Ubuntu下编译安装Nginx及相关设置

sudo apt-get update
sudo apt-get install build-essential zlib1g-dev libpcre3 libpcre3-dev libssl-dev libxslt1-dev libxml2-dev libgd2-xpm-dev libgeoip-dev libgoogle-perftools-dev libperl-dev libtool
sudo apt-get install openssl

wget http://nginx.org/download/nginx-1.13.5.tar.gz

tar -zxvf nginx-1.13.5.tar.gz

# 进入解压目录：
cd nginx-1.13.5
# 配置：这里额外安装几个模块
./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-stream --with-mail=dynamic

# 编辑nginx：
sudo make
# 安装nginx：
sudo make install
# 启动nginx：
sudo /usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
#注意：-c 指定配置文件的路径，不加的话，nginx会自动加载默认路径的配置文件，可以通过 -h查看帮助命令。

# 查看nginx进程：
ps -ef|grep nginx

# 建立软链接（由于/usr/local/bin包含于$PATH当中，这样就不需要额外的设置环境变量了，这意味着可以在其他路径下直接运行nginx命令）
sudo ln -s /opt/dotnet/dotnet /usr/local/bin #（创建链接）

# 建立服务器私钥（过程需要输入密码，请记住这个密码）生成RSA密钥
sudo openssl genrsa -des3 -out testcert.key 1024  
# 生成一个证书请求   
# 需要依次输入国家，地区，组织，email。
# 最重要的是有一个common name，可以写你的名字或者域名。如果为了https申请（不使用自己生成的证书，向CA申请），这个必须和域名吻合，否则会引发浏览器警报。生成的csr文件交给CA签名后形成服务端自己的证书
sudo openssl req -new -key testcert.key -out testcert.csr
# 生成不需要密码的key
sudo openssl rsa -in testcert.key -out testcert_nopwd.key  
# 生成crt文件
sudo openssl x509 -req -days 365 -in testcert.csr -signkey testcert_nopwd.key -out testcert.crt  

http {
    include       proxy.conf;
    include       mime.types;
    default_type  application/octet-stream;  

    limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;
    server_tokens off;
    
    sendfile        on;
    #tcp_nopush     on;
   
    keepalive_timeout  29;
    client_body_timeout 10; 
    client_header_timeout 10; 
    send_timeout 10;
    #gzip  on;

    # mvctest是一个名称，与具体的程序相关
    upstream mvctest{
        server localhost:5000;
    }

    server {
       
        listen       80;
        add_header Strict-Transport-Security max-age=15768000;
        return 301 https://$host$request_uri;
    }

    server {
        listen *:443    ssl;
        server_name     localhost;
        ssl_certificate /etc/ssl/certs/testcert.crt;
        ssl_certificate_key /etc/ssl/certs/testcert.key;
        ssl_protocols TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_ecdh_curve secp384r1;
        ssl_session_cache shared:SSL:10m;
        ssl_session_tickets off;
        ssl_stapling on; #ensure your cert is capable
        ssl_stapling_verify on; #ensure your cert is capable

        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;

        #Redirects all traffic
        location / {
            proxy_pass  http://localhost:5000;
            limit_req   zone=one burst=10 nodelay;
            limit_req_status 503;
        }
    }

}

#使用cat命令生成
cat test_com.crt  test_com.ca-bundle > test_com.pem

server {  
    #...
    ssl on;
    ssl_certificate /etc/ssl/private/test_com.pem;
    ssl_certificate_key /etc/ssl/private/test_com.key;
    #...

}

test@test-VirtualBox:/etc/ssl/certs$ sudo  openssl dhparam -out dhparam.pem 4096
[sudo] test 的密码：
Generating DH parameters, 4096 bit long safe prime, generator 2
This is going to take a long time
# ...会等一段时间，与机器性能有关...
#完成后可以查看生成的文件
test@test-VirtualBox:~$ cd /etc/ssl/certs/
test@test-VirtualBox:/etc/ssl/certs$ ll dhparam.pem 
-rw-r--r-- 1 root root 769 9月  27 11:49 dhparam.pem

ssl_prefer_server_ciphers on;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";

#启动 Nginx
/usr/local/nginx/sbin/nginx 
./sbin/nginx　
#停止 Nginx
./sbin/nginx -s stop 
./sbin/nginx -s quit
# -s都是采用向 Nginx 发送信号的方式。
#Nginx重新加载配置
./sbin/nginx -s reload
#指定配置文件
./sbin/nginx -c /usr/local/nginx/conf/nginx.conf
#-c表示configuration，指定配置文件
#查看 Nginx 版本
./sbin/nginx -v
#帮助
./sbin/nginx -h
./sbin/nginx -?

# 设置nginx自启动，在/lib/systemd/system/ 目录下创建一个服务文件
vim /lib/systemd/system/nginx.service

[Unit]
Description=nginx - high performance web server
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/usr/local/nginx/sbin/nginx -s stop

[Install]
WantedBy=multi-user.target

# 设置了自启动后，任意目录下执行
systemctl enable nginx.service
# 启动nginx服务
systemctl start nginx.service
# 设置开机自动启动
systemctl enable nginx.service
# 停止开机自动启动
systemctl disable nginx.service
# 查看状态
systemctl status nginx.service
# 重启服务
systemctl restart nginx.service
# 查看所有服务
systemctl list-units --type=service