Nginx 反向代理与负载均衡配置完全手册

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 30s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
}

upstream backend {
    # 1. 轮询（默认）
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;

    # 2. 加权轮询
    # server 192.168.1.10:8080 weight=3;
    # server 192.168.1.11:8080 weight=1;

    # 3. ip_hash（会话保持）
    # ip_hash;

    # 4. least_conn（最少连接）
    # least_conn;

    # 5. 一致性 hash（需第三方模块）
    # hash $request_uri consistent;

    # 故障节点摘除
    server 192.168.1.12:8080 max_fails=3 fail_timeout=30s;
    server 192.168.1.13:8080 backup;
}

location ~* \.(jpg|jpeg|png|gif|css|js|svg|woff2)$ {
    root /var/www/static;
    expires 30d;
    add_header Cache-Control "public, immutable";
    access_log off;
}

location /api/ {
    proxy_pass http://backend;
}

server {
    listen 443 ssl http2;
    server_name www.example.com;

    ssl_certificate     /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers on;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;

    add_header Strict-Transport-Security "max-age=31536000" always;
}

server {
    listen 80;
    server_name www.example.com;
    return 301 https://$host$request_uri;
}

location /ws/ {
    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 3600s;
}

http {
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
    limit_conn_zone $binary_remote_addr zone=conn:10m;

    server {
        location /api/ {
            limit_req zone=api burst=20 nodelay;
            limit_conn conn 20;
            limit_req_status 429;
            proxy_pass http://backend;
        }
    }
}

add_header Access-Control-Allow-Origin $http_origin always;
add_header Access-Control-Allow-Methods 'GET, POST, PUT, DELETE, OPTIONS' always;
add_header Access-Control-Allow-Headers 'Content-Type, Authorization' always;
add_header Access-Control-Allow-Credentials 'true' always;

if ($request_method = OPTIONS) {
    return 204;
}

worker_processes auto;
worker_connections 10240;

sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;

gzip on;
gzip_min_length 1k;
gzip_types text/plain text/css application/json application/javascript;