# macOS
brew install nginx
 
# Ubuntu/Debian
sudo apt update && sudo apt install nginx -y
 
# 验证
nginx -v
# nginx version: nginx/1.24.0

# 启动（macOS 用 brew services start nginx）
sudo systemctl start nginx
 
# 停止
sudo systemctl stop nginx
# 或直接 sudo nginx -s stop
 
# 重载配置（不中断服务 — 这个命令你会经常用）
sudo nginx -s reload
# 或 sudo systemctl reload nginx
 
# 测试配置语法（改完配置先跑这个，确认没问题再 reload）
sudo nginx -t
# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
# nginx: configuration file /etc/nginx/nginx.conf test is successful
 
# 开机自启
sudo systemctl enable nginx

# 浏览器打开 http://localhost:8080（macOS brew 默认 8080）
# 或者 curl
curl -I http://localhost:8080
 
# 应该看到:
# HTTP/1.1 200 OK
# Server: nginx/1.24.0

# 1. 全局层 — 影响 Nginx 整体行为
worker_processes  auto;         # 工作进程数
 
events {
    worker_connections  1024;   # 每个进程最大连接数
}
 
# 2. HTTP 层 — 所有 HTTP 相关配置的容器
http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
 
    # 3. Server 层 — 一个网站 / 域名
    server {
        listen       80;
        server_name  example.com;
 
        # 4. Location 层 — 某个 URL 路径的规则
        location / {
            root   /var/www/html;
            index  index.html;
        }
 
        location /api/ {
            proxy_pass http://127.0.0.1:3000;
        }
    }
}

# /etc/nginx/conf.d/static-site.conf
server {
    listen       80;
    server_name  localhost;
 
    # 指定静态文件根目录
    root   /var/www/my-site;
    index  index.html;
 
    # 所有请求都去找文件
    location / {
        try_files $uri $uri/ =404;
    }
}

# 创建测试文件
sudo mkdir -p /var/www/my-site
echo '<h1>Hello Nginx</h1>' | sudo tee /var/www/my-site/index.html
 
# 测试配置
sudo nginx -t
 
# 重载
sudo nginx -s reload
 
# 验证
curl http://localhost
# <h1>Hello Nginx</h1>

server {
    listen       80;
    server_name  api.example.com;
 
    # 静态资源让 Nginx 直接处理（比 Node 快 10 倍）
    location /static/ {
        root   /var/www/app/public;
        expires 30d;
    }
 
    # 其他请求转发给 Node 应用
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

proxy_set_header Host $host;
# → 把原始请求的 Host header 传给应用（否则应用收到的是 127.0.0.1:3000）
 
proxy_set_header X-Real-IP $remote_addr;
# → 把真实客户端 IP 放在 X-Real-IP header 里
 
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# → 记录完整的代理链（如果前面还有 CDN / 负载均衡）
 
proxy_set_header X-Forwarded-Proto $scheme;
# → 告诉应用原始请求用的是 HTTP 还是 HTTPS

server {
    listen       80;
    server_name  spa.example.com;
 
    root   /var/www/spa/dist;
    index  index.html;
 
    location / {
        # ★ 关键：找不到文件就回退到 index.html
        try_files $uri $uri/ /index.html;
    }
 
    # 静态资源（JS/CSS/图片）— 加长缓存
    location /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
}

location = /api/health {
    return 200 "精确匹配: health check";
}
 
location ^~ /static/ {
    return 200 "前缀优先: static 文件";
}
 
location ~ \.php$ {
    return 200 "正则: PHP 文件";
}
 
location /api/ {
    return 200 "普通前缀: API 请求";
}
 
location / {
    return 200 "兜底: 其他所有请求";
}

# 定义一组后端服务器
upstream app_servers {
    # 默认轮询（round-robin）
    server 127.0.0.1:3000;
    server 127.0.0.1:3001;
    server 127.0.0.1:3002;
 
    # 可选：加权（weight 越大分配越多）
    # server 127.0.0.1:3000 weight=3;
    # server 127.0.0.1:3001 weight=1;
}
 
server {
    location / {
        proxy_pass http://app_servers;  # ← 用 upstream 名代替具体地址
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

# 在 http 块里定义限流规则
http {
    # 每个 IP 每秒最多 10 个请求（超出返回 503）
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
 
    server {
        location /api/ {
            limit_req zone=api_limit burst=20 nodelay;
            # burst=20  →  允许瞬间多 20 个请求排队
            # nodelay    →  不延迟，超出 burst 直接 503
            proxy_pass http://127.0.0.1:3000;
        }
    }
}

http {
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml;
    gzip_min_length 1000;       # 小于 1KB 不压缩（压缩反而变大）
    gzip_comp_level 5;          # 压缩级别 1-9（5 是性价比较好的点）
    gzip_vary on;               # 告诉 CDN「这个资源有压缩版」
}

server {
    location /api/ {
        # 允许跨域的域名
        add_header Access-Control-Allow-Origin "https://example.com";
        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
        add_header Access-Control-Allow-Headers "Content-Type, Authorization";
 
        # ★ OPTIONS 预检请求直接返回 204，不转发给应用
        if ($request_method = OPTIONS) {
            return 204;
        }
 
        proxy_pass http://127.0.0.1:3000;
    }
}

server {
    location /ws/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;                    # ← WebSocket 需要 HTTP/1.1
        proxy_set_header Upgrade $http_upgrade;     # ← 协议升级
        proxy_set_header Connection "upgrade";      # ← 保持连接
        proxy_set_header Host $host;
        proxy_read_timeout 86400s;                  # ← WebSocket 长连接不超时
    }
}

# HTTP 永久重定向到 HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}
 
# 旧域名重定向到新域名
server {
    listen 80;
    server_name old-domain.com;
    return 301 https://new-domain.com$request_uri;
}

sudo nginx -t
# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
# nginx: configuration file /etc/nginx/nginx.conf test is successful

# 实时跟踪错误日志
sudo tail -f /var/log/nginx/error.log
 
# 查看最近 50 条
sudo tail -n 50 /var/log/nginx/error.log
 
# 常见错误解读
# "connect() failed (111: Connection refused)" → proxy_pass 的应用没启动
# "Permission denied" → 文件权限不对
# "primary script unknown" → root 路径不对

# 实时看谁在访问
sudo tail -f /var/log/nginx/access.log
 
# 输出格式（默认）:
# 1.2.3.4 - - [21/Jul/2026:10:30:00 +0800] "GET /api/users HTTP/1.1" 200 1234
#    ↑ IP        ↑ 时间                    ↑ 请求行               ↑ 状态码 ↑ 响应大小
 
# 加自定义日志格式（调试时很有用）
log_format debug '$remote_addr [$time_local] "$request" '
                 '$status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent" '
                 'upstream=$upstream_addr rt=$upstream_response_time';

sudo nginx -t                          # 配置语法检查（改配置后第一步）
sudo nginx -s reload                   # 热重载（不中断服务）
sudo tail -f /var/log/nginx/error.log  # 实时错误日志
sudo tail -f /var/log/nginx/access.log # 实时访问日志
curl -I http://localhost               # 快速验证响应头
curl -v http://localhost/api/users     # 看完整请求-响应过程