[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"knowledge-\u002Fapi\u002Fknowledge\u002Fbooklet\u002Fuphold\u002Fnginx\u002Fse":3,"knowledge-related-\u002Fknowledge\u002Fbooklet\u002Fuphold\u002Fnginx\u002Fse":933,"knowledge-series-\u002Fknowledge\u002Fbooklet\u002Fuphold\u002Fnginx\u002Fse":955},{"source":4,"connector":5,"page":6},"sqlite","better-sqlite3",{"path":7,"title":8,"description":9,"category":10,"tags":11,"date":14,"pinned":15,"draft":15,"body":16,"seo":929,"stem":930,"id":931,"extension":932},"\u002Fknowledge\u002Fbooklet\u002Fuphold\u002Fnginx\u002Fse","安全基础","Nginx 作为流量的总入口，安全配置是防线第一关。以下从六个基础维度加固你的服务，既实用又立竿见影。","技能小册",[12,13],"nginx","se","2024-12-02",false,{"type":17,"value":18,"toc":918},"minimark",[19,22,54,56,61,71,76,104,115,119,125,139,144,205,215,219,222,234,240,244,302,318,325,328,332,377,388,392,398,407,435,440,450,477,483,487,490,494,497,521,544,548,551,560,566,570,627,630,668,671,675,678,826,842,846,858,861,914],[20,21,8],"h1",{"id":8},[23,24,25],"blockquote",{},[26,27,28,29,33,34,38,39,42,43,48,49,53],"p",{},"本文文件名为 ",[30,31,32],"code",{},"se.md","（security 缩写），对应本目录学习路径中「阶段 10：调优与安全」的",[35,36,37],"strong",{},"安全","部分；姊妹篇 ",[30,40,41],{},"seror.md","（service error 缩写）为",[44,45,47],"a",{"href":46},"\u002Fknowledge\u002Fbooklet\u002Fuphold\u002Fnginx\u002Fseror","常见故障排查思路","。核心概念见 ",[44,50,52],{"href":51},"\u002Fknowledge\u002Fbooklet\u002Fuphold\u002Fnginx\u002Fbase","Nginx 核心概念","。",[26,55,9],{},[57,58,60],"h3",{"id":59},"一隐藏版本信息","一、隐藏版本信息",[26,62,63,66,67,70],{},[35,64,65],{},"风险","：报错页面或响应头中的 ",[30,68,69],{},"Server: nginx\u002F1.xx.x"," 会暴露软件版本，方便攻击者利用已知漏洞。",[26,72,73],{},[35,74,75],{},"配置",[77,78,82],"pre",{"className":79,"code":80,"language":12,"meta":81,"style":81},"language-nginx shiki shiki-themes material-theme-lighter github-light github-dark","http {\n    server_tokens off;\n}\n","",[30,83,84,92,98],{"__ignoreMap":81},[85,86,89],"span",{"class":87,"line":88},"line",1,[85,90,91],{},"http {\n",[85,93,95],{"class":87,"line":94},2,[85,96,97],{},"    server_tokens off;\n",[85,99,101],{"class":87,"line":100},3,[85,102,103],{},"}\n",[26,105,106,107,110,111,114],{},"效果：响应头变为 ",[30,108,109],{},"Server: nginx","，不再含有具体版本。可选地，通过第三方模块 ",[30,112,113],{},"headers-more-nginx-module"," 可以更彻底地修改或清除该头。",[57,116,118],{"id":117},"二ip-访问控制","二、IP 访问控制",[26,120,121,124],{},[35,122,123],{},"场景","：管理后台、内部接口仅允许特定 IP 或网段访问；屏蔽已知恶意 IP。",[26,126,127,130,131,134,135,138],{},[35,128,129],{},"指令","：",[30,132,133],{},"allow"," \u002F ",[30,136,137],{},"deny","，从上到下依次匹配。",[26,140,141],{},[35,142,143],{},"配置示例",[77,145,147],{"className":79,"code":146,"language":12,"meta":81,"style":81},"location \u002Fadmin {\n    allow 192.168.1.0\u002F24;\n    allow 10.0.0.0\u002F8;\n    deny all;                 # 拒绝其余所有\n}\n\nlocation \u002Finternal-api {\n    deny 192.168.1.100;       # 拒绝特定 IP\n    allow all;\n}\n",[30,148,149,154,159,164,170,175,182,188,194,200],{"__ignoreMap":81},[85,150,151],{"class":87,"line":88},[85,152,153],{},"location \u002Fadmin {\n",[85,155,156],{"class":87,"line":94},[85,157,158],{},"    allow 192.168.1.0\u002F24;\n",[85,160,161],{"class":87,"line":100},[85,162,163],{},"    allow 10.0.0.0\u002F8;\n",[85,165,167],{"class":87,"line":166},4,[85,168,169],{},"    deny all;                 # 拒绝其余所有\n",[85,171,173],{"class":87,"line":172},5,[85,174,103],{},[85,176,178],{"class":87,"line":177},6,[85,179,181],{"emptyLinePlaceholder":180},true,"\n",[85,183,185],{"class":87,"line":184},7,[85,186,187],{},"location \u002Finternal-api {\n",[85,189,191],{"class":87,"line":190},8,[85,192,193],{},"    deny 192.168.1.100;       # 拒绝特定 IP\n",[85,195,197],{"class":87,"line":196},9,[85,198,199],{},"    allow all;\n",[85,201,203],{"class":87,"line":202},10,[85,204,103],{},[26,206,207,210,211,214],{},[35,208,209],{},"注意","：在 CDN 或反向代理之后，客户端 IP 可能被隐藏，需配合 ",[30,212,213],{},"ngx_http_realip_module"," 获取真实 IP 后再做控制。",[57,216,218],{"id":217},"三限制速率防-cc-攻击","三、限制速率（防 CC 攻击）",[26,220,221],{},"通过限制单个 IP 的请求速率，防止恶意刷接口、撞库、CC 攻击。",[223,224,226,227,230,231],"h4",{"id":225},"_1-限制请求速率limit_req_zone-limit_req","1. 限制请求速率：",[30,228,229],{},"limit_req_zone"," + ",[30,232,233],{},"limit_req",[26,235,236,239],{},[35,237,238],{},"原理","：基于共享内存的漏斗算法（leaky bucket），以固定速率处理请求，超过的返回 503 或延迟处理。",[26,241,242],{},[35,243,143],{},[77,245,247],{"className":79,"code":246,"language":12,"meta":81,"style":81},"http {\n    # 定义限流区域：以客户端 IP 为键，10m 内存空间，每秒最多 10 个请求\n    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r\u002Fs;\n\n    server {\n        location \u002Fapi\u002F {\n            limit_req zone=api_limit burst=20 nodelay;\n            proxy_pass http:\u002F\u002Fbackend;\n        }\n    }\n}\n",[30,248,249,253,258,263,267,272,277,282,287,292,297],{"__ignoreMap":81},[85,250,251],{"class":87,"line":88},[85,252,91],{},[85,254,255],{"class":87,"line":94},[85,256,257],{},"    # 定义限流区域：以客户端 IP 为键，10m 内存空间，每秒最多 10 个请求\n",[85,259,260],{"class":87,"line":100},[85,261,262],{},"    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r\u002Fs;\n",[85,264,265],{"class":87,"line":166},[85,266,181],{"emptyLinePlaceholder":180},[85,268,269],{"class":87,"line":172},[85,270,271],{},"    server {\n",[85,273,274],{"class":87,"line":177},[85,275,276],{},"        location \u002Fapi\u002F {\n",[85,278,279],{"class":87,"line":184},[85,280,281],{},"            limit_req zone=api_limit burst=20 nodelay;\n",[85,283,284],{"class":87,"line":190},[85,285,286],{},"            proxy_pass http:\u002F\u002Fbackend;\n",[85,288,289],{"class":87,"line":196},[85,290,291],{},"        }\n",[85,293,294],{"class":87,"line":202},[85,295,296],{},"    }\n",[85,298,300],{"class":87,"line":299},11,[85,301,103],{},[303,304,305,312],"ul",{},[306,307,308,311],"li",{},[30,309,310],{},"burst=20","：允许瞬间突发 20 个请求排队，超过的直接拒绝。",[306,313,314,317],{},[30,315,316],{},"nodelay","：立即处理突发请求而不引入延迟，适合保持响应速度。",[223,319,321,322],{"id":320},"_2-限制并发连接limit_conn","2. 限制并发连接：",[30,323,324],{},"limit_conn",[26,326,327],{},"针对某个 IP 同时占用的连接数量，防止单 IP 占满所有连接。",[26,329,330],{},[35,331,143],{},[77,333,335],{"className":79,"code":334,"language":12,"meta":81,"style":81},"http {\n    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;\n\n    server {\n        limit_conn conn_limit 10;         # 每个 IP 最多 10 个并发连接\n        limit_conn_log_level warn;        # 达到限制时的日志级别\n        limit_conn_status 503;            # 返回的状态码\n    }\n}\n",[30,336,337,341,346,350,354,359,364,369,373],{"__ignoreMap":81},[85,338,339],{"class":87,"line":88},[85,340,91],{},[85,342,343],{"class":87,"line":94},[85,344,345],{},"    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;\n",[85,347,348],{"class":87,"line":100},[85,349,181],{"emptyLinePlaceholder":180},[85,351,352],{"class":87,"line":166},[85,353,271],{},[85,355,356],{"class":87,"line":172},[85,357,358],{},"        limit_conn conn_limit 10;         # 每个 IP 最多 10 个并发连接\n",[85,360,361],{"class":87,"line":177},[85,362,363],{},"        limit_conn_log_level warn;        # 达到限制时的日志级别\n",[85,365,366],{"class":87,"line":184},[85,367,368],{},"        limit_conn_status 503;            # 返回的状态码\n",[85,370,371],{"class":87,"line":190},[85,372,296],{},[85,374,375],{"class":87,"line":196},[85,376,103],{},[26,378,379,130,382,384,385,387],{},[35,380,381],{},"组合使用",[30,383,233],{}," 控制请求速度，",[30,386,324],{}," 控制连接总数，能有效缓解大部分应用层 DDoS。",[57,389,391],{"id":390},"四请求方法限制","四、请求方法限制",[26,393,394,397],{},[35,395,396],{},"目标","：RESTful API 通常仅使用 GET\u002FPOST\u002FPUT\u002FDELETE 等，禁用 TRACE\u002FTRACK 等危险方法，减少攻击面。",[26,399,400,130,403,406],{},[35,401,402],{},"推荐方式一",[30,404,405],{},"limit_except","（专门用于限制方法）",[77,408,410],{"className":79,"code":409,"language":12,"meta":81,"style":81},"location \u002Fapi\u002F {\n    limit_except GET POST PUT DELETE OPTIONS {\n        deny all;\n    }\n}\n",[30,411,412,417,422,427,431],{"__ignoreMap":81},[85,413,414],{"class":87,"line":88},[85,415,416],{},"location \u002Fapi\u002F {\n",[85,418,419],{"class":87,"line":94},[85,420,421],{},"    limit_except GET POST PUT DELETE OPTIONS {\n",[85,423,424],{"class":87,"line":100},[85,425,426],{},"        deny all;\n",[85,428,429],{"class":87,"line":166},[85,430,296],{},[85,432,433],{"class":87,"line":172},[85,434,103],{},[26,436,437,439],{},[30,438,405],{}," 内的指令仅对其所列方法之外的方法生效，这里禁止了所有不允许的方法。",[26,441,442,445,446,449],{},[35,443,444],{},"推荐方式二","：简单 ",[30,447,448],{},"if"," 判断（注意 if 在 location 中的谨慎使用）",[77,451,453],{"className":79,"code":452,"language":12,"meta":81,"style":81},"location \u002Fapi\u002F {\n    if ($request_method !~ ^(GET|POST|HEAD|OPTIONS)$) {\n        return 405;            # 方法不被允许\n    }\n}\n",[30,454,455,459,464,469,473],{"__ignoreMap":81},[85,456,457],{"class":87,"line":88},[85,458,416],{},[85,460,461],{"class":87,"line":94},[85,462,463],{},"    if ($request_method !~ ^(GET|POST|HEAD|OPTIONS)$) {\n",[85,465,466],{"class":87,"line":100},[85,467,468],{},"        return 405;            # 方法不被允许\n",[85,470,471],{"class":87,"line":166},[85,472,296],{},[85,474,475],{"class":87,"line":172},[85,476,103],{},[26,478,479,482],{},[30,480,481],{},"405 Method Not Allowed"," 比直接丢包更合规范。",[57,484,486],{"id":485},"五https-安全头","五、HTTPS 安全头",[26,488,489],{},"全站 HTTPS 基础上，增加安全响应头，大幅提升浏览器安全防护等级。",[223,491,493],{"id":492},"_1-hstshttp-strict-transport-security","1. HSTS（HTTP Strict-Transport-Security）",[26,495,496],{},"强制浏览器在指定时间内仅通过 HTTPS 访问该域名，杜绝 SSL 剥离攻击。",[77,498,500],{"className":79,"code":499,"language":12,"meta":81,"style":81},"server {\n    listen 443 ssl;\n    add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\" always;\n}\n",[30,501,502,507,512,517],{"__ignoreMap":81},[85,503,504],{"class":87,"line":88},[85,505,506],{},"server {\n",[85,508,509],{"class":87,"line":94},[85,510,511],{},"    listen 443 ssl;\n",[85,513,514],{"class":87,"line":100},[85,515,516],{},"    add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\" always;\n",[85,518,519],{"class":87,"line":166},[85,520,103],{},[303,522,523,529,535],{},[306,524,525,528],{},[30,526,527],{},"max-age=63072000","：两年内强制 HTTPS。",[306,530,531,534],{},[30,532,533],{},"includeSubDomains","：对所有子域名也生效。",[306,536,537,540,541,543],{},[30,538,539],{},"preload","：允许加入浏览器内置 HSTS 预加载列表。\n",[35,542,209],{},"：首次启用前请确保所有子域名都已支持 HTTPS，否则会造成访问故障。",[223,545,547],{"id":546},"_2-cspcontent-security-policy","2. CSP（Content-Security-Policy）",[26,549,550],{},"限制页面能加载哪些资源，是防御 XSS 的核心手段。",[77,552,554],{"className":79,"code":553,"language":12,"meta":81,"style":81},"add_header Content-Security-Policy \"default-src 'self'; script-src 'self' 'unsafe-inline' https:\u002F\u002Ftrusted-cdn.com; style-src 'self' 'unsafe-inline'; img-src * data:; font-src 'self' data:; frame-ancestors 'none';\";\n",[30,555,556],{"__ignoreMap":81},[85,557,558],{"class":87,"line":88},[85,559,553],{},[26,561,562],{},[563,564,565],"em",{},"策略需要根据业务定制，过严可能影响正常功能，建议先在报告模式测试。",[223,567,569],{"id":568},"_3-其他常用安全头","3. 其他常用安全头",[77,571,573],{"className":79,"code":572,"language":12,"meta":81,"style":81},"# 防止页面被嵌在 frame 中（防点击劫持）\nadd_header X-Frame-Options \"SAMEORIGIN\" always;\n\n# 禁止浏览器猜测资源类型（防 MIME 混淆）\nadd_header X-Content-Type-Options \"nosniff\" always;\n\n# 开启浏览器 XSS 过滤器并强制阻断\nadd_header X-XSS-Protection \"1; mode=block\" always;\n\n# 限制 Referer 传递范围\nadd_header Referrer-Policy \"strict-origin-when-cross-origin\" always;\n",[30,574,575,580,585,589,594,599,603,608,613,617,622],{"__ignoreMap":81},[85,576,577],{"class":87,"line":88},[85,578,579],{},"# 防止页面被嵌在 frame 中（防点击劫持）\n",[85,581,582],{"class":87,"line":94},[85,583,584],{},"add_header X-Frame-Options \"SAMEORIGIN\" always;\n",[85,586,587],{"class":87,"line":100},[85,588,181],{"emptyLinePlaceholder":180},[85,590,591],{"class":87,"line":166},[85,592,593],{},"# 禁止浏览器猜测资源类型（防 MIME 混淆）\n",[85,595,596],{"class":87,"line":172},[85,597,598],{},"add_header X-Content-Type-Options \"nosniff\" always;\n",[85,600,601],{"class":87,"line":177},[85,602,181],{"emptyLinePlaceholder":180},[85,604,605],{"class":87,"line":184},[85,606,607],{},"# 开启浏览器 XSS 过滤器并强制阻断\n",[85,609,610],{"class":87,"line":190},[85,611,612],{},"add_header X-XSS-Protection \"1; mode=block\" always;\n",[85,614,615],{"class":87,"line":196},[85,616,181],{"emptyLinePlaceholder":180},[85,618,619],{"class":87,"line":202},[85,620,621],{},"# 限制 Referer 传递范围\n",[85,623,624],{"class":87,"line":299},[85,625,626],{},"add_header Referrer-Policy \"strict-origin-when-cross-origin\" always;\n",[57,628,629],{"id":629},"最佳实践小结",[631,632,633,639,645,658],"ol",{},[306,634,635,638],{},[35,636,637],{},"在 http 块全局设置通用安全头","，个别站点可覆盖。",[306,640,641,644],{},[35,642,643],{},"限速配置务必测试","，错杀正常用户会降低体验，可先设为较大值再逐步收紧。",[306,646,647,650,651,654,655,53],{},[35,648,649],{},"IP 控制前确认真实 IP 获取正确","，在代理后面一定要用 ",[30,652,653],{},"real_ip_header"," 和 ",[30,656,657],{},"set_real_ip_from",[306,659,660,663,664,667],{},[35,661,662],{},"安全头和限速生效后","，可借助 ",[30,665,666],{},"curl -I"," 和浏览器 DevTools → Network 校验。",[26,669,670],{},"打好这些安全基础，你的 Nginx 就能从容应对绝大多数脚本小子和常见攻击，让后端服务安心运行。",[57,672,674],{"id":673},"七验证安全配置是否生效","七、验证安全配置是否生效",[26,676,677],{},"配置完成后，别只凭“看起来对”就上线，用命令实际核对：",[77,679,683],{"className":680,"code":681,"language":682,"meta":81,"style":81},"language-bash shiki shiki-themes material-theme-lighter github-light github-dark","# 确认版本信息已隐藏\ncurl -I https:\u002F\u002Fyourdomain | grep -i server\n\n# 确认安全响应头齐全\ncurl -I https:\u002F\u002Fyourdomain | grep -iE \"strict-transport|x-frame|x-content-type\"\n\n# 简单压测确认限流生效（观察是否出现 503）\nfor i in $(seq 1 30); do curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\\n\" https:\u002F\u002Fyourdomain\u002Fapi\u002F; done\n","bash",[30,684,685,691,718,722,727,752,756,761],{"__ignoreMap":81},[85,686,687],{"class":87,"line":88},[85,688,690],{"class":689},"sutJx","# 确认版本信息已隐藏\n",[85,692,693,697,701,705,709,712,715],{"class":87,"line":94},[85,694,696],{"class":695},"sbgvK","curl",[85,698,700],{"class":699},"stzsN"," -I",[85,702,704],{"class":703},"s_sjI"," https:\u002F\u002Fyourdomain",[85,706,708],{"class":707},"smGrS"," |",[85,710,711],{"class":695}," grep",[85,713,714],{"class":699}," -i",[85,716,717],{"class":703}," server\n",[85,719,720],{"class":87,"line":100},[85,721,181],{"emptyLinePlaceholder":180},[85,723,724],{"class":87,"line":166},[85,725,726],{"class":689},"# 确认安全响应头齐全\n",[85,728,729,731,733,735,737,739,742,746,749],{"class":87,"line":172},[85,730,696],{"class":695},[85,732,700],{"class":699},[85,734,704],{"class":703},[85,736,708],{"class":707},[85,738,711],{"class":695},[85,740,741],{"class":699}," -iE",[85,743,745],{"class":744},"sjJ54"," \"",[85,747,748],{"class":703},"strict-transport|x-frame|x-content-type",[85,750,751],{"class":744},"\"\n",[85,753,754],{"class":87,"line":177},[85,755,181],{"emptyLinePlaceholder":180},[85,757,758],{"class":87,"line":184},[85,759,760],{"class":689},"# 简单压测确认限流生效（观察是否出现 503）\n",[85,762,763,767,771,774,778,781,785,788,791,794,797,800,803,806,809,811,814,817,820,823],{"class":87,"line":190},[85,764,766],{"class":765},"sVHd0","for",[85,768,770],{"class":769},"su5hD"," i ",[85,772,773],{"class":765},"in",[85,775,777],{"class":776},"sP7_E"," $(",[85,779,780],{"class":695},"seq",[85,782,784],{"class":783},"srdBf"," 1",[85,786,787],{"class":783}," 30",[85,789,790],{"class":776},");",[85,792,793],{"class":765}," do",[85,795,796],{"class":695}," curl",[85,798,799],{"class":699}," -s",[85,801,802],{"class":699}," -o",[85,804,805],{"class":703}," \u002Fdev\u002Fnull",[85,807,808],{"class":699}," -w",[85,810,745],{"class":744},[85,812,813],{"class":703},"%{http_code}\\n",[85,815,816],{"class":744},"\"",[85,818,819],{"class":703}," https:\u002F\u002Fyourdomain\u002Fapi\u002F",[85,821,822],{"class":776},";",[85,824,825],{"class":765}," done\n",[26,827,828,829,835,836,841],{},"也可以借助在线工具如 ",[44,830,834],{"href":831,"rel":832},"https:\u002F\u002Fobservatory.mozilla.org\u002F",[833],"nofollow","Mozilla Observatory"," 或 ",[44,837,840],{"href":838,"rel":839},"https:\u002F\u002Fwww.ssllabs.com\u002Fssltest\u002F",[833],"SSL Labs"," 对线上域名做一次外部视角的安全评分，弥补本地配置检查的盲区。",[843,844,845],"h2",{"id":845},"延伸阅读",[303,847,848,853],{},[306,849,850,852],{},[44,851,52],{"href":51},"：Master-Worker 模型与事件驱动，理解限流\u002F连接数限制生效的底层原因。",[306,854,855,857],{},[44,856,47],{"href":46},"：安全加固后若出现 403\u002F超时等问题，可对照排查。",[843,859,860],{"id":860},"参考文献",[862,863,864,877],"table",{},[865,866,867],"thead",{},[868,869,870,874],"tr",{},[871,872,873],"th",{},"资料",[871,875,876],{},"说明",[878,879,880,893,904],"tbody",{},[868,881,882,890],{},[883,884,885],"td",{},[44,886,889],{"href":887,"rel":888},"https:\u002F\u002Fnginx.org\u002Fen\u002Fdocs\u002F",[833],"nginx 文档",[883,891,892],{},"官方",[868,894,895,901],{},[883,896,897],{},[44,898,900],{"href":899},"\u002Fknowledge\u002Fbooklet\u002Fuphold","运维导读",[883,902,903],{},"学习路径",[868,905,906,911],{},[883,907,908],{},[44,909,834],{"href":831,"rel":910},[833],[883,912,913],{},"安全头在线评分",[915,916,917],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sutJx, html code.shiki .sutJx{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#6A737D;--shiki-default-font-style:inherit;--shiki-dark:#6A737D;--shiki-dark-font-style:inherit}html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .stzsN, html code.shiki .stzsN{--shiki-light:#91B859;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .smGrS, html code.shiki .smGrS{--shiki-light:#39ADB5;--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sVHd0, html code.shiki .sVHd0{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#D73A49;--shiki-default-font-style:inherit;--shiki-dark:#F97583;--shiki-dark-font-style:inherit}html pre.shiki code .su5hD, html code.shiki .su5hD{--shiki-light:#90A4AE;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sP7_E, html code.shiki .sP7_E{--shiki-light:#39ADB5;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":81,"searchDepth":94,"depth":94,"links":919},[920,921,922,923,924,925,926,927,928],{"id":59,"depth":100,"text":60},{"id":117,"depth":100,"text":118},{"id":217,"depth":100,"text":218},{"id":390,"depth":100,"text":391},{"id":485,"depth":100,"text":486},{"id":629,"depth":100,"text":629},{"id":673,"depth":100,"text":674},{"id":845,"depth":94,"text":845},{"id":860,"depth":94,"text":860},{"title":8,"description":9},"knowledge\u002Fbooklet\u002Fuphold\u002FNginx\u002Fse","knowledge\u002Fknowledge\u002Fbooklet\u002Fuphold\u002FNginx\u002Fse.md","md",{"items":934},[935,939,943,945,947,951],{"path":936,"title":937,"description":938,"category":10,"score":177},"\u002Fknowledge\u002Fbooklet\u002Fuphold\u002Fnginx\u002Fconfig","配置文件结构与语法","下面我们深入到 Nginx 的配置核心——配置文件的结构、语法和变量系统。这一部分是你驾驭 Nginx 的“语法手册”。",{"path":940,"title":941,"description":942,"category":10,"score":177},"\u002Fknowledge\u002Fbooklet\u002Fuphold\u002Fnginx\u002Fcore","核心模块与常见指令详解","深入 Nginx 的指令层，是配置落地的关键。下面按功能模块拆解，每个指令都说明含义、语法、典型示例，并点出极易踩坑的地方。",{"path":51,"title":52,"description":944,"category":10,"score":177},"Nginx 是一款高性能的 HTTP 和反向代理服务器。学习路径见 运维导读。它的强大并发能力与灵活的扩展性根植于少数几个核心设计。理解这些底层原理，后续的配置、调优和排障都会变得通透。",{"path":46,"title":47,"description":946,"category":10,"score":177},"故障排查的关键是快速定位，而非盲目重试。下面按最常见的五种现象归类，每一种都给出清晰的排查路径和解决思路。",{"path":948,"title":949,"description":950,"category":10,"score":177},"\u002Fknowledge\u002Fbooklet\u002Fuphold\u002Fnginx\u002Fpre","性能调优基础","性能调优的目标是：用有限的资源，支撑更高的并发、更快的响应、更稳的服务。下面按优化维度，逐一拆解原理和配置要诀。",{"path":952,"title":953,"description":954,"category":10,"score":177},"\u002Fknowledge\u002Fbooklet\u002Fuphold\u002Fnginx\u002Flogger","访问日志与错误日志","日志是 Nginx 排错的“第一现场”。一个优秀的日志策略既能完整保留请求上下文，又不会撑爆磁盘。下面从格式定制、存储轮转、错误分级三个维度详细讲解。",{"series":956,"title":12,"items":957,"index":172,"prev":971,"next":972},"booklet\u002Fuphold\u002Fnginx",[958,960,962,964,966,968,969],{"path":51,"title":52,"date":959,"pinned":15},"2023-04-03",{"path":936,"title":937,"date":961,"pinned":15},"2023-11-24",{"path":940,"title":941,"date":963,"pinned":15},"2023-04-25",{"path":952,"title":953,"date":965,"pinned":15},"2020-02-29",{"path":948,"title":949,"date":967,"pinned":15},"2020-07-11",{"path":7,"title":8,"date":14,"pinned":15},{"path":46,"title":47,"date":970,"pinned":15},"2020-09-18",{"path":948,"title":949,"date":967,"pinned":15},{"path":46,"title":47,"date":970,"pinned":15}]