\u76ee\u524d\u6709\u4e09\u4e2a\u89e3\u51b3\u65b9\u6848<\/p>\n
\u4f46\u662f\u6240\u6709\u65b9\u6848\u524d\u5c3d\u91cf\u6267\u884c\u4e00\u4e0b\u6307\u4ee4\u8fdb\u884c\u57fa\u7840\u914d\u7f6e<\/p>\n
# \u4f7f\u7528sudo\u6743\u9650\u6d4b\u8bd5nginx\u914d\u7f6e
\nsudo nginx -t<\/p>\n
# \u68c0\u67e5nginx\u670d\u52a1\u72b6\u6001
\nsudo systemctl status nginx<\/p>\n
# \u5907\u4efdnginx\u914d\u7f6e
\nsudo cp -r \/etc\/nginx \/etc\/nginx-backup-1.18<\/p>\n
# \u5907\u4efd\u7f16\u8bd1\u53c2\u6570（\u91cd\u8981！）
\nnginx -V > ~\/nginx-1.18-compile-options.txt<\/p>\n
# \u5b89\u88c5\u5fc5\u8981\u7684\u5de5\u5177
\nsudo apt update
\nsudo apt install -y curl gnupg2 ca-certificates lsb-release ubuntu-keyring<\/p>\n
# \u5bfc\u5165Nginx\u5b98\u65b9\u7b7e\u540d\u5bc6\u94a5
\ncurl https:\/\/nginx.org\/keys\/nginx_signing.key | gpg –dearmor | sudo tee \/usr\/share\/keyrings\/nginx-archive-keyring.gpg >\/dev\/null<\/p>\n
# \u6dfb\u52a0Nginx\u5b98\u65b9\u6e90
\necho "deb [signed-by=\/usr\/share\/keyrings\/nginx-archive-keyring.gpg] http:\/\/nginx.org\/packages\/ubuntu `lsb_release -cs` nginx" | sudo tee \/etc\/apt\/sources.list.d\/nginx.list<\/p>\n
# \u8bbe\u7f6e\u4f18\u5148\u7ea7，\u4f18\u5148\u4f7f\u7528Nginx\u5b98\u65b9\u6e90
\necho -e "Package: *\\\\nPin: origin nginx.org\\\\nPin-Priority: 900" | sudo tee \/etc\/apt\/preferences.d\/99nginx<\/p>\n
# \u66f4\u65b0\u5305\u5217\u8868
\nsudo apt update<\/p>\n
\u4e00\u4e0b\u6307\u4ee4\u6839\u636e\u9700\u8981\u8fdb\u884c\u6267\u884c\u64cd\u4f5c<\/p>\n
sudo systemctl stop nginx
\nsudo systemctl status nginx<\/p>\n<\/p>\n
# \u67e5\u770b\u53ef\u7528\u7684Nginx\u7248\u672c
\napt-cache policy nginx<\/p>\n
# \u5347\u7ea7Nginx\u5230\u6700\u65b0\u7a33\u5b9a\u7248（1.28）
\nsudo apt install nginx<\/p>\n
nginx -v
\nsudo nginx -v<\/p>\n
#!\/bin\/bash<\/p>\n
# Nginx\u70ed\u5347\u7ea7\u811a\u672c – \u65e0\u9700\u91cd\u542f\u670d\u52a1
\nset -e<\/p>\n
echo "\u5f00\u59cbNginx\u70ed\u5347\u7ea7…"<\/p>\n
# \u5907\u4efd\u5f53\u524dNginx\u4e8c\u8fdb\u5236\u6587\u4ef6
\nsudo cp \/usr\/sbin\/nginx \/usr\/sbin\/nginx.backup.1.18.0<\/p>\n
# \u4e0b\u8f7d\u5e76\u7f16\u8bd1Nginx 1.28
\ncd \/tmp
\nwget http:\/\/nginx.org\/download\/nginx-1.28.0.tar.gz
\ntar -zxvf nginx-1.28.0.tar.gz
\ncd nginx-1.28.0<\/p>\n
# \u4f7f\u7528\u4e0e\u5f53\u524d\u7248\u672c\u76f8\u540c\u7684\u914d\u7f6e\u53c2\u6570
\n\u53ef\u4ee5\u6267\u884c\u6307\u4ee4nginx -V > ~\/nginx-1.18-compile-options.txt\u67e5\u770b<\/p>\n
# \u53ea\u7f16\u8bd1\u4e0d\u5b89\u88c5
\nmake<\/p>\n
# \u5907\u4efd\u5f53\u524dNginx
\nsudo mv \/usr\/sbin\/nginx \/usr\/sbin\/nginx.old<\/p>\n
# \u5b89\u88c5\u65b0\u7248\u672c\u4e8c\u8fdb\u5236\u6587\u4ef6
\nsudo cp objs\/nginx \/usr\/sbin\/nginx<\/p>\n
# \u6d4b\u8bd5\u65b0\u7248\u672c
\nsudo \/usr\/sbin\/nginx -t<\/p>\n
# \u5411\u4e3b\u8fdb\u7a0b\u53d1\u9001USR2\u4fe1\u53f7，\u542f\u52a8\u65b0\u7684\u4e3b\u8fdb\u7a0b
\nsudo kill -USR2 $(cat \/run\/nginx.pid)<\/p>\n
# \u7b49\u5f85\u65b0\u8fdb\u7a0b\u542f\u52a8
\nsleep 5<\/p>\n
# \u5411\u65e7\u4e3b\u8fdb\u7a0b\u53d1\u9001WINCH\u4fe1\u53f7，\u4f18\u96c5\u5173\u95ed\u65e7\u5de5\u4f5c\u8fdb\u7a0b
\nsudo kill -WINCH $(cat \/run\/nginx.pid.oldbin 2>\/dev\/null) 2>\/dev\/null || true<\/p>\n
# \u68c0\u67e5\u65b0\u7248\u672c\u662f\u5426\u6b63\u5e38\u8fd0\u884c
\necho "\u68c0\u67e5\u65b0\u7248\u672c\u72b6\u6001…"
\nsudo nginx -v
\nsudo systemctl status nginx<\/p>\n
echo "\u70ed\u5347\u7ea7\u5b8c\u6210！\u65e7\u8fdb\u7a0b\u4ecd\u5728\u8fd0\u884c，\u53ef\u4ee5\u968f\u65f6\u56de\u6eda\u3002"
\necho "\u5982\u679c\u4e00\u5207\u6b63\u5e38，\u53ef\u4ee5\u5b89\u5168\u7ec8\u6b62\u65e7\u8fdb\u7a0b：sudo kill -QUIT $(cat \/run\/nginx.pid.oldbin)"
\n\u00a0<\/p>\n
#!\/bin\/bash<\/p>\n
# \u65e0\u91cd\u542fNginx\u5347\u7ea7\u65b9\u6848
\necho "Nginx\u65e0\u91cd\u542f\u5347\u7ea7\u65b9\u6848…"<\/p>\n
# 1. \u9996\u5148\u68c0\u67e5\u5f53\u524d\u670d\u52a1\u72b6\u6001
\necho "\u5f53\u524dNginx\u72b6\u6001："
\nsudo systemctl status nginx –no-pager<\/p>\n
# 2. \u5b89\u88c5\u65b0\u7248\u672c\u4f46\u4e0d\u91cd\u542f
\nsudo apt update
\nsudo apt install -y nginx –no-install-recommends<\/p>\n
# 3. \u91cd\u65b0\u52a0\u8f7d\u914d\u7f6e（\u4e0d\u91cd\u542f\u670d\u52a1）
\necho "\u91cd\u65b0\u52a0\u8f7d\u914d\u7f6e…"
\nsudo nginx -t && sudo nginx -s reload<\/p>\n
# 4. \u9a8c\u8bc1\u7248\u672c\u5347\u7ea7
\necho "\u5f53\u524d\u8fd0\u884c\u7684Nginx\u7248\u672c："
\nnginx -v 2>&1<\/p>\n
echo "\u7cfb\u7edf\u5b89\u88c5\u7684Nginx\u7248\u672c："
\n\/usr\/sbin\/nginx -v 2>&1<\/p>\n
# 5. \u68c0\u67e5\u670d\u52a1\u662f\u5426\u6b63\u5e38
\necho "\u670d\u52a1\u72b6\u6001\u68c0\u67e5："
\nsudo systemctl status nginx –no-pager<\/p>\n
# 6. \u9a8c\u8bc1\u7f51\u7ad9\u8bbf\u95ee
\necho "\u6d4b\u8bd5\u7f51\u7ad9\u54cd\u5e94："
\ncurl -I http:\/\/localhost -m 5 || echo "HTTP\u6d4b\u8bd5\u5931\u8d25"
\ncurl -I https:\/\/localhost -k -m 5 2>\/dev\/null || echo "HTTPS\u6d4b\u8bd5\u5931\u8d25"<\/p>\n
echo "\u5347\u7ea7\u5b8c\u6210！\u670d\u52a1\u672a\u91cd\u542f，\u4f46\u65b0\u7248\u672c\u5df2\u5c31\u4f4d\u3002"
\necho "\u6ce8\u610f：\u4e0b\u6b21\u91cd\u542f\u670d\u52a1\u65f6\u4f1a\u4f7f\u7528\u65b0\u7248\u672c\u3002"
\n\u00a0<\/p>\n<\/p>\n
#!\/bin\/bash<\/p>\n
# Nginx\u914d\u7f6e\u4f18\u5316\u548c\u5b89\u5168\u52a0\u56fa（\u4e0d\u5347\u7ea7\u7248\u672c）
\necho "\u5f00\u59cb\u4f18\u5316Nginx\u914d\u7f6e…"<\/p>\n
# \u5907\u4efd\u5f53\u524d\u914d\u7f6e
\nsudo cp \/etc\/nginx\/nginx.conf \/etc\/nginx\/nginx.conf.backup.$(date +%Y%m%d)<\/p>\n
# 1. \u5b89\u5168\u5934\u914d\u7f6e
\nsudo tee \/etc\/nginx\/conf.d\/security_headers.conf > \/dev\/null <<'EOF'
\n# \u5b89\u5168\u5934\u90e8\u914d\u7f6e
\nadd_header X-Frame-Options "SAMEORIGIN" always;
\nadd_header X-XSS-Protection "1; mode=block" always;
\nadd_header X-Content-Type-Options "nosniff" always;
\nadd_header Referrer-Policy "strict-origin-when-cross-origin" always;
\nadd_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
\nEOF<\/p>\n
# 2. SSL\u4f18\u5316\u914d\u7f6e
\nsudo tee \/etc\/nginx\/conf.d\/ssl_optimize.conf > \/dev\/null <<'EOF'
\n# SSL\u4f18\u5316\u914d\u7f6e
\nssl_protocols TLSv1.2 TLSv1.3;
\nssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
\nssl_prefer_server_ciphers on;
\nssl_session_cache shared:SSL:10m;
\nssl_session_timeout 10m;
\nEOF<\/p>\n
# 3. \u6027\u80fd\u4f18\u5316\u914d\u7f6e
\nsudo tee \/etc\/nginx\/conf.d\/performance.conf > \/dev\/null <<'EOF'
\n# \u6027\u80fd\u4f18\u5316
\nclient_max_body_size 100M;
\nclient_body_timeout 30;
\nclient_header_timeout 30;
\nkeepalive_timeout 65;
\nsend_timeout 30;
\nsendfile on;
\ntcp_nopush on;
\ntcp_nodelay on;
\ntypes_hash_max_size 2048;
\nserver_tokens off;
\nEOF<\/p>\n
# 4. \u68c0\u67e5\u914d\u7f6e\u8bed\u6cd5
\necho "\u68c0\u67e5\u914d\u7f6e\u8bed\u6cd5…"
\nsudo nginx -t<\/p>\n
if [ $? -eq 0 ]; then
\n\u00a0 \u00a0 # 5. \u91cd\u65b0\u52a0\u8f7d\u914d\u7f6e
\n\u00a0 \u00a0 echo "\u91cd\u65b0\u52a0\u8f7dNginx\u914d\u7f6e…"
\n\u00a0 \u00a0 sudo nginx -s reload
\n\u00a0 \u00a0 echo "\u914d\u7f6e\u4f18\u5316\u5b8c\u6210！"
\nelse
\n\u00a0 \u00a0 echo "\u914d\u7f6e\u8bed\u6cd5\u9519\u8bef，\u5df2\u56de\u6eda…"
\n\u00a0 \u00a0 sudo cp \/etc\/nginx\/nginx.conf.backup.$(date +%Y%m%d) \/etc\/nginx\/nginx.conf
\nfi<\/p>\n
# 6. \u9a8c\u8bc1\u4f18\u5316\u6548\u679c
\necho "\u5f53\u524dNginx\u914d\u7f6e\u72b6\u6001："
\nsudo nginx -T | grep -E "(add_header|ssl_|client_|keepalive)" | head -20
\n\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
\u76ee\u524d\u6709\u4e09\u4e2a\u89e3\u51b3\u65b9\u6848\u4f46\u662f\u6240\u6709\u65b9\u6848\u524d\u5c3d\u91cf\u6267\u884c\u4e00\u4e0b\u6307\u4ee4\u8fdb\u884c\u57fa\u7840\u914d\u7f6e# \u4f7f\u7528sudo\u6743\u9650\u6d4b\u8bd5nginx\u914d\u7f6e
\nsudo nginx -t# \u68c0\u67e5nginx\u670d\u52a1\u72b6\u6001
\nsudo systemctl status nginx# \u5907\u4efdnginx\u914d\u7f6e
\nsudo cp -r \/etc\/nginx \/etc\/nginx-backup-1.18# \u5907\u4efd\u7f16\u8bd1\u53c2\u6570（\u91cd\u8981！）
\nnginx -V > ~\/nginx-1.18-compile-options.txt# <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[117,5388,43],"topic":[],"class_list":["post-86655","post","type-post","status-publish","format-standard","hentry","category-server","tag-nginx","tag-xcode","tag-43"],"yoast_head":"\n