SUSE Linux 15 sp5上Nginx安装配置升级

1.安装SUSE linux 15 SP5
图形化界面安装很简单，选择最小安装，安装好后，使用vim编辑配置文件，结果提示"bash: vim: command not found"。
最简安装把一些常用命令都整没有了，于是又重新选择了Server Applications Module 和 Web and scripting Module安装。
终于可以使用vim命令了，继续往下操作。
安装时没有设置IP地址，/etc/sysconfig/network下没有找到生成的ifcfg-eth0，于是用yast设置IP和网关

2.安装Nginx
localhost:/etc/sysconfig/network # zypper search nginx
Loading repository data...
Reading installed packages...
S | Name             | Summary                                                     | Type
--+------------------+-------------------------------------------------------------+--------
  | dehydrated-nginx | Nginx Integration for dehydrated                            | package
  | nginx            | A HTTP server and IMAP/POP3 proxy server                    | package
  | nginx-macros     | Just some macros to make packaging nginx and modules easier | package
  | nginx-source     | The nginx source                                            | package

Note: For an extended search including not yet activated remote resources please use 'zypper   search-packages'.
#安装
localhost:/etc/sysconfig/network # zypper in nginx
Loading repository data...
Reading installed packages...
Resolving package dependencies...

The following NEW package is going to be installed:  nginx
1 new package to install.
Overall download size: 703.3 KiB. Already cached: 0 B. After the operation, additional 2.3 MiB will be used.
Continue? [y/n/v/...? shows all options] (y): y
Retrieving: nginx-1.21.5-150400.3.3.1.x86_64 (sle-module-server-applications)                                                                                                                                                                             (1/1), 703.3 KiB    
Checking for file conflicts: ...........................................................................................................................................................................................................................................[done]
/usr/sbin/useradd -r -c User for nginx -d /var/lib/nginx -U nginx -s /usr/sbin/nologin
(1/1) Installing: nginx-1.21.5-150400.3.3.1.x86_64 .....................................................................................................................................................................................................................[done]
#启用
localhost:/etc/sysconfig/network # systemctl enable nginx
Created symlink /etc/systemd/system/multi-user.target.wants/nginx.service → /usr/lib/systemd/system/nginx.service.
#开启服务
localhost:/etc/sysconfig/network # systemctl start nginx
#查看启动状态
localhost:/etc/sysconfig/network # systemctl status nginx
● nginx.service - The nginx HTTP and reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vendor preset: disabled)
     Active: active (running) since Thu 2024-06-13 13:06:32 CST; 38s ago
    Process: 8487 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
   Main PID: 8489 (nginx)
      Tasks: 2
     CGroup: /system.slice/nginx.service
             ├─ 8489 "nginx: master process /usr/sbin/nginx -g daemon off;"
             └─ 8490 "nginx: worker process" "" "" "" "" "" "" "" "" ""

Jun 13 13:06:32 localhost systemd[1]: Starting The nginx HTTP and reverse proxy server...
Jun 13 13:06:32 localhost nginx[8487]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
Jun 13 13:06:32 localhost nginx[8487]: nginx: configuration file /etc/nginx/nginx.conf test is successful
Jun 13 13:06:32 localhost systemd[1]: Started The nginx HTTP and reverse proxy server.
#查看进程
localhost:/etc/sysconfig/network # ps -ef|grep nginx
root      8489     1  0 13:06 ?        00:00:00 nginx: master process /usr/sbin/nginx -g daemon off;
nginx     8490  8489  0 13:06 ?        00:00:00 nginx: worker process
root      8496  4496  0 13:09 pts/0    00:00:00 grep --color=auto nginx
#查看端口
localhost:/etc/sysconfig/network # ss -tulpn |grep nginx
一切都正常，但是访问http://ip，得到的结果是“无法反问，错误403 Forbidden nginx/1.21.5"
正常情况这里安装好了都是可以打开Nginx的欢迎界面的。
#防火墙设置
localhost:/etc/sysconfig/network # systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: disabled)
     Active: active (running) since Thu Jun 13 13:09:32 CST; 3h 8min ago
       Docs: man:firewalld(1)
   Main PID: 778 (firewalld)
      Tasks: 2
     CGroup: /system.slice/firewalld.service
             └─ 778 /usr/bin/python3 /usr/sbin/firewalld --nofork --nopid
Jun 13 13:09:32 localhost systemd[1]: Starting firewalld - dynamic firewall daemon...
Jun 13 13:09:32 localhost systemd[1]: Started firewalld - dynamic firewall daemon.
#添加了端口

localhost:/etc/sysconfig/network # firewall-cmd --add-port=80/tcp --permanent
localhost:/etc/sysconfig/network # firewall-cmd --reload
设置了也没有用，原因不在这儿。
#查看错误日志
localhost:/etc/nginx # cat /var/log/nginx/error.log
2024/06/13 13:47:16 [error] 1453#1453: *4 open() "/srv/www/htdocs/index.html" failed (2: No such file or directory), client: 192.168.10.8, server: localhost, request: "GET /index.html HTTP/1.1", host: "192.168.10.39"
"http://192.168.0.39/index.html"
2024/06/13 13:56:43 [error] 2376#2376: *1 directory index of "/srv/www/htdocs/" is forbidden, client: 192.168.10.8, server: localhost, request: "GET / HTTP/1.1", host: "192.168.10.39"
2024/06/13 13:56:47 [error] 2376#2376: *1 directory index of "/srv/www/htdocs/" is forbidden, client: 192.168.10.8, server: localhost, request: "GET / HTTP/1.1", host: "192.168.10.39"
2024/06/13 13:57:00 [error] 2376#2376: *1 directory index of "/srv/www/htdocs/" is forbidden, client: 192.168.10.8, server: localhost, request: "GET / HTTP/1.1", host: "192.168.10.39
里面空空荡荡的，使用SUSE库安装的和从Nginx下载的安装还是有点不同的。
localhost:~ # cd /srv/www/htdocs
localhost:/srv/www/htdocs # ls
50x.html

3.配置Nginx
配置之前好好看了优化的相关文章，优化的参数太多，就修改了自己中意的几个。
3.1配置参数优化Nginx： vim /etc/nginx/nginx.conf
worker_processes  8;
worker_rlimit_nofile 65536;
events {
    worker_connections  10240;
    use epoll;
}
--高效传输
    sendfile        on;
    tcp_nopush     on;

--压缩
    gzip  on;
    gzip_min_length 1k;
    gzip_buffers 4 32k;
    gzip_comp_level 6;
    gzip_types text/plain application/x-javascript text/css application/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png;
    gzip_vary off;
    gzip_disable "MSIE [1-6]\.";

3.2文件句柄限制：vim /etc/security/limits.conf
*               -       nofile          65536
*               soft    nofile          65536
*               hard    nofile          65536
root            soft    nofile          65536
root            hard    nofile          65536

3.3内核参数优化：vim /etc/sysctl.conf
net.core.somaxconn = 40960
fs.file-max = 999999  --同时打开的最大句柄数
net.ipv4.tcp_tw_recycle = 1--快速回收
net.ipv4.tcp_tw_reuse = 1--开启重用
net.ipv4.tcp_syncookies = 0--启用SYNC cookies
net.ipv4.tcp_max_orphans = 3276800

我的目的是让Nginx做请求代理服务器，所以http配置如下
http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    tcp_nopush     on;
    keepalive_timeout  65;
    gzip  on;
    gzip_min_length 1k;
    gzip_buffers 4 32k;
    gzip_comp_level 6;
    gzip_types text/plain application/x-javascript text/css application/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png;
    gzip_vary off;
    gzip_disable "MSIE [1-6]\.";
    upstream srm {
              #sticky;
              ip_hash;
          server  192.168.10.1:82 weight=3 max_fails=2 fail_timeout=36;
          server  192.168.10.2:82 weight=3 max_fails=2 fail_timeout=36;
          server  192.168.10.3:82 weight=3 max_fails=2 fail_timeout=36;
          server  192.168.10.4:82 weight=3 max_fails=2 fail_timeout=36;
                      }
    include conf.d/*.conf;
    server {
        listen       80;
        server_name  localhost;
        #charset koi8-r;
        access_log  /var/log/nginx/host.access.log  main;
        location / {
           root   /srv/www/htdocs/;
           index  index.html index.htm;
           proxy_pass         http://srm;
           proxy_set_header   Host             $host:80;
           proxy_set_header   X-Real-IP        $remote_addr;
           proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
           client_max_body_size     100m;
           proxy_connect_timeout       15;
           proxy_read_timeout          300;
           proxy_send_timeout          500;
           if (-d $request_filename){ rewrite ^/(.*)([^/])$ /$1$2/ permanent; }
        }

4.防火墙设置允许端口
SuSEfirewall2配置简单，但是将被 firewalld替代，用yast2配置更直观一些。
#启停命令及状态查看
systemctl start firewalld
systemctl enable firewalld
systemctl stop firewalld
systemctl disable firewalld
firewall-cmd --state
#查看安全域
localhost:/etc/sysconfig/network  # firewall-cmd --get-zones
localhost:/etc/sysconfig/network  # firewall-cmd --get-default-zone
#配置多个端口
localhost:/etc/sysconfig/network # firewall-cmd --add-port=80/tcp --add-port=22/tcp --permanent
#配置服务
localhost:/etc/sysconfig/network #firewall-cmd --zone=public --add-service=http
#配置修改后重新加载
localhost:/etc/sysconfig/network #firewall-cmd --reload
#列出安全域允许的服务
localhost:/etc/sysconfig/network #firewall-cmd --list-services --zone=public
#查看配置结果
localhost:/etc/sysconfig/network #firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: dhcpv6-client ssh
  ports: 80/tcp
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

5.升级Nginx失败
localhost:/etc/sysconfig/network # nginx -v
nginx version: nginx/1.21.5
但是官网上的版本都已经1.27了，继续往上升级
找到下载链接，下载解压缩：
localhost:/tmp #wget https://nginx.org/download/nginx-1.27.0.tar.gz
localhost:/tmp #mkdir /usr/nginx
localhost:/tmp #mv nginx-1.27.0.tar.gz /usr/nginx
localhost://usr/nginx #tar -zxf nginx-1.27.0.tar.gz
localhost:/usr/nginx #./configure && make &&make install
结果获得错误：
checking for C compiler ... not found
./configure: error: C compiler cc is not found
localhost:/usr/nginx #whereis gcc
可以看到安装了gcc,怀疑版本问题
localhost:/usr/nginx #zypper install gcc
果然更新后，检查通过，但是遇到新问题了：
./configure error the HTTP rewrite module requires the PCRE library
localhost:/usr/nginx #zypper install pcre
找不到安装包，只能选择跳过
localhost:/usr/nginx #./confgure --without-http_rewrite_module && make && make install
又遇到新错误
./configure error the HTTP Gzip module requires the zlib library
缺失那我就安装
localhost:/usr/nginx #zypper install zlib
可系统提示已经存在，那就继续跳过
localhost:/usr/nginx #./configure --wirhout-http_rewrite_module --with-zlib=/usr/share/man/mann/zbil.n.gz && make && make install
还是错误：
fatal error:zlib.h:No such file or directory
算了，还是老老实实用1.21.5版本。