1
http {
2
    sendfile on;                 # 零拷贝发送静态文件
3
    tcp_nopush on;               # 与 sendfile 配合，减少网络包数量
4
    tcp_nodelay on;              # keepalive 连接上立即发送小包
5
    keepalive_timeout 65;        # 长连接保持时间
6
    keepalive_requests 100;      # 单连接最大请求数
7
}

1
http {
2
    client_body_buffer_size 16k;
3
    client_header_buffer_size 1k;
4
    large_client_header_buffers 4 8k;   # 大请求头缓冲（URL 过长时用到）
5
    client_max_body_size 10m;           # 上传文件大小限制
6
    client_body_timeout 12s;
7
    client_header_timeout 12s;
8
    send_timeout 10s;
9
    reset_timedout_connection on;       # 超时连接立刻释放，不占用 FIN_WAIT
10
}

1
http {
2
    gzip on;
3
    gzip_comp_level 5;
4
    gzip_min_length 256;                # 小于 256 字节不压缩
5
    gzip_vary on;                       # 响应头加 Vary: Accept-Encoding
6
    gzip_proxied any;
7
    gzip_types
8
        text/plain
9
        text/css
10
        text/xml
11
        text/javascript
12
        application/json
13
        application/javascript
14
        application/xml+rss
15
        image/svg+xml;
16
    gzip_disable "msie6";               # IE6 不压缩（有兼容问题）
17
}

1
# 在主配置顶部加载动态模块
2
load_module modules/ngx_http_brotli_filter_module.so;
3

4
http {
5
    brotli on;
6
    brotli_comp_level 6;                # 推荐 4-6，11 CPU 翻倍但收益递减
7
    brotli_min_length 256;
8
    brotli_types text/plain text/css application/json application/javascript text/xml image/svg+xml;
9
    brotli_static on;                   # 优先使用预压缩的 .br 文件
10

11
    # Brotli 和 gzip 二选一，避免重复压缩（浏览器不支持 Brotli 时回退 gzip）
12
    gzip on;                            # 保留 gzip 作为回退
13
}

1
server {
2
    location ~* \.(jpg|jpeg|png|gif|ico|webp|svg|css|js|woff|woff2|ttf|eot)$ {
3
        expires 30d;
4
        add_header Cache-Control "public, immutable";
5
    }
6
}

1
# nginx.conf 全局配置中
2
http {
3
    quic_retry on;           # 防 QUIC 泛洪攻击
4
    # quic_gso on;           # 需要 Linux 内核 ≥5.4 且支持 UDP_SEGMENT
5

6
    server {
7
        # 同时监听 QUIC (UDP) 和标准 HTTPS (TCP)
8
        listen 443 quic reuseport;
9
        listen 443 ssl;
10

11
        server_name example.com;
12

13
        ssl_certificate     /etc/nginx/ssl/fullchain.pem;
14
        ssl_certificate_key /etc/nginx/ssl/privkey.pem;
15

16
        # 告知客户端支持 HTTP/3
17
        add_header Alt-Svc 'h3=":443"; ma=86400';
18
    }
19
}

1
server {
2
    listen 443 ssl;
3
    server_name app.example.com;
4

5
    location / {
6
        proxy_pass https://backend.example.com;
7
        proxy_http_version 2;              # 与后端建立 HTTP/2 连接
8
        # HPACK 头部压缩自动生效，减少延迟
9
    }
10
}

1
server {
2
    add_header_inherit merge;                        # 合并而非覆盖
3
    add_header Strict-Transport-Security "max-age=31536000" always;
4

5
    location /api/ {
6
        add_header Content-Security-Policy "default-src 'self'";
7
        # 响应同时包含 HSTS 和 CSP，而不是只有 CSP
8
    }
9
}

1
server {
2
    listen 443 ssl;
3
    ssl_certificate_compression on;    # 需 OpenSSL 3.2+ 或 BoringSSL
4
    ssl_certificate     /etc/nginx/ssl/fullchain.pem;
5
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
6
}

1
http {
2
    log_format detailed '$remote_addr - $ssl_sigalg - $ssl_client_sigalg '
3
                        '[$time_local] "$request" $status';
4

5
    access_log /var/log/nginx/access.log detailed;
6
}

1
http {
2
    server_tokens off;     # 不暴露 Nginx 版本号，降低针对性攻击风险
3
}

1
server {
2
    add_header_inherit merge;          # 1.29.3+，让下面所有头在嵌套 location 中也生效
3

4
    # 强制 HTTPS，一年内浏览器自动转换
5
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
6

7
    # 禁止被嵌入 iframe，防点击劫持
8
    add_header X-Frame-Options "DENY" always;
9

10
    # 禁止 MIME 类型嗅探
11
    add_header X-Content-Type-Options "nosniff" always;
12

13
    # 内容安全策略（根据业务调整）
14
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'" always;
15

16
    # 禁用旧浏览器 Referrer 信息泄露
17
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
18

19
    # 权限策略（限制浏览器 API）
20
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
21
}

1
server {
2
    listen 443 ssl;
3

4
    # 仅允许 TLS 1.2 和 1.3（SSLv3、TLS 1.0、TLS 1.1 已不安全）
5
    ssl_protocols TLSv1.2 TLSv1.3;
6

7
    # 现代加密套件（优先 ECDHE 前向保密）
8
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
9
    ssl_prefer_server_ciphers on;
10

11
    # 会话缓存（减少重复握手计算开销）
12
    ssl_session_cache shared:SSL:10m;
13
    ssl_session_timeout 10m;
14
    ssl_session_tickets off;      # 关闭 session tickets，保证前向保密
15

16
    ssl_certificate     /etc/nginx/ssl/fullchain.pem;
17
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
18

19
    # DH 参数（RSA 密钥交换时的前向保密，≥2048 位）
20
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
21

22
    # OCSP Stapling（减少客户端 OCSP 查询延迟）
23
    ssl_stapling on;
24
    ssl_stapling_verify on;
25
}

1
http {
2
    # 定义限流区域：按客户端 IP，10MB 约能存 16 万个 IP
3
    limit_req_zone $binary_remote_addr zone=general:10m rate=30r/s;
4
    limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
5

6
    server {
7
        # 全站限流
8
        limit_req zone=general burst=50 nodelay;
9

10
        # 登录接口严格限流：每分钟 5 次
11
        location /login {
12
            limit_req zone=login burst=3 nodelay;
13
            proxy_pass http://backend;
14
        }
15
    }
16
}

1
http {
2
    limit_conn_zone $binary_remote_addr zone=per_ip:10m;
3

4
    server {
5
        limit_conn per_ip 20;          # 单个 IP 最大 20 并发连接
6
        limit_conn_status 429;         # 超限返回 429 Too Many Requests
7
    }
8
}

1
server {
2
    # 禁止访问隐藏文件（.env、.git 等）
3
    location ~ /\. {
4
        deny all;
5
        access_log off;
6
        log_not_found off;
7
    }
8

9
    # 禁止访问配置文件和后端代码
10
    location ~* \.(conf|ini|log|sh|sql|bak|swp|save)$ {
11
        deny all;
12
        access_log off;
13
        log_not_found off;
14
    }
15
}

1
server {
2
    location /admin {
3
        allow 192.168.1.0/24;      # 内网网段
4
        allow 10.0.0.0/8;           # VPN 网段
5
        deny all;                     # 拒绝所有其他 IP
6

7
        proxy_pass http://backend;
8
    }
9
}

1
server {
2
    # 只允许 GET、POST、HEAD，拒绝 PUT、DELETE、TRACE 等
3
    if ($request_method !~ ^(GET|POST|HEAD)$) {
4
        return 405;
5
    }
6
}

1
server {
2
    listen 443 ssl http2;
3
    server_name app.example.com;
4

5
    location / {
6
        proxy_pass http://127.0.0.1:3000;
7
        proxy_http_version 1.1;
8

9
        # 传递客户端信息
10
        proxy_set_header Host $host;
11
        proxy_set_header X-Real-IP $remote_addr;
12
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
13
        proxy_set_header X-Forwarded-Proto $scheme;
14

15
        # WebSocket 支持
16
        proxy_set_header Upgrade $http_upgrade;
17
        proxy_set_header Connection "upgrade";
18

19
        # 超时
20
        proxy_connect_timeout 60s;
21
        proxy_send_timeout 60s;
22
        proxy_read_timeout 60s;
23

24
        # 缓冲
25
        proxy_buffering on;
26
        proxy_buffer_size 4k;
27
        proxy_buffers 8 16k;
28
    }
29
}

1
http {
2
    upstream backend {
3
        # 加权轮询（默认算法，weight 越大分到的请求越多）
4
        server 127.0.0.1:3000 weight=3;
5
        server 127.0.0.1:3001 weight=1;
6
        # 备用节点（所有主节点不可用时才启用）
7
        server 192.168.1.100:3000 backup;
8

9
        # keepalive 连接池（减少与后端的 TCP 握手开销）
10
        keepalive 32;
11
        keepalive_timeout 60s;
12
    }
13

14
    server {
15
        location / {
16
            proxy_pass http://backend;
17
            proxy_http_version 1.1;
18
            proxy_set_header Connection "";
19
        }
20
    }
21
}

1
stream {
2
    # 通过 SNI 区分不同后端
3
    map $ssl_preread_server_name $upstream_name {
4
        app1.example.com    backend_app1;
5
        app2.example.com    backend_app2;
6
        default             backend_default;
7
    }
8

9
    upstream backend_app1 { server 10.0.0.1:443; }
10
    upstream backend_app2 { server 10.0.0.2:443; }
11
    upstream backend_default { server 10.0.0.3:443; }
12

13
    server {
14
        listen 443;
15
        proxy_pass $upstream_name;
16
        ssl_preread on;
17
    }
18
}

1
http {
2
    log_format main '$remote_addr - $http_x_forwarded_for - [$time_local] '
3
                    '"$request" $status $body_bytes_sent '
4
                    '"$http_referer" "$http_user_agent" '
5
                    'rt=$request_time uct=$upstream_connect_time '
6
                    'uht=$upstream_header_time urt=$upstream_response_time';
7

8
    access_log /var/log/nginx/access.log main;
9
    error_log  /var/log/nginx/error.log warn;
10
}

1
server {
2
    listen 127.0.0.1:8080;          # 仅本地监听，不对外暴露
3
    server_name localhost;
4

5
    location /nginx_status {
6
        stub_status on;
7
        access_log off;
8
        allow 127.0.0.1;
9
        deny all;
10
    }
11
}

1
Active connections: 291
2
server accepts handled requests
3
 16630948 16630948 31070465
4
Reading: 6 Writing: 179 Waiting: 106

1
scrape_configs:
2
  - job_name: 'nginx'
3
    static_configs:
4
      - targets: ['127.0.0.1:9113']