Nginx 生产综合模板：反向代理 + 缓存 + 限流 + 防爬虫

# 全局配置
user  nginx;
worker_processes  auto;
error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

# 打开文件句柄上限
worker_rlimit_nofile 65535;

events {
    worker_connections  1024;
    use epoll;
    multi_accept on;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    # 日志格式
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    tcp_nopush     on;
    tcp_nodelay    on;
    keepalive_timeout  65;
    types_hash_max_size 2048;

    # -------------------------- 1. 限流配置 --------------------------
    # 按IP限制并发连接数
    limit_conn_zone $binary_remote_addr zone=conn_zone:10m;
    # 按IP限制请求速率：每秒2请求，burst=5，超出排队
    limit_req_zone $binary_remote_addr zone=req_zone:10m rate=2r/s;

    # IP黑名单，可动态写入
    geo $blacklist_ip {
        default 0;
        # 示例黑名单 IP
        192.168.1.100 1;
        10.0.0.55     1;
    }

    # -------------------------- 2. 代理缓存配置 --------------------------
    # proxy_cache_path：缓存目录，内存区域，最大磁盘空间，缓存有效期，层级目录
    proxy_cache_path /data/nginx/cache
                     levels=1:2
                     keys_zone=proxy_cache_zone:200m
                     inactive=7d
                     max_size=10g
                     use_temp_path=off;

    proxy_cache_key "$scheme$request_method$host$request_uri";
    proxy_cache_valid 200 302 10m;   # 200/302缓存10分钟
    proxy_cache_valid 404 1m;        # 404缓存1分钟
    proxy_cache_valid any 1s;

    # 缓存状态头（调试用，上线可注释）
    add_header X-Cache $upstream_cache_status;

    # -------------------------- 3. 通用安全头 --------------------------
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options nosniff;
    add_header Referrer-Policy "strict-origin-when-cross-origin";
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # -------------------------- 4. 防爬虫 UserAgent 规则 --------------------------
    map $http_user_agent $is_bot {
        default 0;
        ~*scraper|crawler|spider|bot|curl|wget|python-requests|phantomjs|selenium 1;
    }

    # -------------------------- 5. 后端上游集群 --------------------------
    upstream backend_server {
        server 127.0.0.1:8080;
        server 127.0.0.1:8081;
        keepalive 32; # 长连接池
    }

    # -------------------------- HTTP 80 跳转 HTTPS --------------------------
    server {
        listen 80;
        server_name demo.example.com;
        return 301 https://$host$request_uri;
    }

    # -------------------------- HTTPS 主站点配置 --------------------------
    server {
        listen 443 ssl;
        server_name demo.example.com;

        ssl_certificate     /etc/nginx/ssl/demo.example.com.crt;
        ssl_certificate_key /etc/nginx/ssl/demo.example.com.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_prefer_server_ciphers off;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;

        # 黑名单IP直接拒绝
        if ($blacklist_ip) {
            return 403;
        }

        # 基础爬虫拦截，返回403
        if ($is_bot) {
            return 403;
        }

        # 限制并发连接
        limit_conn conn_zone 10;
        # 限制请求速率，burst=5，nodelay
        limit_req zone=req_zone burst=5 nodelay;

        # 最大请求体大小
        client_max_body_size 20M;

        # 反向代理基础参数
        location / {
            proxy_pass http://backend_server;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # 超时设置
            proxy_connect_timeout 10s;
            proxy_read_timeout 30s;
            proxy_send_timeout 30s;

            # 启用代理缓存
            proxy_cache proxy_cache_zone;
            # 不缓存带Cookie、登录态的请求
            proxy_cache_bypass $cookie_session $http_authorization;
            proxy_no_cache $cookie_session $http_authorization;
        }

        # -------------------------- 静态资源单独缓存（图片/js/css） --------------------------
        location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2|woff|ttf)$ {
            proxy_pass http://backend_server;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            # 静态资源长缓存
            expires 7d;
            add_header Cache-Control "public";
            proxy_cache proxy_cache_zone;
        }

        # -------------------------- 禁止访问隐藏文件 --------------------------
        location ~ /\. {
            deny all;
        }

        # -------------------------- 自定义错误页 --------------------------
        error_page 403 /403.html;
        error_page 404 /404.html;
        error_page 500 502 503 504 /5xx.html;

        location ~ ^/(403|404|5xx)\.html$ {
            root /usr/share/nginx/html;
            internal;
        }
    }
}

# 创建缓存目录，权限 nginx
mkdir -p /data/nginx/cache
chown nginx:nginx /data/nginx/cache
chmod 700 /data/nginx/cache

# 校验配置
nginx -t

# 重载
nginx -s reload