12.17 Nginx负载均衡
代理服务器代理多个WEB即为均衡，dig命令可以查看域名对应IP地址，安装dig命令为#yum install -y bind-utils
例如#dig qq.com
vim /usr/local/nginx/conf/vhost/load.conf //写入如下内容
-------------------------------------------------------------------------
upstream qq
{
ip_hash; //同一个用户，保持在同一个IP上；
server 61.135.157.156:80;
server 125.39.240.113:80;
}
server
{
listen 80;
server_name www.qq.com;
location /
{
proxy_pass http://qq;
proxy_ser_header Hsot $host;
proxy_ser_header X-Real-IP $remote_addr;
proxy_ser_header X-Forward-For $proxy_add_x_forwarded_for;
}
}
-------------------------------------------------------------------------
curl -x127.0.0.1:80 www.qq.com //正常情况会访问默认网页；
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload
curl -x127.0.0.1:80 www.qq.com
nginx不支持代理https网站
12.18 ssl原理
12.19 生成ssl密钥对
cd /usr/local/nginx/conf
openssl genrsa -des3 -out tmp.key 2048 //key文件为私钥
openssl rsa -in tmp.key -out aminglinux.key //转换key，取消密码
rm -f tmp.key
openssl req -new -key aming.key -out aminglinux.csr //生成证书请求文件，需要拿这个和私钥一起生产公钥文件
openssl x509 -req -days 365 -in aminglinux.csr -singkey aminglinux.key -out aminglinux.crt //这里的amingliux.crt为公钥
12.20 Nginx配置ssl
vim /usr/local/nginx/conf/vhost/ssl.conf //加入如下内容
--------------------------------------------------------------------
server
{
listen 443;
server_name aming.com;
index index.html index.php;
root /data/wwwroot/aming.com; //目录
ssl on; //开启
ssl_certificate aminglinux.crt; //私钥
ssl_certificate_key aminglinux.key; //公钥
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; //协议
}
--------------------------------------------------------------------
/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload //若报错unknown directive "ssl"，需要重新编译nginx，加上--with-http_ssl_module
-------------------------------------------------------------------------
./configure --prefix-/usr/local/nginx --with-http_ssl_module
make
make install
/usr/local/nginx/sbin/nginx -V //查看配置信息
/usr/local/nginx/sbin/nginx -t
/etc/init.d/nginx restart //重启服务
-------------------------------------------------------------------------
netstat -lntp //查看监听端口443
mkdir /data/wwwroot/aming.com
echo "ssl test page." > /data/wwwroot/aming.com/index.html
编辑hosts，增加127.0.0.1 aming.com
vim /etc/hosts
127.0.0.1 其他域名 aming.com
curl https://aming.com/
如果访问不到，查看防火墙，#iptables -nvl
#iptables -F关闭防火墙
扩展
针对请求的uri来代理 http://ask.apelearn.com/question/1049
根据访问的目录来区分后端的web http://ask.apelearn.com/question/920
nginx长连接 http://www.apelearn.com/bbs/thread-6545-1-1.html
nginx算法分析 http://blog.sina.com.cn/s/blog_72995dcc01016msi.html
