Certbot\u5c06\u81ea\u52a8\u4fee\u6539\u60a8\u7684\u914d\u7f6e\u4ee5\u4f7f\u7528\u65b0\u8bc1\u4e66\u3002\u5b83\u8fd8\u8bbe\u7f6e\u4e86\u4e00\u4e2a\u5b9a\u65f6\u4efb\u52a1\u7528\u4e8e\u81ea\u52a8\u66f4\u65b0\u3002\u8981\u6d4b\u8bd5\u66f4\u65b0\u8fc7\u7a0b,\u8bf7\u8fd0\u884c:<\/p>\n

sudo certbot renew --dry-run\r\n<\/code><\/pre>\n
\u8981\u83b7\u5f97\u66f4\u597d\u7684\u5b89\u5168\u6027,\u8003\u8651\u901a\u8fc7\u5728\u670d\u52a1\u5668\u5757\u4e2d\u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9\u6765\u5b9e\u73b0HSTS(HTTP\u4e25\u683c\u4f20\u8f93\u5b89\u5168):<\/p>\n
add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;\r\n<\/code><\/pre>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n
\u9ad8\u7ea7\u6027\u80fd\u4f18\u5316\u6280\u672f<\/strong><\/h2>\n
\u4f18\u5316Nginx\u7684\u6027\u80fd\u53ef\u4ee5\u663e\u8457\u63d0\u9ad8\u60a8\u7f51\u7ad9\u7684\u901f\u5ea6\u548c\u7528\u6237\u4f53\u9a8c\u3002\u8ba9\u6211\u4eec\u63a2\u8ba8\u4e00\u4e9b\u9ad8\u7ea7\u6280\u672f:<\/p>\n
\u5b9e\u65bd\u9ad8\u6548\u7684Gzip\u538b\u7f29<\/h3>\n
Gzip\u538b\u7f29\u53ef\u4ee5\u5927\u5e45\u51cf\u5c11\u4f20\u8f93\u6570\u636e\u7684\u5927\u5c0f\u3002\u5728\u60a8\u7684`nginx.conf`\u6216\u670d\u52a1\u5668\u5757\u4e2d\u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9:<\/p>\n
gzip on;\r\ngzip_vary on;\r\ngzip_min_length 1000;\r\ngzip_proxied expired no-cache no-store private auth;\r\ngzip_types text\/plain text\/css text\/xml text\/javascript application\/x-javascript application\/xml application\/json;\r\ngzip_disable \"MSIE [1-6]\\.\";\r\n<\/code><\/pre>\n
\u4f18\u5316\u7f13\u5b58\u7b56\u7565<\/h3>\n
\u6709\u6548\u7684\u7f13\u5b58\u53ef\u4ee5\u663e\u8457\u51cf\u5c11\u670d\u52a1\u5668\u8d1f\u8f7d\u5e76\u6539\u5584\u54cd\u5e94\u65f6\u95f4\u3002\u901a\u8fc7\u5728\u670d\u52a1\u5668\u5757\u4e2d\u6dfb\u52a0\u8fd9\u4e9b\u6307\u4ee4\u6765\u5b9e\u73b0\u6d4f\u89c8\u5668\u7f13\u5b58:<\/p>\n
location ~* \\.(jpg|jpeg|png|gif|ico|css|js)$ {\r\n    expires 30d;\r\n    add_header Cache-Control \"public, no-transform\";\r\n}\r\n<\/code><\/pre>\n
\u5bf9\u4e8e\u52a8\u6001\u5185\u5bb9,\u8003\u8651\u5b9e\u65bd\u5fae\u7f13\u5b58:<\/p>\n
fastcgi_cache_path \/tmp\/nginx_cache levels=1:2 keys_zone=MYAPP:100m inactive=60m;\r\nfastcgi_cache_key \"$scheme$request_method$host$request_uri\";\r\n\r\nserver {\r\n    set $no_cache 0;\r\n    \r\n    if ($request_method = POST) {\r\n        set $no_cache 1;\r\n    }\r\n    if ($query_string != \"\") {\r\n        set $no_cache 1;\r\n    }\r\n\r\n    location ~ \\.php$ {\r\n        fastcgi_cache MYAPP;\r\n        fastcgi_cache_valid 200 60m;\r\n        fastcgi_cache_use_stale error timeout http_500 http_503;\r\n        fastcgi_cache_bypass $no_cache;\r\n        fastcgi_no_cache $no_cache;\r\n    }\r\n}\r\n<\/code><\/pre>\n
\u5fae\u8c03\u5de5\u4f5c\u8fdb\u7a0b\u548c\u8fde\u63a5<\/h3>\n
\u6839\u636e\u670d\u52a1\u5668\u7684CPU\u6838\u5fc3\u4f18\u5316Nginx\u7684\u5de5\u4f5c\u8fdb\u7a0b:<\/p>\n
worker_processes auto;\r\nworker_rlimit_nofile 65535;\r\n\r\nevents {\r\n    worker_connections 65535;\r\n    multi_accept on;\r\n    use epoll;\r\n}\r\n<\/code><\/pre>\n
Nginx\u7684\u6709\u6548\u6545\u969c\u6392\u9664\u7b56\u7565<\/strong><\/h2>\n
\u5373\u4f7f\u914d\u7f6e\u6700\u4f18,\u95ee\u9898\u4e5f\u53ef\u80fd\u51fa\u73b0\u3002\u77e5\u9053\u5982\u4f55\u6709\u6548\u8fdb\u884c\u6545\u969c\u6392\u9664\u81f3\u5173\u91cd\u8981:<\/p>\n
\u638c\u63e1\u9519\u8bef\u65e5\u5fd7\u5206\u6790<\/h3>\n
\u9519\u8bef\u65e5\u5fd7\u901a\u5e38\u4f4d\u4e8e`\/var\/log\/nginx\/error.log`\u3002\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u5b9e\u65f6\u76d1\u63a7\u5b83\u4eec:<\/p>\n
tail -f \/var\/log\/nginx\/error.log\r\n<\/code><\/pre>\n
\u5bf9\u4e8e\u66f4\u9ad8\u7ea7\u7684\u65e5\u5fd7\u5206\u6790,\u8003\u8651\u4f7f\u7528GoAccess\u6216ELK Stack(Elasticsearch, Logstash, Kibana)\u7b49\u5de5\u5177\u3002<\/p>\n
\u89e3\u51b3\u5e38\u89c1\u9519\u8bef<\/h3>\n
\n
403 Forbidden<\/strong>:\u901a\u5e38\u7531\u6587\u4ef6\u6743\u9650\u95ee\u9898\u5f15\u8d77\u3002\u68c0\u67e5\u76f8\u5173\u6587\u4ef6\u548c\u76ee\u5f55\u7684\u7528\u6237\u6743\u9650\u3002<\/li>\n
502 Bad Gateway<\/strong>:\u901a\u5e38\u8868\u793a\u4e0a\u6e38\u670d\u52a1\u5668\u6216PHP-FPM\u51fa\u73b0\u95ee\u9898\u3002\u68c0\u67e5\u60a8\u7684PHP-FPM\u914d\u7f6e\u5e76\u786e\u4fdd\u5b83\u6b63\u5728\u8fd0\u884c\u3002<\/li>\n
504 Gateway Timeout<\/strong>:\u5982\u679c\u60a8\u7684PHP\u811a\u672c\u9700\u8981\u66f4\u591a\u6267\u884c\u65f6\u95f4,\u8bf7\u589e\u52a0`fastcgi_read_timeout`\u503c\u3002<\/li>\n<\/ul>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n
Nginx\u4e0e\u5176\u4ed6\u670d\u52a1\u7684\u65e0\u7f1d\u96c6\u6210<\/strong><\/h2>\n
\u4f18\u5316Nginx\u4e0ePHP-FPM\u7684\u914d\u5408<\/h3>\n
\u5bf9\u4e8ePHP\u5e94\u7528\u7a0b\u5e8f\u7684\u6700\u4f73\u6027\u80fd,\u914d\u7f6eNginx\u4ee5\u4e0ePHP-FPM\u914d\u5408\u5de5\u4f5c:<\/p>\n
location ~ \\.php$ {\r\n    fastcgi_pass unix:\/var\/run\/php\/php7.4-fpm.sock;\r\n    fastcgi_index index.php;\r\n    include fastcgi_params;\r\n    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;\r\n    fastcgi_intercept_errors on;\r\n    fastcgi_buffer_size 128k;\r\n    fastcgi_buffers 256 16k;\r\n    fastcgi_busy_buffers_size 256k;\r\n    fastcgi_temp_file_write_size 256k;\r\n}\r\n<\/code><\/pre>\n
\u5c06Nginx\u914d\u7f6e\u4e3a\u53cd\u5411\u4ee3\u7406<\/h3>\n
Nginx\u4f5c\u4e3a\u53cd\u5411\u4ee3\u7406\u8868\u73b0\u51fa\u8272\u3002\u4ee5\u4e0b\u662f\u5982\u4f55\u4e3a\u53e6\u4e00\u4e2a\u670d\u52a1\u8bbe\u7f6e\u5b83:<\/p>\n
location \/ {\r\n    proxy_pass http:\/\/localhost:8080;\r\n    proxy_set_header Host $host;\r\n    proxy_set_header X-Real-IP $remote_addr;\r\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\r\n    proxy_set_header X-Forwarded-Proto $scheme;\r\n}\r\n<\/code><\/pre>\n
\u6b64\u914d\u7f6e\u5c06\u8bf7\u6c42\u4ee3\u7406\u5230\u8fd0\u884c\u57288080\u7aef\u53e3\u4e0a\u7684\u670d\u52a1,\u5e76\u4f20\u9012\u91cd\u8981\u7684\u5934\u4fe1\u606f\u3002<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n
\u66f4\u65b0\u548c\u7ef4\u62a4Nginx\u7684\u6700\u4f73\u5b9e\u8df5<\/strong><\/h2>\n
\u5b9a\u671f\u66f4\u65b0\u5bf9\u5b89\u5168\u548c\u6027\u80fd\u81f3\u5173\u91cd\u8981\u3002\u9075\u5faa\u4ee5\u4e0b\u6700\u4f73\u5b9e\u8df5:<\/p>\n
\n
\u5728\u66f4\u65b0\u4e4b\u524d\u59cb\u7ec8\u5907\u4efd\u60a8\u7684\u914d\u7f6e:\n
sudo cp -R \/etc\/nginx \/etc\/nginx-backup-$(date +%F)\r\n<\/code><\/pre>\n<\/li>\n
\u66f4\u65b0Nginx:\n
sudo apt-get update\r\nsudo apt-get upgrade nginx\r\n<\/code><\/pre>\n<\/li>\n
\u66f4\u65b0\u540e\u6d4b\u8bd5\u60a8\u7684\u914d\u7f6e:\n
sudo nginx -t\r\n<\/code><\/pre>\n<\/li>\n
\u5982\u679c\u6d4b\u8bd5\u901a\u8fc7,\u91cd\u65b0\u52a0\u8f7dNginx:\n
sudo systemctl reload nginx\r\n<\/code><\/pre>\n<\/li>\n<\/ol>\n
\u8003\u8651\u8bbe\u7f6e\u4e00\u4e2a\u6682\u5b58\u73af\u5883,\u5728\u5c06\u914d\u7f6e\u66f4\u6539\u5e94\u7528\u5230\u751f\u4ea7\u670d\u52a1\u5668\u4e4b\u524d\u8fdb\u884c\u6d4b\u8bd5\u3002<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text]<\/p>\n
\u7ed3\u8bba:\u63d0\u5347\u60a8\u7684Nginx\u4e13\u4e1a\u77e5\u8bc6<\/strong><\/h2>\n
\u638c\u63e1\u8fd9\u4e9b\u9ad8\u7ea7Nginx\u6280\u672f\u4f7f\u60a8\u80fd\u591f\u521b\u5efa\u4e00\u4e2a\u5f3a\u5927\u3001\u9ad8\u6027\u80fd\u7684Web\u670d\u52a1\u5668\u73af\u5883\u3002\u4ece\u590d\u6742\u7684\u914d\u7f6e\u7ba1\u7406\u5230\u5b9e\u65bd\u6700\u524d\u6cbf\u7684\u5b89\u5168\u63aa\u65bd\u548c\u4f18\u5316\u4ee5\u8fbe\u5230\u6700\u4f73\u6027\u80fd,\u8fd9\u4e9b\u6280\u80fd\u5bf9\u4efb\u4f55\u7cbe\u901a\u6280\u672f\u7684\u670d\u52a1\u5668\u7ba1\u7406\u5458\u6216\u5f00\u53d1\u4eba\u5458\u6765\u8bf4\u90fd\u662f\u65e0\u4ef7\u7684\u3002<\/p>\n
\u5728\u5b9e\u65bd\u8fd9\u4e9b\u7b56\u7565\u65f6,\u8bf7\u8bb0\u4f4f\u670d\u52a1\u5668\u4f18\u5316\u662f\u4e00\u4e2a\u6301\u7eed\u7684\u8fc7\u7a0b\u3002\u5173\u6ce8\u6700\u65b0\u7684Nginx\u529f\u80fd\u548c\u6700\u4f73\u5b9e\u8df5,\u5e76\u4e0d\u8981\u72b9\u8c6b\u5728\u53d7\u63a7\u73af\u5883\u4e2d\u8fdb\u884c\u5b9e\u9a8c\u3002\u65e0\u8bba\u60a8\u662f\u7ba1\u7406\u5c0f\u578b\u670d\u52a1\u5668\u79df\u7528\u8bbe\u7f6e\u8fd8\u662f\u5927\u89c4\u6a21\u670d\u52a1\u5668\u6258\u7ba1\u8bbe\u65bd,\u8fd9\u4e9b\u9ad8\u7ea7\u6280\u80fd\u90fd\u5c06\u786e\u4fdd\u60a8\u7684\u57fa\u7840\u8bbe\u65bd\u4fdd\u6301\u654f\u6377\u3001\u5b89\u5168,\u5e76\u80fd\u591f\u6ee1\u8db3\u73b0\u4ee3Web\u5e94\u7528\u7a0b\u5e8f\u4e0d\u65ad\u53d1\u5c55\u7684\u9700\u6c42\u3002<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"
[vc_row el_class=”blog-detail-section”][vc_column][vc_column_text] \u5728\u52a8\u6001\u7684\u7f51\u7edc\u670d\u52a1\u5668\u4e16\u754c\u4e2d,Nginx\u51ed\u501f\u5176\u65e0\u4e0e\u4f26\u6bd4\u7684\u6548\u7387\u548c\u591a\u529f\u80fd\u6027\u8131\u9896\u800c\u51fa,\u5438\u5f15\u4e86\u5f00\u53d1\u4eba\u5458\u548c\u7cfb\u7edf\u7ba1\u7406\u5458\u7684\u9752\u7750\u3002\u65e0\u8bba\u60a8\u662f\u7ba1\u7406\u4e00\u4e2a\u7b80\u5355\u7684\u670d\u52a1\u5668\u79df\u7528\u73af\u5883,\u8fd8\u662f\u76d1\u7763\u5e9e\u5927\u7684\u670d\u52a1\u5668\u6258\u7ba1\u57fa\u7840\u8bbe\u65bd,\u638c\u63e1Nginx\u7684\u9ad8\u7ea7\u529f\u80fd\u90fd\u53ef\u4ee5\u663e\u8457\u63d0\u5347\u60a8\u670d\u52a1\u5668\u7684\u6027\u80fd\u548c\u5b89\u5168\u6027\u3002\u8fd9\u4efd\u5168\u9762\u7684\u6307\u5357\u6df1\u5165\u63a2\u8ba8\u4e86Nginx\u7684\u590d\u6742\u6027,\u6db5\u76d6\u4e86\u4ece\u9ad8\u7ea7\u914d\u7f6e\u6280\u672f\u5230\u6700\u524d\u6cbf\u7684\u5b89\u5168\u63aa\u65bd\u548c\u6027\u80fd\u4f18\u5316\u7684\u6240\u6709\u5185\u5bb9\u3002 [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text] \u9ad8\u7ea7Nginx\u914d\u7f6e\u6280\u672f Nginx\u5f3a\u5927\u529f\u80fd\u7684\u6838\u5fc3\u5728\u4e8e\u5176\u7075\u6d3b\u7684\u914d\u7f6e\u7cfb\u7edf\u3002\u8ba9\u6211\u4eec\u63a2\u7d22\u4e00\u4e9b\u6709\u6548\u5229\u7528\u8fd9\u79cd\u80fd\u529b\u7684\u9ad8\u7ea7\u7b56\u7565: \u638c\u63e1\u914d\u7f6e\u6587\u4ef6\u7ba1\u7406 Nginx\u7684\u4e3b\u8981\u914d\u7f6e\u6587\u4ef6,\u901a\u5e38\u4f4d\u4e8e`\/etc\/nginx\/nginx.conf`,\u662f\u60a8\u8bbe\u7f6e\u7684\u57fa\u77f3\u3002\u7136\u800c,\u4e3a\u4e86\u5b9e\u73b0\u6700\u4f73\u7684\u7ec4\u7ec7\u548c\u53ef\u7ef4\u62a4\u6027,\u5229\u7528include\u6307\u4ee4\u81f3\u5173\u91cd\u8981\u3002\u8fd9\u79cd\u65b9\u6cd5\u5141\u8bb8\u60a8\u6a21\u5757\u5316\u914d\u7f6e,\u4f7f\u5176\u66f4\u6613\u4e8e\u7ba1\u7406\u548c\u6392\u9664\u6545\u969c\u3002\u8003\u8651\u4ee5\u4e0b\u7ed3\u6784: http { include \/etc\/nginx\/conf.d\/*.conf; include \/etc\/nginx\/sites-enabled\/*; } \u8fd9\u79cd\u7ed3\u6784\u4f7f\u60a8\u80fd\u591f\u5c06\u914d\u7f6e\u5206\u6210\u903b\u8f91\u5355\u5143\u3002\u4f8b\u5982,\u60a8\u53ef\u80fd\u6709\u5355\u72ec\u7684\u6587\u4ef6\u7528\u4e8eSSL\u8bbe\u7f6e\u3001\u7f13\u5b58\u7b56\u7565,\u4ee5\u53ca\u4e0d\u540c\u57df\u540d\u7684\u670d\u52a1\u5668\u5757\u3002 \u5236\u5b9a\u9ad8\u6548\u7684\u865a\u62df\u4e3b\u673a\u914d\u7f6e \u865a\u62df\u4e3b\u673a\u662f\u591a\u57df\u540d\u8bbe\u7f6e\u7684\u57fa\u672c\u6784\u5efa\u5757\u3002\u8981\u521b\u5efa\u865a\u62df\u4e3b\u673a,\u8bf7\u9075\u5faa\u4ee5\u4e0b\u6b65\u9aa4: \u5728`\/etc\/nginx\/sites-available\/`\u4e2d\u521b\u5efa\u65b0\u7684\u914d\u7f6e\u6587\u4ef6 \u5c06\u6b64\u6587\u4ef6\u7b26\u53f7\u94fe\u63a5\u5230`\/etc\/nginx\/sites-enabled\/` \u4f7f\u7528\u9002\u5f53\u7684\u6307\u4ee4\u914d\u7f6e\u670d\u52a1\u5668\u5757 \u4ee5\u4e0b\u662f\u57fa\u672c\u865a\u62df\u4e3b\u673a\u914d\u7f6e\u7684\u793a\u4f8b: server { listen 80; server_name example.com www.example.com; root \/var\/www\/example.com; index index.html index.htm index.php; location \/ { try_files $uri $uri\/ \/index.php?$query_string; } location ~ \\.php$ { fastcgi_pass unix:\/var\/run\/php\/php7.4-fpm.sock; fastcgi_index index.php; include fastcgi_params; } […]<\/p>\n
Read More…<\/a><\/p>\n","protected":false},"author":2,"featured_media":14840,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[62],"tags":[2456,2280,770,353],"class_list":["post-14855","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hong-kong-dedicated-server-sc","tag-ssl-tls-sc","tag-nginx-sc","tag-server-configuration-sc","tag-server-rental-sc"],"acf":[],"yoast_head":"\n