Nginx 网站服务器优化完全指南：从基础配置到性能调优

Nginx 网站服务器优化完全指南：从基础配置到性能调优

Nginx 以其高性能、低资源消耗和灵活配置成为最流行的 Web 服务器和反向代理方案。超过 30% 的网站使用 Nginx。

基础配置模板

# /etc/nginx/nginx.conf
user www-data;
worker_processes auto;
worker_rlimit_nofile 65535;
pid /run/nginx.pid;

events {
    worker_connections 4096;
    use epoll;
    multi_accept on;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    # 基础优化
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    server_tokens off;
}

静态文件服务优化

对于托管静态资源的 Nginx，以下配置可显著提升性能：

server {
    listen 80;
    server_name static.example.com;
    root /var/www/static;
    
    # 启用 Gzip 压缩
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
    gzip_min_length 256;
    gzip_comp_level 5;
    gzip_vary on;
    
    # 浏览器缓存
    location ~* \.(jpg|jpeg|png|gif|ico|webp|svg)$ {
        expires 365d;
        add_header Cache-Control "public, immutable";
    }
    
    location ~* \.(css|js)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
    }
    
    location ~* \.(html|json)$ {
        expires 1h;
        add_header Cache-Control "public, must-revalidate";
    }
}

反向代理配置

server {
    listen 443 ssl http2;
    server_name example.com;
    
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # 缓冲优化
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 32k;
        proxy_busy_buffers_size 64k;
        proxy_temp_file_write_size 64k;
    }
    
    location /api/ {
        proxy_pass http://127.0.0.1:8080;
        proxy_read_timeout 60s;
        proxy_send_timeout 60s;
    }
}

安全加固配置

# 隐藏 Nginx 版本号
server_tokens off;

# 安全响应头
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

# 限制请求速率
limit_req_zone $binary_remote_addr zone=mylimit:10m rate=30r/s;
location /login/ {
    limit_req zone=mylimit burst=5 nodelay;
}

# 限制连接数
limit_conn_zone $binary_remote_addr zone=addr:10m;
server {
    limit_conn addr 100;
}

性能调优技巧

1. 使用 HTTP/2 或 HTTP/3

HTTP/2 支持多路复用，HTTP/3（基于 QUIC）进一步降低延迟。

listen 443 ssl http2;
# HTTP/3 需要额外配置
listen 443 quic reuseport;

2. 开启 OpenSSL 硬件加速

ssl_engine aesni;

3. 调整内核参数

# /etc/sysctl.conf
net.core.somaxconn = 65535
net.ipv4.tcp_max_tw_buckets = 2000000
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_tw_reuse = 1
net.core.netdev_max_backlog = 5000

性能检测命令

# 测试 Nginx 配置
nginx -t

# 查看 Nginx 状态
systemctl status nginx

# 实时请求统计
tail -f /var/log/nginx/access.log | grep -c "GET"

# 使用 ab 进行压力测试
ab -n 10000 -c 100 https://example.com/

16IDC 观察

Nginx 是网站服务器领域的事实标准。对于大多数网站，Nginx 加上 CDN 的架构已经能够满足性能需求。正确配置 Gzip、缓存策略和安全头可以在不增加硬件成本的情况下显著提升网站表现。

参考我们的 服务器推荐 选择合适的 Nginx 运行环境。