timeout 20;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarder-For $remote_addr;
        proxy_pass http://hello-server;
    }
}

更多参数设置，参见 Module ngx_http_proxy_module 官方文档, 中文文档

检查配置的语法正确性 sudo nginx -t

[vagrant@bogon vagrant]$ sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

启动nginx，检查反向代理服务，查看 nginx 错误日志

[vagrant@bogon vagrant]$ sudo nginx
[vagrant@bogon vagrant]$ ps -ef|grep nginx
root      4837     1  0 06:10 ?        00:00:00 nginx: master process nginx
nginx     4838  4837  0 06:10 ?        00:00:00 nginx: worker process
[vagrant@bogon vagrant]$ curl http://127.0.0.1:8801/say
Hi there, say I love you! port 9901, pport 0
[vagrant@bogon vagrant]$ sudo tail /var/log/nginx/error.log
2019/11/13 02:59:05 [notice] 3272#3272: signal process started
2019/11/13 02:59:47 [notice] 3286#3286: signal process started
2019/11/13 03:13:52 [notice] 3363#3363: signal process started
2019/11/13 06:09:29 [emerg] 4821#4821: bind() to 0.0.0.0:80 failed (98: Address already in use)

自动启动

1. 检查状态 sudo systemctl status nginx
2. 检查自动启动 sudo systemctl is-enabled nginx
3. 设置自动启动 sudo systemctl enable nginx
4. 重新加载配置 sudo systemctl reload nginx

$ sudo systemctl status nginx
● nginx.service - nginx - high performance web server
   Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vendor preset: disabled)
   Active: inactive (dead)
     Docs: http://nginx.org/en/docs/
$ sudo systemctl start nginx
$ sudo systemctl status nginx
● nginx.service - nginx - high performance web server
   Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2019-11-14 03:12:01 UTC; 2s ago
     Docs: http://nginx.org/en/docs/
  Process: 3279 ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf (code=exited, status=0/SUCCESS)
 Main PID: 3280 (nginx)
   CGroup: /system.slice/nginx.service
           ├─3280 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
           └─3281 nginx: worker process

Nov 14 03:12:01 bogon systemd[1]: Starting nginx - high performance web server...
Nov 14 03:12:01 bogon systemd[1]: Can't open PID file /var/run/nginx.pid (yet?) after start: No such file or directory
Nov 14 03:12:01 bogon systemd[1]: Started nginx - high performance web server.
$ sudo systemctl is-enabled nginx
enabled
$ sudo systemctl reload nginx
$ sudo systemctl status nginx
● nginx.service - nginx - high performance web server
   Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2019-11-14 03:12:01 UTC; 2min 22s ago
     Docs: http://nginx.org/en/docs/
  Process: 3321 ExecReload=/bin/kill -s HUP $MAINPID (code=exited, status=0/SUCCESS)
 Main PID: 3280 (nginx)
   CGroup: /system.slice/nginx.service
           ├─3280 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
           └─3322 nginx: worker process

Nov 14 03:12:01 bogon systemd[1]: Starting nginx - high performance web server...
Nov 14 03:12:01 bogon systemd[1]: Can't open PID file /var/run/nginx.pid (yet?) after start: No such file or directory
Nov 14 03:12:01 bogon systemd[1]: Started nginx - high performance web server.
Nov 14 03:14:11 bogon systemd[1]: Reloading nginx - high performance web server.
Nov 14 03:14:11 bogon systemd[1]: Reloaded nginx - high performance web server.
[vagrant@bogon vagrant]$ systemctl cat nginx
# /usr/lib/systemd/system/nginx.service
[Unit]
Description=nginx - high performance web server
Documentation=http://nginx.org/en/docs/
After=network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/var/run/nginx.pid
ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s TERM $MAINPID

[Install]
WantedBy=multi-user.target

Thanks

1. How To Use Systemctl to Manage Systemd Services and Units
2. Nginx Commands You Should Know

查看 Nginx 所需要的动态链接库

vagrant@bogon ~]$ readelf
Usage: readelf <option(s)> elf-file(s)
 Display information about the contents of ELF format files
 Options are:
  ...
  -d --dynamic           Display the dynamic section (if present)
[vagrant@bogon ~]$ readelf -d /usr/sbin/nginx

Dynamic section at offset 0x120240 contains 34 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libdl.so.2]
 0x0000000000000001 (NEEDED)             Shared library: [libpthread.so.0]
 0x0000000000000001 (NEEDED)             Shared library: [libcrypt.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libpcre.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libssl.so.10]
 0x0000000000000001 (NEEDED)             Shared library: [libcrypto.so.10]
 0x0000000000000001 (NEEDED)             Shared library: [libz.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x000000000000000f (RPATH)              Library rpath: [./luajit/lib:./zlib/lib:./pcre/lib:./openssl/lib]
...

查看 Nginx 编译时的信息

所包含的组件

[vagrant@bogon ~]$ /usr/sbin/nginx -V
nginx version: nginx/1.16.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC)
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie'