user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;
    types_hash_max_size 2048;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

server {
    listen 80;
    server_name www.example.com example.com;

    root /var/www/www.example.com/html;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }

    access_log /var/log/nginx/www.example.com.access.log;
    error_log /var/log/nginx/www.example.com.error.log;
}

server {
    listen 80;
    server_name blog.example.com;

    root /var/www/blog.example.com/html;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
    }

    access_log /var/log/nginx/blog.example.com.access.log;
    error_log /var/log/nginx/blog.example.com.error.log;
}

server {
    listen 80;
    server_name shop.example.com;

    root /var/www/shop.example.com/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    # 靜態(tài)資源緩存
    location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
        expires 30d;
        add_header Cache-Control "public, no-transform";
    }

    access_log /var/log/nginx/shop.example.com.access.log;
    error_log /var/log/nginx/shop.example.com.error.log;
}

package com.example.apiserver;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
import java.util.HashMap;
import java.util.Map;
@SpringBootApplication
@RestController
public class ApiServerApplication {
    public static void main(String[] args) {
        SpringApplication.run(ApiServerApplication.class, args);
    }
    @GetMapping("/health")
    public Map<String, Object> healthCheck() {
        Map<String, Object> response = new HashMap<>();
        response.put("status", "UP");
        response.put("service", "API Server v1.2");
        response.put("timestamp", System.currentTimeMillis());
        response.put("message", "? Nginx + Java integration working!");
        return response;
    }
    @GetMapping("/user/{id}")
    public Map<String, Object> getUser(@PathVariable("id") Long id) {
        Map<String, Object> user = new HashMap<>();
        user.put("id", id);
        user.put("name", "張三");
        user.put("email", "zhangsan@example.com");
        user.put("role", "admin");
        return user;
    }
}

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://127.0.0.1:8081;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 超時(shí)設(shè)置
        proxy_connect_timeout 5s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }

    access_log /var/log/nginx/api.example.com.access.log;
    error_log /var/log/nginx/api.example.com.error.log;
}

192.168.1.10 www.example.com
192.168.1.10 blog.example.com
192.168.1.10 shop.example.com
192.168.1.10 api.example.com

server {
    listen 80;
    server_name example.com;

    root /var/www/example.com/main;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    access_log /var/log/nginx/example.com-main.access.log;
    error_log /var/log/nginx/example.com-main.error.log;
}

server {
    listen 8080;
    server_name example.com;

    root /var/www/example.com/admin;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    # 限制訪問來源（僅允許內(nèi)網(wǎng)）
    allow 192.168.1.0/24;
    deny all;

    access_log /var/log/nginx/example.com-admin.access.log;
    error_log /var/log/nginx/example.com-admin.error.log;
}

server {
    listen 9000;
    server_name example.com;

    root /var/www/example.com/swagger;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    # 允許跨域訪問（前端調(diào)用）
    add_header Access-Control-Allow-Origin "*";
    add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
    add_header Access-Control-Allow-Headers "DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization";

    access_log /var/log/nginx/example.com-swagger.access.log;
    error_log /var/log/nginx/example.com-swagger.error.log;
}

<dependency>
    <groupId>org.springdoc</groupId>
    <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
    <version>2.3.0</version>
</dependency>

@SpringBootApplication
public class SwaggerApp {
    public static void main(String[] args) {
        System.setProperty("server.port", "8081");
        SpringApplication.run(SwaggerApp.class, args);
    }
}

server {
    listen 9000;
    server_name example.com;

    location / {
        proxy_pass http://127.0.0.1:8081/v3/api-docs;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    location /swagger-ui/ {
        proxy_pass http://127.0.0.1:8081/swagger-ui/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    access_log /var/log/nginx/example.com-swagger.access.log;
    error_log /var/log/nginx/example.com-swagger.error.log;
}

server {
    listen 192.168.1.10:80;
    server_name example.com;

    root /var/www/public-site;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    access_log /var/log/nginx/public-site.access.log;
    error_log /var/log/nginx/public-site.error.log;
}

server {
    listen 192.168.1.11:80;
    server_name example.com;

    root /var/www/internal-admin;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    # 僅允許內(nèi)網(wǎng)訪問
    allow 192.168.1.0/24;
    deny all;

    access_log /var/log/nginx/internal-admin.access.log;
    error_log /var/log/nginx/internal-admin.error.log;
}

location / {
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    try_files $uri $uri/ =404;
}

sudo apt install apache2-utils
htpasswd -c /etc/nginx/.htpasswd admin

server {
    listen 80;
    server_name customerA.yourcompany.com;

    root /var/www/customers/customerA;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    # 緩存靜態(tài)資源
    location ~* \.(css|js|png|jpg|jpeg|gif|ico)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    access_log /var/log/nginx/customerA.access.log;
    error_log /var/log/nginx/customerA.error.log;
}

server {
    listen 80;
    server_name customerB.yourcompany.com;

    root /var/www/customers/customerB;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    # 自定義響應(yīng)頭（用于客戶品牌識(shí)別）
    add_header X-Customer-ID "B-2024";

    access_log /var/log/nginx/customerB.access.log;
    error_log /var/log/nginx/customerB.error.log;
}

server {
    listen 8081;
    server_name admin.yourcompany.com;

    location / {
        proxy_pass http://127.0.0.1:8082;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # 限制僅公司內(nèi)網(wǎng)訪問
    allow 192.168.1.0/24;
    allow 10.0.0.0/8;
    deny all;

    access_log /var/log/nginx/admin.access.log;
    error_log /var/log/nginx/admin.error.log;
}

server {
    listen 192.168.1.11:80;
    server_name internal.yourcompany.com;

    root /var/www/internal;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    # 禁止外部訪問
    deny all;

    access_log /var/log/nginx/internal.access.log;
    error_log /var/log/nginx/internal.error.log;
}

sudo apt update
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d www.example.com -d blog.example.com -d shop.example.com

server {
    listen 443 ssl;
    server_name www.example.com;

    ssl_certificate /etc/letsencrypt/live/www.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.example.com/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
    ssl_prefer_server_ciphers off;

    root /var/www/www.example.com/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    access_log /var/log/nginx/www.example.com.ssl.access.log;
    error_log /var/log/nginx/www.example.com.ssl.error.log;
}

# 強(qiáng)制 HTTP 跳轉(zhuǎn) HTTPS
server {
    listen 80;
    server_name www.example.com;
    return 301 https://$host$request_uri;
}

keytool -genkey -alias tomcat -keyalg RSA -keystore keystore.jks

server.port=8443
server.ssl.key-store=classpath:keystore.jks
server.ssl.key-store-password=changeit
server.ssl.key-password=changeit
server.ssl.key-store-type=JKS

server {
    listen 443 ssl;
    server_name api.example.com;

    ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;

    location / {
        proxy_pass https://127.0.0.1:8443;
        proxy_ssl_verify off; # 僅在自簽名證書時(shí)使用，生產(chǎn)環(huán)境請(qǐng)開啟
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|svg)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
    access_log off;
}

limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

server {
    location /api/ {
        limit_req zone=api_limit burst=20 nodelay;
        proxy_pass http://backend;
    }
}

listen 443 ssl http2;

# 編輯 /etc/logrotate.d/nginx
/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        [ -f /var/run/nginx.pid ] && kill -USR1 `cat /var/run/nginx.pid`
    endscript
}

version: '3.8'
services:
  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf
      - ./nginx/sites-available:/etc/nginx/conf.d
      - ./frontend:/var/www/frontend
    depends_on:
      - java-api
    restart: unless-stopped
  java-api:
    build: ./java-api
    ports:
      - "8081:8080"
    environment:
      - SPRING_PROFILES_ACTIVE=prod
    restart: unless-stopped
  frontend:
    build: ./frontend
    ports:
      - "8082:80"
    restart: unless-stopped

FROM openjdk:17-jre-slim

WORKDIR /app

COPY target/api-1.0.jar app.jar

EXPOSE 8080

ENTRYPOINT ["java","-jar","app.jar"]

FROM nginx:alpine

COPY index.html /usr/share/nginx/html/index.html
COPY index.html /usr/share/nginx/html/404.html

EXPOSE 80

<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <title>前端站點(diǎn)</title>
</head>
<body>
    <h1>?? 歡迎訪問前端站點(diǎn)</h1>
    <p>調(diào)用 API：<a href="http://localhost/api/health" rel="external nofollow" >/api/health</a></p>
    <script>
        fetch('http://nginx/api/health')
            .then(r => r.json())
            .then(data => console.log('API 響應(yīng):', data))
            .catch(e => console.error('調(diào)用失敗:', e));
    </script>
</body>
</html>

server {
    listen 80;
    server_name frontend.example.com;

    root /var/www/frontend;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

server {
    listen 80;
    server_name api.example.com;

    location /api/ {
        proxy_pass http://java-api:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

cd nginx-multi-site
docker-compose up --build

# 檢查配置語法
sudo nginx -t

# 重載配置（不中斷服務(wù)）
sudo nginx -s reload

# 查看正在監(jiān)聽的端口
sudo ss -tuln | grep nginx

# 查看訪問日志實(shí)時(shí)流
tail -f /var/log/nginx/www.example.com.access.log

# 模擬請(qǐng)求測試
curl -H "Host: blog.example.com" http://192.168.1.10

location /nginx_status {
    stub_status;
    allow 127.0.0.1;
    deny all;
}

# docker-compose.yml 添加
nginx-exporter:
  image: nginx/nginx-prometheus-exporter:0.10.0
  ports:
    - "9113:9113"
  command: -nginx.scrape-uri=http://nginx/nginx_status
  depends_on:
    - nginx

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: multi-site-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: frontend.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: frontend-service
            port:
              number: 80
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080