Nginx 反向代理配置详解与性能优化实践

前言

Nginx 作为高性能 HTTP 服务器和反向代理，在生产环境中应用极为广泛。本文将系统讲解 Nginx 反向代理的核心配置，并分享实际项目中的性能优化经验。

一、反向代理基础配置

1.1 基本反向代理

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

1.2 负载均衡配置

upstream backend {
    server 192.168.1.10:3000 weight=3;
    server 192.168.1.11:3000 weight=2;
    server 192.168.1.12:3000 weight=1;
    keepalive 32;
}

server {
    listen 80;
    location / {
        proxy_pass http://backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }
}

二、性能优化要点

2.1 Worker 进程配置

worker_processes auto;
worker_cpu_affinity auto;

events {
    worker_connections 10240;
    use epoll;
    multi_accept on;
}

2.2 Gzip 压缩

gzip on;
gzip_min_length 1k;
gzip_comp_level 6;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript image/svg+xml;
gzip_vary on;
gzip_proxied any;

2.3 静态文件缓存

location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2)$ {
    expires 30d;
    add_header Cache-Control "public, immutable";
    access_log off;
}

三、SSL/TLS 配置

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    add_header Strict-Transport-Security "max-age=63072000" always;
}

四、常见问题排查

4.1 502 Bad Gateway

通常原因：后端服务未启动、端口不通、网络问题。

# 检查后端服务
curl -I http://127.0.0.1:3000

# 查看错误日志
tail -f /var/log/nginx/error.log

# 检查端口
ss -tlnp | grep 3000

4.2 504 Gateway Timeout

后端响应超时，适当调大 proxy_read_timeout。

五、总结

Nginx 反向代理配置看似简单，但要在生产环境中跑出最佳性能，需要在 worker 模型、连接复用、压缩缓存、SSL 优化等多个维度精细调优。建议每次修改配置后用 nginx -t 检查语法，逐步调整观察效果。