Nginx 源码编译安装与生产级配置全指南（Nginx 系列第 1 期）

apt update -y
apt install -y build-essential libpcre3-dev zlib1g-dev libssl-dev \
    libxslt1-dev libgd-dev libgeoip-dev libgoogle-perftools-dev

# 1. 核心配置目录
mkdir -p /etc/nginx/{conf.d,sites-available,sites-enabled,ssl}

# 2. 日志目录
mkdir -p /var/log/nginx

# 3. 运行时临时文件（body 缓冲、proxy 缓冲等）
mkdir -p /var/lib/nginx/{client_body,proxy,fastcgi,uwsgi,scgi}

# 4. 权限收紧
chown -R www-data:root /var/log/nginx /var/lib/nginx
chmod -R 700 /var/lib/nginx

cd /usr/src

# 下载 Stable 版本（1.30.3，截至 2026 年 7 月最新稳定版）
wget https://nginx.org/download/nginx-1.30.3.tar.gz
tar xzf nginx-1.30.3.tar.gz
cd nginx-1.30.3

./configure \
    --prefix=/usr/share/nginx \
    --sbin-path=/usr/sbin/nginx \
    --modules-path=/usr/lib/nginx/modules \
    --conf-path=/etc/nginx/nginx.conf \
    --error-log-path=/var/log/nginx/error.log \
    --http-log-path=/var/log/nginx/access.log \
    --pid-path=/run/nginx.pid \
    --lock-path=/run/nginx.lock \
    --http-client-body-temp-path=/var/lib/nginx/client_body \
    --http-proxy-temp-path=/var/lib/nginx/proxy \
    --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
    --http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
    --http-scgi-temp-path=/var/lib/nginx/scgi \
    --user=www-data \
    --group=www-data \
    --with-poll_module \
    --with-threads \
    --with-file-aio \
    --with-http_ssl_module \
    --with-http_v2_module \
    --with-http_realip_module \
    --with-http_xslt_module \
    --with-http_image_filter_module \
    --with-http_geoip_module \
    --with-http_sub_module \
    --with-http_dav_module \
    --with-http_flv_module \
    --with-http_mp4_module \
    --with-http_gunzip_module \
    --with-http_gzip_static_module \
    --with-http_auth_request_module \
    --with-http_random_index_module \
    --with-http_secure_link_module \
    --with-http_degradation_module \
    --with-http_slice_module \
    --with-http_stub_status_module \
    --with-mail \
    --with-stream \
    --with-stream_ssl_module \
    --with-stream_ssl_preread_module \
    --with-stream_realip_module \
    --with-stream_geoip_module \
    --with-google_perftools_module \
    --with-pcre

make -j$(nproc) && make install

/usr/sbin/nginx -V
# 输出应包含所有 --with-* 模块的列表

# =====================================================
# Main Nginx configuration file (FHS Standard)
# /etc/nginx/nginx.conf
# =====================================================

user www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
    worker_connections 1024;
    multi_accept on;
}

# =====================================================
# TCP Stream：四层 SNI 预读 —— 同一 443 端口分流
# =====================================================
stream {
    map $ssl_preread_server_name $backend {
        probe.test.com        probe;
        blog.test.com         blog;
        filebox.test.com      filebox;
        default               blog;
    }

    upstream probe   { server 127.0.0.1:10001; }
    upstream blog    { server 127.0.0.1:10002; }
    upstream filebox { server 127.0.0.1:10003; }

    server {
        listen 443 reuseport;
        listen [::]:443 reuseport;
        proxy_protocol on;
        ssl_preread on;
        proxy_pass $backend;
    }
}

# =====================================================
# HTTP：七层配置
# =====================================================
http {
    # --- 真实 IP 获取（配合 Stream 的 proxy_protocol）---
    set_real_ip_from 127.0.0.1;
    set_real_ip_from ::1;
    real_ip_header proxy_protocol;
    real_ip_recursive on;

    server_tokens off;
    sendfile on;

    # --- JSON 格式日志（适配 ELK / Loki 日志平台）---
    log_format json escape=json '{'
        '"time_local":"$time_local",'
        '"remote_addr":"$remote_addr",'
        '"request":"$request",'
        '"status":$status,'
        '"body_bytes_sent":$body_bytes_sent,'
        '"http_referer":"$http_referer",'
        '"http_user_agent":"$http_user_agent",'
        '"request_time":$request_time,'
        '"upstream_response_time":"$upstream_response_time"'
    '}';

    access_log /var/log/nginx/access.log json;
    error_log /var/log/nginx/error.log;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # --- Gzip 压缩优化 ---
    gzip on;
    gzip_comp_level 6;
    gzip_min_length 1k;
    gzip_types text/plain application/xml text/css application/javascript application/json;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*.conf;
}

[Unit]
Description=The NGINX HTTP and reverse proxy server
After=syslog.target network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t -c /etc/nginx/nginx.conf
ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true

[Install]
WantedBy=multi-user.target

cat > /etc/systemd/system/nginx.service << 'EOF'
...（上方内容）...
EOF

systemctl daemon-reload
systemctl enable --now nginx
systemctl status nginx

# 编译完成后，/usr/src/nginx-1.30.3/ 下包含大量 .o 中间文件（约 50 MB）
# 如果你磁盘空间紧张，可以删除源码目录
# 但建议保留——将来需要通过 ./configure 追加模块时需要完整的编译目录

max_clients = worker_processes × worker_connections

max_clients = 4 × 1024 = 4096

ulimit -n 65535
# 或持久化：
echo "www-data soft nofile 65535" >> /etc/security/limits.conf
echo "www-data hard nofile 65535" >> /etc/security/limits.conf

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;