Nginxの導入

カテゴリーから探す

年別から見る

2018/06/13

Nginxの導入

はじめに

前々から他のエンジニアも挙げていたNginx。
これを実際に運用レベルで導入してみた投稿となります。

以下アジェンダ
・Nginx導入の経緯
・メリット、デメリット
・導入フロー

経緯

Apacheより軽いらしい、と言う事で導入。

Apacheとは？
Webサーバー。
Webサイトを表示するためのソフトウェア。
有名所でよく使われるのが「Apache」「Nginx」など。
　※ 他にもあるけど割愛

メリット・デメリット

Apache

多機能。
その分同時アクセスが過多になると重くなる。
OSの性質上同時処理の上限あり。

Nginx

シンプルで処理が軽くメモリ消費も少ない。
Apacheで対応できる多くの機能は使えない。
.htaccessが使えない。

一つのフレームワークで多くの内部アクセスなどが
発生しうるのが想定しやすい場合はとりあえずNginxで良さそう。

導入

Nginxのインストール


yum install -y nginx

1	yum install -y nginx

加えてPHPで動かしているシステム前提でphp-fpmをインストール


yum install -y php-fpm

1	yum install -y php-fpm

※ php56などバージョンによって異なるrepositoryを使用する場合はそれに応じて変更

軽くカスタマイズ(圧縮転送や仮想ホスト毎の設定)


# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
pid /var/run/nginx.pid;
worker_processes auto;
error_log /var/log/nginx/error.log;
worker_rlimit_nofile 100000;
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# pid /var/run/nginx.pid;
events {
    worker_connections 2048;
    multi_accept on;
    use epoll;
}
http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    server_tokens off;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    error_log /var/log/nginx/error.log crit;
    access_log  /var/log/nginx/access.log  main;
    keepalive_timeout 10;
    client_header_timeout 10;
    client_body_timeout 10;
    reset_timedout_connection on;
    send_timeout 10;
    limit_conn_zone $binary_remote_addr zone=addr:5m;
    limit_conn addr 100;
    include /etc/nginx/mime.types;
    default_type text/html;
    charset UTF-8;
    gzip on;
    gzip_http_version 1.0;
    gzip_disable "msie6";
    gzip_proxied any;
    gzip_min_length 1024;
    gzip_comp_level 6;
    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;
    open_file_cache max=100000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

# For more information on configuration, see:

# * Official English Documentation: http://nginx.org/en/docs/

# * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;

pid /var/run/nginx.pid;

worker_processes auto;

error_log /var/log/nginx/error.log;

worker_rlimit_nofile 100000;

# proxy_set_header X-Real-IP $remote_addr;

# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

# pid /var/run/nginx.pid;

events {

worker_connections 2048;

multi_accept on;

use epoll;

}

http {

log_format main '$remote_addr - $remote_user [$time_local] "$request" '

'$status $body_bytes_sent "$http_referer" '

'"$http_user_agent" "$http_x_forwarded_for"';

server_tokens off;

sendfile on;

tcp_nopush on;

tcp_nodelay on;

error_log /var/log/nginx/error.log crit;

access_log /var/log/nginx/access.log main;

keepalive_timeout 10;

client_header_timeout 10;

client_body_timeout 10;

reset_timedout_connection on;

send_timeout 10;

limit_conn_zone $binary_remote_addr zone=addr:5m;

limit_conn addr 100;

include /etc/nginx/mime.types;

default_type text/html;

charset UTF-8;

gzip on;

gzip_http_version 1.0;

gzip_disable "msie6";

gzip_proxied any;

gzip_min_length 1024;

gzip_comp_level 6;

gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;

open_file_cache max=100000 inactive=20s;

open_file_cache_valid 30s;

open_file_cache_min_uses 2;

open_file_cache_errors on;

include /etc/nginx/conf.d/*.conf;

include /etc/nginx/sites-enabled/*;

}


server {
    listen    *:80;

    server_name launchcart.local;
    return 301 https://www.launchcart.local$request_uri;
}

server {
    listen    *:443;

    server_name launchcart.local;
    return 301 https://www.launchcart.local$request_uri;
}

server {
    # wwwあり共通の場合は default_server 記述が必要
    listen    80 default_server;
    listen    443 ssl default_server;

    # VitualHost
    server_name www.launchcart.local;
    root /var/www/html/LC/web;

    # Sertifications.
    # TLS1.2に制限
    ssl_protocols     TLSv1.2;
    ssl_certificate /etc/nginx/conf.d/cert_files/launchcart.local.crt;
    ssl_certificate_key /etc/nginx/conf.d/cert_files/launchcart.local.key;
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  10m;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    location / {
        # Basic Auth
        auth_basic "Restricted";
        auth_basic_user_file /etc/nginx/.htpasswd;
        try_files $uri /app.php$is_args$args;
    }
    # Symfony用設定
    location ~ ^/(app_dev|config)\.php(/|$) {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_param DOCUMENT_ROOT $realpath_root;
    }
    # PROD
    location ~ ^/app\.php(/|$) {
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_param DOCUMENT_ROOT $realpath_root;
        internal;
    }

    location ~ \.php {
        return 404;
    }

    error_log /var/log/nginx/launchcart.local_error.log;
    access_log /var/log/nginx/launchcart.local_access.log;
}

server {

listen *:80;

server_name launchcart.local;

return 301 https://www.launchcart.local$request_uri;

}

server {

listen *:443;

server_name launchcart.local;

return 301 https://www.launchcart.local$request_uri;

}

server {

# wwwあり共通の場合は default_server 記述が必要

listen 80 default_server;

listen 443 ssl default_server;

# VitualHost

server_name www.launchcart.local;

root /var/www/html/LC/web;

# Sertifications.

# TLS1.2に制限

ssl_protocols TLSv1.2;

ssl_certificate /etc/nginx/conf.d/cert_files/launchcart.local.crt;

ssl_certificate_key /etc/nginx/conf.d/cert_files/launchcart.local.key;

ssl_session_cache shared:SSL:1m;

ssl_session_timeout 10m;

ssl_ciphers HIGH:!aNULL:!MD5;

ssl_prefer_server_ciphers on;

location / {

# Basic Auth

auth_basic "Restricted";

auth_basic_user_file /etc/nginx/.htpasswd;

try_files $uri /app.php$is_args$args;

}

# Symfony用設定

location ~ ^/(app_dev|config)\.php(/|$) {

fastcgi_pass 127.0.0.1:9000;

fastcgi_split_path_info ^(.+\.php)(/.*)$;

include fastcgi_params;

fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;

fastcgi_param DOCUMENT_ROOT $realpath_root;

}

# PROD

location ~ ^/app\.php(/|$) {

fastcgi_pass 127.0.0.1:9000;

fastcgi_split_path_info ^(.+\.php)(/.*)$;

include fastcgi_params;

fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;

fastcgi_param DOCUMENT_ROOT $realpath_root;

internal;

}

location ~ \.php {

return 404;

}

error_log /var/log/nginx/launchcart.local_error.log;

access_log /var/log/nginx/launchcart.local_access.log;

}

終わったら各サービスとして起動 (Apacheが起動してたら停止)
service httpd stop
service nginx start
service php-fpm start
chkconfig nginx on
chkconfig php-fpm on
chkconfig httpd off

注意点1

まずSSLの設定？がやや違う。

Apacheはキー、証明書、中間証明書を別々に指定。
Nginxは証明書と中間証明書を一つのファイルにする必要があります。


cat /etc/httpd/conf.d/cert_files/launchcart.local.crt /etc/httpd/conf.d/cert_files/launchcart.local.ca > /etc/nginx/conf.d/cert_files/launchcart.local.crt

1	cat /etc/httpd/conf.d/cert_files/launchcart.local.crt /etc/httpd/conf.d/cert_files/launchcart.local.ca > /etc/nginx/conf.d/cert_files/launchcart.local.crt