Nginx virtual host & php-fpm settings

共享我的当前VPS中关于nginx的一些设置,防止自己忘记了。

针对Nginx global的设置(没有写的,说明使用了默认的设置了):

#Nginx进程的用户名和用户组设置,最小权限原则
user www-data www-data;
#Nginx初始化工作进程数
worker_processes 4; 
#启用Nginx的核心安全策略,比如SQL注入,跨站之类
include /etc/nginx/naxsi_core.rules; 
#启用gzip压缩输出,对IE6禁用gzip
gzip on; 
gzip_disable "msie6";

针对Virtaul Host的设置:

首先看Reserve Proxy,

server { 
 ### server port and name ### 
 listen 443; 
 ssl on; 
 server_name ******.zhuoyue.me 
 ### SSL log files ### 
 access_log /var/log/nginx/ssl-access.log; 
 error_log /var/log/nginx/ssl-error.log; 
 
 ### SSL cert files ### 
 ssl_certificate /home/niyouzhu/nginxssl/server.crt; 
 ssl_certificate_key /home/niyouzhu/nginxssl/server.key; 
 
 ### Add SSL specific settings here ### 
 
 
 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; 
 ssl_ciphers RC4:HIGH:!aNULL:!MD5; 
 ssl_prefer_server_ciphers on; 
 keepalive_timeout 60; 
 ssl_session_cache shared:SSL:10m; 
 ssl_session_timeout 10m; 
 
 ### We want full access to SSL via backend ### 
 location / {
 proxy_pass https://localhost:4200; 
 
 ### force timeouts if one of backend is died ## 
 proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504; 
 
 ### Set headers #### 
 proxy_set_header Accept-Encoding ""; 
 proxy_set_header Host $host; 
 proxy_set_header X-Real-IP $remote_addr; 
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
 
 ### Most PHP, Python, Rails, Java App can use this header ### 
 #proxy_set_header X-Forwarded-Proto https;## 
 proxy_set_header X-Forwarded-Proto $scheme; 
 add_header Front-End-Https on; 
 proxy_redirect off; 
 }
 }

上面关于SSL自签名证书的创建,可以看我的另一篇文章:Ubuntu+LAMP+Nginx

再来看一般的Virtual Host设置,

server { 
 listen 80; 
 #listen [::]:8080 default_server ipv6only=on; 
 
 root /home/v.zhuoyue.me; 
 index index.php index.html index.htm; 
 
 # Make site accessible from http://localhost/ 
 server_name v.zhuoyue.me; 
 location / { 
 # First attempt to serve request as file, then 
 # as directory, then fall back to displaying a 404. 
 try_files $uri $uri/ =404; 
 # Uncomment to enable naxsi on this location 
 # include /etc/nginx/naxsi.rules 
 # rewrite ^/index.html$ /index.php last; 
 rewrite ^/vod-(.*)$ /index.php?s=/Home-vod-$1 last; 
 rewrite ^/news-(.*).html$ /index.php?s=/Home-news-$1 last; 
 rewrite ^/special-(.*).html$ /index.php?s=/Home-special-$1 last; 
 rewrite ^/tag-(.*).html$ /index.php?s=/Home-tag-$1 last; 
 rewrite ^/gb-(.*).html$ /index.php?s=/Home-gb-$1 last; 
 rewrite ^/cm-(.*).html$ /index.php?s=/Home-cm-$1 last; 
 rewrite ^/map-(.*).html$ /index.php?s=/Home-map-$1 last; 
 rewrite ^/my-(.*).html$ /index.php?s=/Home-my-$1 last; 
 
 
 
 } 
 
 # Only for nginx-naxsi used with nginx-naxsi-ui : process denied requests 
 #location /RequestDenied { 
 # proxy_pass http://127.0.0.1:8080; 
 #} 
 
 #error_page 404 /404.html; 
 
 # redirect server error pages to the static page /50x.html 
 # 
 #error_page 500 502 503 504 /50x.html; 
 #location = /50x.html { 
 # root /usr/share/nginx/html; 
 #} 
 
 # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 
 # 
 location ~ \.php$ { 
 fastcgi_split_path_info ^(.+\.php)(/.+)$; 
 # # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini 
 # 
 # # With php5-cgi alone: 
 # fastcgi_pass 127.0.0.1:9000; 
 # # With php5-fpm: 
 #启用与php的通信
 fastcgi_pass unix:/var/run/php5-fpm.sock; 
 fastcgi_index index.php; 
 include fastcgi_params; 
 } 
 # deny access to .htaccess files, if Apache's document root 
 # concurs with nginx's one 
 # 
 #location ~ /\.ht { 
 # deny all; 
 #} 
}

最后来看一下php-fpm的设置(设置比较多,这里只列一些与安全和性能有关的),

; Start a new pool named 'www'. 
; the variable $pool can we used in any directive and will be replaced by the 
; pool name ('www' here) 
[www] 

; Unix user/group of processes 
; Note: The user is mandatory. If the group is not set, the default user's group 
; will be used. 
#最小权限原则
user = www-data 
group = www-data 
 
; Set listen(2) backlog. 
; Default Value: 65535 (-1 on FreeBSD and OpenBSD) 
;listen.backlog = 65535 
 
; Set permissions for unix socket, if one is used. In Linux, read/write 
"/etc/php5/fpm/pool.d/www.conf" 392L, 17401C 1,1 Top 
 
; Set permissions for unix socket, if one is used. In Linux, read/write 
; permissions must be set in order to allow connections from a web server. Many 
; BSD-derived systems allow connections regardless of permissions. 
; Default Values: user and group are set as the running user 
; mode is set to 0660 
listen.owner = www-data 
listen.group = www-data 
;listen.mode = 0660 
 
; List of ipv4 addresses of FastCGI clients which are allowed to connect. 
; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original 
; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address 
; must be separated by a comma. If this value is left blank, connections will be 
; accepted from any ip address. 
; Default Value: any 
#只允许监听来本机的请求,请求是由nginx发送给php-fpm的,所以在单机上,可以使用本机
listen.allowed_clients = 127.0.0.1 
 
; Specify the nice(2) priority to apply to the pool processes (only if set) 
; The value can vary from -19 (highest priority) to 20 (lower priority) 
; Note: - It will only work if the FPM master process is launched as root 
; - The pool processes will inherit the master process priority 
; unless it specified otherwise 
; Default Value: no set 
; priority = -19 
 
; Choose how the process manager will control the number of child processes. 
; Possible Values: 
; static - a fixed number (pm.max_children) of child processes; 
; dynamic - the number of child processes are set dynamically based on the 
; following directives. With this process management, there will be 
; always at least 1 children. 
; pm.max_children - the maximum number of children that can 
; be alive at the same time. 
; pm.start_servers - the number of children created on startup. 
; pm.min_spare_servers - the minimum number of children in 'idle' 
; state (waiting to process). If the number 
; of 'idle' processes is less than this 
; number then some children will be created. 
; of 'idle' processes is less than this 
; number then some children will be created. 
; pm.max_spare_servers - the maximum number of children in 'idle' 
; state (waiting to process). If the number 
; of 'idle' processes is greater than this 
; number then some children will be killed. 
; ondemand - no children are created at startup. Children will be forked when 
; new requests will connect. The following parameter are used: 
; pm.max_children - the maximum number of children that 
; can be alive at the same time. 
; pm.process_idle_timeout - The number of seconds after which 
; an idle process will be killed. 
; Note: This value is mandatory. 
#根据算法自动进行优化,动态进程管理
pm = dynamic 
 
; The number of child processes to be created when pm is set to 'static' and the 
; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'. 
; This value sets the limit on the number of simultaneous requests that will be 
; served. Equivalent to the ApacheMaxClients directive with mpm_prefork. 
; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP 
; CGI. The below defaults are based on a server without much resources. Don't 
; forget to tweak pm.* to fit your needs. 
; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand' 
; Note: This value is mandatory. 
pm.max_children = 10 
 
; The number of child processes created on startup. 
; Note: Used only when pm is set to 'dynamic' 
; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2 
pm.start_servers = 2 
 
; The desired minimum number of idle server processes. 
; Note: Used only when pm is set to 'dynamic' 
; Note: Mandatory when pm is set to 'dynamic' 
pm.min_spare_servers = 1 
 
; The desired maximum number of idle server processes. 
; Note: Used only when pm is set to 'dynamic' 
; Note: Mandatory when pm is set to 'dynamic' 
; Note: Mandatory when pm is set to 'dynamic' 
pm.max_spare_servers = 3 
 
; The number of seconds after which an idle process will be killed. 
; Note: Used only when pm is set to 'ondemand' 
; Default Value: 10s 
;pm.process_idle_timeout = 10s; 
 
; The number of requests each child process should execute before respawning. 
; This can be useful to work around memory leaks in 3rd party libraries. For 
; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS. 
; Default Value: 0 
pm.max_requests = 500 
 

 

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.