方舟 · Ark

Appearance

Hub代理配置指南 ​

概述 ​

Nginx反向代理是hub数字家庭服务的核心组件，负责：

  • 统一入口管理多个服务
  • SSL/TLS终止
  • 负载均衡
  • 安全防护
  • 静态资源缓存

目录结构 ​

nginx/
├── conf/
│   ├── nginx.conf              # 主配置文件
│   ├── sites-available/        # 可用站点配置
│   │   ├── default.conf        # 默认配置
│   │   ├── nextcloud.conf      # NextCloud配置
│   │   ├── photoprism.conf     # PhotoPrism配置
│   │   ├── joplin.conf         # Joplin配置
│   │   ├── jellyfin.conf       # Jellyfin配置
│   │   └── grafana.conf        # Grafana配置
│   └── sites-enabled/          # 启用的站点配置
├── ssl/                        # SSL证书目录
│   ├── certs/
│   └── private/
├── logs/                       # 日志目录
└── cache/                      # 缓存目录

1. 安装与基础配置 ​

1.1 安装Nginx ​

bash
# Ubuntu/Debian
sudo apt update
sudo apt install nginx

# 或者使用Docker
docker run -d \
  --name nginx \
  -p 80:80 \
  -p 443:443 \
  -v ./nginx/conf:/etc/nginx \
  -v ./nginx/ssl:/etc/nginx/ssl \
  -v ./nginx/logs:/var/log/nginx \
  nginx:alpine

1.2 基础配置文件 ​

nginx
# /etc/nginx/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # 日志格式
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    # 基础设置
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    client_max_body_size 100M;

    # Gzip压缩
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript
               application/javascript application/xml+rss
               application/json application/xml;

    # 包含站点配置
    include /etc/nginx/sites-enabled/*.conf;
}

2. 多服务代理配置 ​

2.1 NextCloud配置 ​

nginx
# /etc/nginx/sites-available/nextcloud.conf
server {
    listen 80;
    server_name nextcloud.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name nextcloud.yourdomain.com;

    # SSL配置
    ssl_certificate /etc/nginx/ssl/certs/nextcloud.crt;
    ssl_certificate_key /etc/nginx/ssl/private/nextcloud.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
    ssl_prefer_server_ciphers off;

    # 安全头
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

    # 代理到NextCloud容器
    location / {
        proxy_pass http://nextcloud:80;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;

        # WebSocket支持
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # 超时设置
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # 静态文件缓存
    location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg)$ {
        proxy_pass http://nextcloud:80;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
}

2.2 PhotoPrism配置 ​

nginx
# /etc/nginx/sites-available/photoprism.conf
server {
    listen 80;
    server_name photos.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name photos.yourdomain.com;

    # SSL配置
    ssl_certificate /etc/nginx/ssl/certs/photoprism.crt;
    ssl_certificate_key /etc/nginx/ssl/private/photoprism.key;

    # 安全头
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;

    # 代理到PhotoPrism容器
    location / {
        proxy_pass http://photoprism:2342;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 文件上传大小限制
        client_max_body_size 100M;
    }

    # 图片缓存
    location ~* \.(jpg|jpeg|png|gif|webp)$ {
        proxy_pass http://photoprism:2342;
        expires 1y;
        add_header Cache-Control "public";
    }
}

2.3 Joplin配置 ​

nginx
# /etc/nginx/sites-available/joplin.conf
server {
    listen 80;
    server_name notes.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name notes.yourdomain.com;

    # SSL配置
    ssl_certificate /etc/nginx/ssl/certs/joplin.crt;
    ssl_certificate_key /etc/nginx/ssl/private/joplin.key;

    # 代理到Joplin容器
    location / {
        proxy_pass http://joplin:22300;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket支持
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

2.4 Jellyfin配置 ​

nginx
# /etc/nginx/sites-available/jellyfin.conf
server {
    listen 80;
    server_name media.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name media.yourdomain.com;

    # SSL配置
    ssl_certificate /etc/nginx/ssl/certs/jellyfin.crt;
    ssl_certificate_key /etc/nginx/ssl/private/jellyfin.key;

    # 代理到Jellyfin容器
    location / {
        proxy_pass http://jellyfin:8096;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 媒体流优化
        proxy_buffering off;
        proxy_request_buffering off;
    }

    # 媒体文件直接代理
    location ~* \.(mp4|mkv|avi|mov|wmv|flv|webm)$ {
        proxy_pass http://jellyfin:8096;
        proxy_buffering off;
        proxy_request_buffering off;
    }
}

2.5 Grafana配置 ​

nginx
# /etc/nginx/sites-available/grafana.conf
server {
    listen 80;
    server_name monitor.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name monitor.yourdomain.com;

    # SSL配置
    ssl_certificate /etc/nginx/ssl/certs/grafana.crt;
    ssl_certificate_key /etc/nginx/ssl/private/grafana.key;

    # 代理到Grafana容器
    location / {
        proxy_pass http://grafana:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket支持
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

3. SSL证书配置 ​

3.1 自签名证书生成 ​

bash
# 创建SSL目录
sudo mkdir -p /etc/nginx/ssl/{certs,private}

# 生成自签名证书
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /etc/nginx/ssl/private/nextcloud.key \
    -out /etc/nginx/ssl/certs/nextcloud.crt \
    -subj "/C=CN/ST=State/L=City/O=Organization/CN=nextcloud.yourdomain.com"

# 为其他服务生成证书
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /etc/nginx/ssl/private/photoprism.key \
    -out /etc/nginx/ssl/certs/photoprism.crt \
    -subj "/C=CN/ST=State/L=City/O=Organization/CN=photos.yourdomain.com"

3.2 Let's Encrypt证书 ​

bash
# 安装certbot
sudo apt install certbot python3-certbot-nginx

# 获取证书
sudo certbot --nginx -d nextcloud.yourdomain.com
sudo certbot --nginx -d photos.yourdomain.com
sudo certbot --nginx -d notes.yourdomain.com

# 自动续期
sudo crontab -e
# 添加：0 12 * * * /usr/bin/certbot renew --quiet

4. 安全配置 ​

4.1 基础安全设置 ​

nginx
# 在http块中添加
# 隐藏Nginx版本
server_tokens off;

# 限制请求大小
client_max_body_size 100M;
client_body_buffer_size 128k;

# 防止点击劫持
add_header X-Frame-Options "SAMEORIGIN" always;

# 防止MIME类型嗅探
add_header X-Content-Type-Options "nosniff" always;

# XSS保护
add_header X-XSS-Protection "1; mode=block" always;

# 引用策略
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

4.2 访问控制 ​

nginx
# 限制访问频率
limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;

location /login {
    limit_req zone=login burst=20 nodelay;
    proxy_pass http://backend;
}

# IP白名单
allow 192.168.1.0/24;
allow 10.0.0.0/8;
deny all;

4.3 防盗链配置 ​

nginx
# 图片防盗链
location ~* \.(jpg|jpeg|png|gif|webp)$ {
    valid_referers none blocked yourdomain.com *.yourdomain.com;
    if ($invalid_referer) {
        return 403;
    }
    proxy_pass http://backend;
}

5. 性能优化 ​

5.1 缓存配置 ​

nginx
# 静态文件缓存
location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
    add_header Vary Accept-Encoding;
}

# 代理缓存
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=10g inactive=60m use_temp_path=off;

location / {
    proxy_cache my_cache;
    proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
    proxy_cache_valid 200 1h;
    proxy_cache_valid 404 1m;
}

5.2 压缩配置 ​

nginx
# Gzip压缩
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_proxied any;
gzip_comp_level 6;
gzip_types
    text/plain
    text/css
    text/xml
    text/javascript
    application/javascript
    application/xml+rss
    application/json
    application/xml
    image/svg+xml;

5.3 连接优化 ​

nginx
# 连接池配置
upstream backend {
    server 127.0.0.1:8080;
    keepalive 32;
}

# 代理连接优化
location / {
    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_set_header Keep-Alive "";
    proxy_set_header Proxy-Connection "keep-alive";
}

6. 监控与日志 ​

6.1 日志配置 ​

nginx
# 访问日志
log_format detailed '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent" '
                    'rt=$request_time uct="$upstream_connect_time" '
                    'uht="$upstream_header_time" urt="$upstream_response_time"';

access_log /var/log/nginx/access.log detailed;

# 错误日志
error_log /var/log/nginx/error.log warn;

6.2 状态监控 ​

nginx
# Nginx状态页面
location /nginx_status {
    stub_status on;
    access_log off;
    allow 127.0.0.1;
    allow 192.168.1.0/24;
    deny all;
}

7. 故障排查 ​

7.1 常见问题 ​

1. 502 Bad Gateway

bash
# 检查后端服务状态
docker ps | grep nextcloud
curl -I http://nextcloud:80

# 检查Nginx配置
nginx -t

2. SSL证书问题

bash
# 检查证书有效性
openssl x509 -in /etc/nginx/ssl/certs/nextcloud.crt -text -noout

# 检查证书链
openssl s_client -connect nextcloud.yourdomain.com:443 -servername nextcloud.yourdomain.com

3. 权限问题

bash
# 检查文件权限
ls -la /etc/nginx/ssl/private/
chmod 600 /etc/nginx/ssl/private/*.key
chmod 644 /etc/nginx/ssl/certs/*.crt

7.2 调试命令 ​

bash
# 测试配置
nginx -t

# 重新加载配置
nginx -s reload

# 查看进程
ps aux | grep nginx

# 查看端口
netstat -tlnp | grep nginx

# 查看日志
tail -f /var/log/nginx/error.log
tail -f /var/log/nginx/access.log

8. Docker部署 ​

8.1 Docker Compose配置 ​

yaml
# docker-compose.yml
version: '3.8'

services:
  nginx:
    image: nginx:alpine
    container_name: nginx-proxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/conf:/etc/nginx
      - ./nginx/ssl:/etc/nginx/ssl
      - ./nginx/logs:/var/log/nginx
      - ./nginx/cache:/var/cache/nginx
    depends_on:
      - nextcloud
      - photoprism
      - joplin
      - jellyfin
      - grafana
    networks:
      - hub-network
    restart: unless-stopped

networks:
  hub-network:
    external: true

8.2 启动命令 ​

bash
# 创建必要目录
mkdir -p nginx/{conf,ssl/{certs,private},logs,cache}

# 复制配置文件
cp nginx.conf nginx/conf/
cp sites-available/* nginx/conf/sites-available/

# 启动服务
docker-compose up -d nginx

# 检查状态
docker-compose ps nginx
docker-compose logs nginx

9. 最佳实践 ​

9.1 配置管理 ​

  1. 版本控制：将配置文件纳入Git管理
  2. 模板化：使用环境变量替换敏感信息
  3. 备份：定期备份配置文件
  4. 测试：修改配置前先测试

9.2 安全建议 ​

  1. 定期更新：保持Nginx版本最新
  2. 最小权限：使用最小权限原则
  3. 监控告警：设置异常访问告警
  4. 日志分析：定期分析访问日志

9.3 性能建议 ​

  1. 缓存策略：合理配置缓存
  2. 压缩优化：启用Gzip压缩
  3. 连接池：优化连接池配置
  4. 负载均衡：考虑多实例部署

总结 ​

Nginx反向代理是hub数字家庭服务的重要组件，通过合理配置可以实现：

  • 统一入口管理
  • SSL/TLS安全
  • 性能优化
  • 安全防护
  • 易于维护

建议根据实际需求调整配置参数，并定期监控和优化。

方舟 · Ark

Copyright © 2026-present WhatHappenin