Nginx reverse proxy: từ zero đến production
Nginx là reverse proxy phổ biến nhất. Bài này từ setup cơ bản đến các config production mình đang dùng.
Cài đặt
# Ubuntu/Debian
sudo apt install nginx
# Kiểm tra
sudo nginx -t
sudo systemctl start nginx
Reverse Proxy cơ bản
# /etc/nginx/sites-available/myapp
server {
listen 80;
server_name myapp.com;
location / {
proxy_pass http://localhost:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
```
```bash
sudo ln -s /etc/nginx/sites-available/myapp /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
```
## HTTPS với Let's Encrypt
```bash
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d myapp.com
```
Certbot tự thêm SSL config và auto-renew.
## Load Balancing
```nginx
upstream backend {
least_conn; # Chọn server ít connection nhất
server 127.0.0.1:3001;
server 127.0.0.1:3002;
server 127.0.0.1:3003;
}
server {
listen 80;
server_name myapp.com;
location / {
proxy_pass http://backend;
}
}
```
Các algorithm: `round-robin` (mặc định), `least_conn`, `ip_hash` (sticky session).
## Caching static files
```nginx
server {
location /static/ {
alias /app/public/;
expires 30d;
add_header Cache-Control "public, immutable";
}
location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
expires 7d;
add_header Cache-Control "public";
}
}
```
## Rate Limiting
```nginx
# Định nghĩa zone
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
server {
location /api/ {
limit_req zone=api burst=20 nodelay;
proxy_pass http://backend;
}
}
```
10 request/giây/IP, cho phép burst 20 request.
## WebSocket
```nginx
location /ws {
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 86400;
}
```
## Security headers
```nginx
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'" always;
```
## Monitoring
```nginx
location /nginx_status {
stub_status on;
allow 127.0.0.1;
deny all;
}
```
---
Config Nginx nào bạn thấy hữu ích nhất? Share nhé!All rights reserved
