sysctl.conf

nginx.conf

#工作进程 组和用户
user www www; 

#工作进程数，设置为cpu核数
worker_processes 4; 

#CPU亲缘性，绑定每个work进程到固定的CPU核
worker_cpu_affinity 0001 0010 0100 1000; 

#错误日志目录
error_log logs/error.log error; 

#pid文件
pid logs/nginx.pid; 


events {
    #强制使用epoll方式的处理连接
    use epoll; 
    
    #每个work进程可以服务的最大连接数 
    worker_connections  10240; 
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    #TCP 特性
    #打开sendfile特性
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    

    
    #关闭响应头里关于nginx版本号的显示
    server_tokens off; 
    
    
    #############################################
    #缓冲类设置
    
    #主机名哈希桶尺寸,根据使用的主机名长度来设置,一般越长的域名需要设置越大的尺寸, 32|64|128
    server_names_hash_bucket_size 64;
    
    #主机名哈希表的最大长度，如果需要服务更多的虚拟主机需要增加这个尺寸
    server_names_hash_max_size 512;
    
    #客户端请求头部的缓冲容量
    client_header_buffer_size 1k;
    
    #对于超大的请求头最大的缓冲区个数和大小
    large_client_header_buffers 2 1k;        

    #最大请求体大小，会现在例如文件上传的大小
    client_max_body_size  10m;
    
    #读取客户端请求正文的缓冲容量，超过将会写入磁盘
    client_body_buffer_size 10K; 
    
    
    
    ################################################
    #超时类设置
    
    #读取客户端请求正文的超时
    client_body_timeout 12s;
    
    #读取客户端请求头部的超时
    client_header_timeout 12s;
    
    #keepalive 超时
    keepalive_timeout 60s;
    
    #向客户端传输响应的超时
    send_timeout 1m;    
    
    
    
    ##############################################
    #GZIP设置
    
    gzip on;
    
    #压缩级别 1-9
    gzip_comp_level  2;
    
    #开启gzip的最小长度
    gzip_min_length  1000;
    
    #是否对代理的相应进行压缩，添加了不允许缓存的响应头进行了压缩
    gzip_proxied     expired no-cache no-store private auth;
    
    #开启压缩的content-type,一般设置为文本类
    gzip_types       text/plain application/x-javascript text/xml text/css application/xml;    
    
    
    #每个长连接可以开启的请求数，超过将会关闭
    keepalive_requests 100;
    
    
    ############################################
    #日志优化
    
    #定义缓存用来存储频繁使用的文件名中包含变量的日志文件描述符
    open_log_file_cache max=1000 inactive=20s valid=1m min_uses=2;
    
    #关闭在404在errorlog中的日志
    log_not_found off;
    
    ################################################
    #openfile优化
    
    #文件描述符号缓存 5000个/20秒
    open_file_cache max=5000 inactive=20s;
    open_file_cache_valid    30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors   on;  
    

    server {
        listen       80;
        server_name  host.domain.com;

        #日志优化，缓冲区和输出时间,5分钟缓存16k的缓冲区
        access_log /data/var/logs/80_access.log main flush=5m buffer=16k;
        
        location /app1/ {
            proxy_pass http://app1.host/;
            include proxy.conf;
        }
  
  
        #静态文件缓存
        location ~* \.(txt|mp3|jpg|jpeg|gif|png|swf|js|css)$ {
             root /data/www/;
             expires            1d;
        }        

        #禁止的目录访问
        location ~ /(\.git|\.svn|WEB-INF) {
            return 403;
        }

        
        #指定404错误页面
        error_page  404              /404.html;
        #重定向所以5xx错误到统一页面
        error_page   500 502 503 504  /50x.html;
        #指定50x.html页面的特定路径
        location = /50x.html {
            root html;
        }
    }



}

nginx_install.sh

./configure \
--prefix=/opt/tengine --user=www --group=www \
--without-http_autoindex_module \
--without-http_fastcgi_module \
--without-http_uwsgi_module \
--without-http_scgi_module \
--without-mail_pop3_module \
--without-mail_imap_module \
--without-mail_smtp_module

proxy.conf

proxy_redirect off ;
proxy_http_version 1.1;
#proxy_set_header Connection “”;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header REMOTE-HOST $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_connect_timeout 30;
proxy_send_timeout 30;
proxy_read_timeout 60;
proxy_buffer_size 256k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_next_upstream error timeout invalid_header http_500 http_503 http_404;
proxy_max_temp_file_size 128m; 

sysctl.conf

### IMPROVE SYSTEM MEMORY MANAGEMENT ###

# Increase size of file handles and inode cache
fs.file-max = 2097152

# Do less swapping
vm.swappiness = 10
vm.dirty_ratio = 60
vm.dirty_background_ratio = 2

### GENERAL NETWORK SECURITY OPTIONS ###

# Number of times SYNACKs for passive TCP connection.
net.ipv4.tcp_synack_retries = 2

# Allowed local port range
net.ipv4.ip_local_port_range = 2000 65535

# Protect Against TCP Time-Wait
net.ipv4.tcp_rfc1337 = 1

# Decrease the time default value for tcp_fin_timeout connection
net.ipv4.tcp_fin_timeout = 15

# Decrease the time default value for connections to keep alive
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_keepalive_intvl = 15

### TUNING NETWORK PERFORMANCE ###

# Default Socket Receive Buffer
net.core.rmem_default = 31457280

# Maximum Socket Receive Buffer
net.core.rmem_max = 12582912

# Default Socket Send Buffer
net.core.wmem_default = 31457280

# Maximum Socket Send Buffer
net.core.wmem_max = 12582912

# Increase number of incoming connections
net.core.somaxconn = 65536

# Increase number of incoming connections backlog
net.core.netdev_max_backlog = 65536

# Increase the maximum amount of option memory buffers
net.core.optmem_max = 25165824

# Increase the maximum total buffer-space allocatable
# This is measured in units of pages (4096 bytes)
net.ipv4.tcp_mem = 65536 131072 262144
net.ipv4.udp_mem = 65536 131072 262144

# Increase the read-buffer space allocatable
net.ipv4.tcp_rmem = 8192 87380 16777216
net.ipv4.udp_rmem_min = 16384

# Increase the write-buffer-space allocatable
net.ipv4.tcp_wmem = 8192 65536 16777216
net.ipv4.udp_wmem_min = 16384

# Increase the tcp-time-wait buckets pool size to prevent simple DOS attacks
net.ipv4.tcp_max_tw_buckets = 1440000
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1