什么是Nginx？集Web服务器、反向代理与负载均衡于一体

 1# /etc/nginx/nginx.conf
 2worker_processes auto;          # 自动选择worker数量 = CPU核心数
 3events {
 4    worker_connections 1024;    # 每个worker的最大连接数
 5}
 6
 7http {
 8    # --- Upstream: 用于负载均衡的后端池 ---
 9    upstream app_backend {
10        least_conn;             # 算法：优先选择连接数最少的服务器
11        server 10.0.0.10:8080 weight=3;
12        server 10.0.0.11:8080 weight=2;
13        server 10.0.0.12:8080 weight=1 max_fails=3 fail_timeout=30s;
14    }
15
16    # --- Server块：HTTPS + 反向代理 ---
17    server {
18        listen 443 ssl http2;
19        server_name example.com www.example.com;
20
21        ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
22        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
23        ssl_protocols       TLSv1.2 TLSv1.3;
24        ssl_ciphers         HIGH:!aNULL:!MD5;
25
26        # 直接提供静态文件（图片、CSS、JS）
27        location /static/ {
28            root /var/www/myapp;
29            expires 30d;
30            add_header Cache-Control "public, immutable";
31        }
32
33        # 将其余所有请求代理到后端池
34        location / {
35            proxy_pass         http://app_backend;
36            proxy_set_header   Host              $host;
37            proxy_set_header   X-Real-IP         $remote_addr;
38            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
39            proxy_set_header   X-Forwarded-Proto $scheme;
40            proxy_connect_timeout 5s;
41            proxy_read_timeout    60s;
42        }
43    }
44
45    # --- HTTP → HTTPS 重定向 ---
46    server {
47        listen 80;
48        server_name example.com www.example.com;
49        return 301 https://$host$request_uri;
50    }
51}

 1http {
 2    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
 3
 4    server {
 5        location /api/ {
 6            limit_req zone=api_limit burst=20 nodelay;
 7            proxy_pass http://app_backend;
 8        }
 9    }
10}

 1apiVersion: networking.k8s.io/v1
 2kind: Ingress
 3metadata:
 4  name: myapp-ingress
 5  annotations:
 6    nginx.ingress.kubernetes.io/rewrite-target: /
 7    nginx.ingress.kubernetes.io/limit-rps: "100"
 8spec:
 9  ingressClassName: nginx
10  tls:
11    - hosts:
12        - api.example.com
13      secretName: tls-secret
14  rules:
15    - host: api.example.com
16      http:
17        paths:
18          - path: /v1
19            pathType: Prefix
20            backend:
21              service:
22                name: api-v1-svc
23                port:
24                  number: 80
25          - path: /v2
26            pathType: Prefix
27            backend:
28              service:
29                name: api-v2-svc
30                port:
31                  number: 80

1http {
2    sendfile        on;       # 使用sendfile()系统调用——从磁盘到socket的零拷贝
3    tcp_nopush      on;       # 在发送前合并多个TCP段
4    tcp_nodelay     on;       # 为keep-alive连接禁用Nagle算法
5    keepalive_timeout 65;     # 保持TCP连接65秒（减少重复TLS握手）
6    gzip            on;
7    gzip_types      text/plain text/css application/json application/javascript;
8    gzip_min_length 1000;     # 不压缩小于1KB的文件（开销大于收益）
9}