Nginx 反向代理与负载均衡:一台服务器扛不住的解决方案

# 添加 epel 源后安装
sudo yum install nginx -y
# 启动并设置开机自启
sudo systemctl start nginx
sudo systemctl enable nginx

# /etc/nginx/conf.d/myapp.conf
server {
    listen 80;
    server_name api.example.com;
    location / {
        # 把所有请求转发到后端 tomcat
        proxy_pass http://192.168.1.101:8080;
        # 关键：把客户端真实 ip 传给后端，不然 tomcat 日志里全是 nginx 的 ip
        proxy_set_header host $host;
        proxy_set_header x-real-ip $remote_addr;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
    }
}

sudo nginx -s reload

# 先定义一个后端服务器池，叫 tomcat_cluster
upstream tomcat_cluster {
    server 192.168.1.101:8080;
    server 192.168.1.102:8080;
}
server {
    listen 80;
    server_name api.example.com;
    location / {
        proxy_pass http://tomcat_cluster;  # 注意这里写的是 upstream 的名字
        proxy_set_header host $host;
        proxy_set_header x-real-ip $remote_addr;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
    }
}

upstream tomcat_cluster {
    server 192.168.1.101:8080;
    server 192.168.1.102:8080;
}

upstream tomcat_cluster {
    server 192.168.1.101:8080 weight=3;
    server 192.168.1.102:8080 weight=1;
}

upstream tomcat_cluster {
    ip_hash;
    server 192.168.1.101:8080;
    server 192.168.1.102:8080;
}

upstream tomcat_cluster {
    least_conn;
    server 192.168.1.101:8080;
    server 192.168.1.102:8080;
}

server {
    listen 80;
    server_name api.example.com;
    root /usr/share/nginx/html;
    # 静态资源直接由 nginx 返回
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2)$ {
        expires 30d;           # 缓存 30 天
        add_header cache-control "public, immutable";
        access_log off;        # 关闭静态资源访问日志，减少磁盘 io
    }
    # 动态请求转发给 tomcat
    location /api/ {
        proxy_pass http://tomcat_cluster;
        proxy_set_header host $host;
        proxy_set_header x-real-ip $remote_addr;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
    }
}

http {
    # 在 nginx.conf 的 http 块里加
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    gzip_min_length 1k;      # 小于 1k 的文件不压缩，省 cpu
    gzip_comp_level 4;       # 压缩级别 1-9，4 是性价比平衡点
}

server {
    listen 443 ssl;
    server_name api.example.com;
    ssl_certificate /etc/nginx/ssl/api.example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/api.example.com.key;
    ssl_protocols tlsv1.2 tlsv1.3;
    location / {
        proxy_pass http://tomcat_cluster;
        proxy_set_header host $host;
        proxy_set_header x-real-ip $remote_addr;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
    }
}
# http 自动跳 https
server {
    listen 80;
    server_name api.example.com;
    return 301 https://$server_name$request_uri;
}

# 在 http 块定义一个连接限制区域
limit_conn_zone $binary_remote_addr zone=addr:10m;
server {
    location /api/ {
        limit_conn addr 10;  # 单个 ip 最多 10 个并发连接
        proxy_pass http://tomcat_cluster;
    }
}

# 在 http 块定义
limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;
server {
    location /api/ {
        limit_req zone=one burst=20 nodelay;  # 每秒 10 个请求，突发 20 个
        proxy_pass http://tomcat_cluster;
    }
}

# /etc/nginx/nginx.conf
user nginx;
worker_processes auto;           # 根据 cpu 核数自动调整
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
    worker_connections 4096;     # 单个 worker 的最大连接数
    use epoll;                   # linux 高性能网络模型
    multi_accept on;
}
http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    # === 日志格式 ===
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    access_log /var/log/nginx/access.log main;
    # === 性能优化 ===
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    client_max_body_size 50m;    # 允许上传的最大文件大小
    # === gzip 压缩 ===
    gzip on;
    gzip_vary on;
    gzip_min_length 1k;
    gzip_comp_level 4;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    # === 负载均衡 upstream ===
    upstream tomcat_cluster {
        least_conn;              # 谁闲给谁，比轮询更智能
        server 192.168.1.101:8080 weight=2;
        server 192.168.1.102:8080 weight=1;
        # 健康检查：失败 3 次认为不可用，恢复 2 次认为可用
        server 192.168.1.101:8080 max_fails=3 fail_timeout=30s;
        server 192.168.1.102:8080 max_fails=3 fail_timeout=30s;
    }
    # === 虚拟主机配置 ===
    server {
        listen 80;
        server_name api.example.com;
        # http 跳转 https（如果不需要 https 可以注释掉）
        return 301 https://$server_name$request_uri;
    }
    server {
        listen 443 ssl;
        server_name api.example.com;
        ssl_certificate /etc/nginx/ssl/api.example.com.crt;
        ssl_certificate_key /etc/nginx/ssl/api.example.com.key;
        ssl_protocols tlsv1.2 tlsv1.3;
        root /usr/share/nginx/html;
        # 静态资源直接由 nginx 处理
        location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2)$ {
            expires 30d;
            add_header cache-control "public, immutable";
            access_log off;
        }
        # 动态 api 转发给 tomcat 集群
        location /api/ {
            proxy_pass http://tomcat_cluster;
            proxy_set_header host $host;
            proxy_set_header x-real-ip $remote_addr;
            proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
            # 连接超时设置
            proxy_connect_timeout 5s;
            proxy_send_timeout 10s;
            proxy_read_timeout 30s;
        }
    }
}

# 先检查语法是否正确
sudo nginx -t
# 语法 ok 后再 reload
sudo nginx -s reload