Nginx Конфигурация

🌐

Веб-сервер Nginx

Production

Nginx работает как обратный прокси-сервер, обслуживая статические файлы, перенаправляя PHP запросы на PHP-FPM и проксируя WebSocket соединения на Node.js сервер. Все соединения защищены SSL/TLS.

1.22.1 Версия

100ms Ср. ответ

1024 Worker connections

📊 Статистика сервера

⚡

CPU Load

1 min: 0.45 5 min: 0.32 15 min: 0.28

⏱️

Uptime

up 15 days, 4 hours, 23 minutes

Бесперебойная работа

💾

Память

Mem: 7.6G total, 3.2G used, 4.4G free

📦

Версии

PHP: 8.2.26

Nginx: nginx/1.22.1

⚙️ Конфигурация Nginx

# /etc/nginx/sites-available/example.com
server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    
    root /var/www/example.com;
    index index.php index.html;
    
    client_max_body_size 100M;
    
    access_log /var/log/nginx/example_access.log;
    error_log /var/log/nginx/example_error.log;
    
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    
    # Основные правила
    location / {
        try_files $uri $uri/ /index.php?$args;
    }
}

# SSL настройки
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

# HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# HTTP -> HTTPS редирект
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

# PHP-FPM обработка
location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
    
    # Таймауты
    fastcgi_read_timeout 300;
    fastcgi_connect_timeout 300;
}

# Защита от доступа к скрытым файлам
location ~ /\.ht {
    deny all;
}

location = /wp-config.php {
    deny all;
}

# WebSocket прокси
location /ws {
    proxy_pass http://127.0.0.1:8091;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    
    # Таймауты для WebSocket
    proxy_read_timeout 86400;
    proxy_send_timeout 86400;
}

🚀 Оптимизация

⚡

Кэширование статики

location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
    expires 365d;
    add_header Cache-Control "public, immutable";
}

📦

Сжатие gzip

gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json;

🛡️

Заголовки безопасности

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;

🔒 Лимиты и безопасность

Max body size 100M

Keep-alive timeout 65

Max open files 65535

Worker processes auto

Rate limit 10r/s

Connections 1024

Nginx конфигурация сервера