Web 服务器搭建指南

# Ubuntu / Debian
sudo apt update
sudo apt install nginx -y

# 启动并设置开机自启
sudo systemctl start nginx
sudo systemctl enable nginx

# 查看运行状态
sudo systemctl status nginx

server {
    listen 80;
    server_name example.com www.example.com;
    
    root /var/www/mysite;
    index index.html index.htm;

    # 日志配置
    access_log /var/log/nginx/mysite_access.log;
    error_log /var/log/nginx/mysite_error.log;

    location / {
        try_files $uri $uri/ =404;
    }

    # Gzip 压缩
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml;
}

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

upstream backend {
    least_conn;  # 最少连接数负载均衡策略
    server backend1.example.com:8080;
    server backend2.example.com:8080;
    server backend3.example.com:8080;
}

server {
    listen 80;
    server_name app.example.com;

    location / {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

# Ubuntu / Debian (软件包名为 apache2)
sudo apt update
sudo apt install apache2 -y

# CentOS / RHEL (软件包名为 httpd)
sudo yum install httpd -y

# 启动并设置开机自启
sudo systemctl start apache2  # 或 httpd
sudo systemctl enable apache2

# 查看运行状态
sudo systemctl status apache2

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/mysite

    <Directory /var/www/mysite>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # 日志配置
    ErrorLog ${APACHE_LOG_DIR}/mysite_error.log
    CustomLog ${APACHE_LOG_DIR}/mysite_access.log combined
</VirtualHost>

# 开启 Rewrite 引擎
RewriteEngine On

# 强制使用 HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

# 去除 www 前缀
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

# PHP 伪静态规则示例
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?route=$1 [L,QSA]

# 添加 Caddy 官方源
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list

# 安装
sudo apt update
sudo apt install caddy -y

# 查看状态
sudo systemctl status caddy

# 简单的 HTTPS 静态网站
example.com {
    root * /var/www/mysite
    file_server
}

# 高级配置示例
example.com {
    # 指定根目录
    root * /var/www/mysite
    
    # 开启文件服务器
    file_server
    
    # 启用 Gzip 压缩
    encode gzip
    
    # 自定义日志
    log {
        output file /var/log/caddy/example.log
        format console
    }
    
    # 反向代理到后端应用
    reverse_proxy /api/* localhost:3000
    
    # 自定义响应头
    header {
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Referrer-Policy "no-referrer-when-downgrade"
    }
}

# 多个子域名
blog.example.com {
    root * /var/www/blog
    file_server
    php_fastcgi unix//run/php/php-fpm.sock
}

api.example.com {
    reverse_proxy localhost:8080
}

# Ubuntu / Debian
sudo apt update
sudo apt install certbot python3-certbot-nginx python3-certbot-apache -y

# CentOS / RHEL (需要 EPEL 源)
sudo yum install epel-release -y
sudo yum install certbot python3-certbot-nginx python3-certbot-apache -y

# 测试自动续期
sudo certbot renew --dry-run

# 查看已安装的证书
sudo certbot certificates

# 手动续期所有证书
sudo certbot renew

# Certbot 会自动添加定时任务，查看
sudo systemctl list-timers | grep certbot

# 安全配置示例 - 添加到 http 块或 server 块

# 隐藏 Nginx 版本号
server_tokens off;

# 防止点击劫持
add_header X-Frame-Options "SAMEORIGIN" always;

# 防止 MIME 类型嗅探
add_header X-Content-Type-Options "nosniff" always;

# XSS 保护
add_header X-XSS-Protection "1; mode=block" always;

# 推荐的 SSL 配置
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;

# DDoS 防护基础配置
limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;
limit_req zone=one burst=20 nodelay;

# 限制请求体大小
client_max_body_size 10M;