Nginx 缓存与 HTTPS/HTTP2 实战基于陶辉《深入理解 Nginx》第四章本文所有命令输出均来自两台真实云服务器Ubuntu 24.04.4 / nginx 1.24.0的现场回显未做任何编造。承接上一篇的反向代理拓扑本篇在同一台代理层上叠加两件事① 用proxy_cache给上游响应做反向代理缓存② 用listen 443 ssl http2提供 HTTPS 与 HTTP/2。一、架构回顾客户端 ──► 代理层 139.9.***.*** ├─ :80 反向代理 负载均衡上一章 ├─ :8088 反向代理「缓存」演示 ──┐ └─ :443 HTTPS HTTP/2 ├─► 上游 192.168.0.113:8081/8082/8083 缓存落在 /var/cache/nginx/blog ─┘缓存的核心价值让代理直接返回热点响应不再回源从而降低上游压力、缩短响应时间。二、反向代理缓存proxy_cache1) 配置缓存相关的指令分两处proxy_cache_path必须在http上下文这里放在conf.d被主配置include进 http 块proxy_cache系列在location内。# /etc/nginx/conf.d/proxy_cache.conf proxy_cache_path /var/cache/nginx/blog levels1:2 keys_zoneblog_cache:10m max_size1g inactive60m use_temp_pathoff; server { listen 8088; server_name _; add_header X-Cache-Status $upstream_cache_status always; # 透出命中状态 add_header X-Upstream $upstream_addr always; location / { proxy_pass http://backend_rr; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_cache blog_cache; proxy_cache_key $scheme$proxy_host$request_uri; proxy_cache_valid 200 302 10m; # 200/302 缓存 10 分钟 proxy_cache_valid 404 1m; proxy_cache_valid any 5m; proxy_cache_lock on; # 缓存击穿保护只放一个请求去回源 proxy_cache_bypass $http_cache_control; # 客户端可绕过 proxy_no_cache $http_pragma $http_authorization; } # 演示忽略上游 Cache-Control强制按本地规则缓存 location /force/ { proxy_pass http://backend_rr; proxy_ignore_headers Cache-Control Expires Set-Cookie; proxy_cache blog_cache; proxy_cache_key FORCE:$scheme$proxy_host$request_uri; proxy_cache_valid 200 30s; add_header X-Cache-Status $upstream_cache_status always; } }几个要点keys_zoneblog_cache:10m在共享内存划 10MB 存缓存索引与上一章upstream的zone同理必须共享。levels1:2多级目录避免单目录文件过多拖慢文件系统。$upstream_cache_statusMISS / HIT / BYPASS / EXPIRED / UPDATING / STALE是验证缓存效果的「显微镜」。2) 命中验证MISS → HIT对同一 URL 连续请求第一次回源MISS之后直接命中HIT$curl-s-ihttp://127.0.0.1:8088/|grep-iEX-Cache-Status|X-BackendX-Backend: backend-8083 X-Cache-Status: MISS $curl-s-ihttp://127.0.0.1:8088/|grep-iEX-Cache-Status|X-BackendX-Backend: backend-8083 X-Cache-Status: HIT $curl-s-ihttp://127.0.0.1:8088/|grep-iEX-Cache-Status|X-BackendX-Backend: backend-8083 X-Cache-Status: HIT注意第二次、第三次虽然是 HIT但X-Backend仍是backend-8083——这是缓存命中后直接读磁盘/内存、不再回源的证据若真回源轮询会把后端换成其它节点。3) 缓存键cache key随 URL 变化缓存键包含$request_uri所以不同查询串是独立缓存项$curl-s-ihttp://127.0.0.1:8088/?v2|grep-iEX-Cache-StatusX-Cache-Status: MISS $curl-s-ihttp://127.0.0.1:8088/?v2|grep-iEX-Cache-StatusX-Cache-Status: HIT4) 客户端绕过缓存通过proxy_cache_bypass $http_cache_control带Cache-Control: no-cache的请求会强制回源$curl-s-i-HCache-Control: no-cachehttp://127.0.0.1:8088/|grep-iEX-Cache-StatusX-Cache-Status: BYPASS5) 强制缓存忽略上游头上游若返回Cache-Control: no-store之类默认不会被缓存。用proxy_ignore_headers可让代理按自己的规则缓存$curl-s-ihttp://127.0.0.1:8088/force/test|grep-iEX-Cache-StatusX-Cache-Status: MISS $curl-s-ihttp://127.0.0.1:8088/force/test|grep-iEX-Cache-StatusX-Cache-Status: HIT6) 缓存真的落盘了$find/var/cache/nginx/blog-typef|head/var/cache/nginx/blog/3/65/4ec78dcd21eb44ed1326c79aceb9a653 /var/cache/nginx/blog/7/40/50550861c9c9b763e75dfd0cf6a14407 /var/cache/nginx/blog/a/f6/3d77faa614c79b2586bc1d0380b94f6a $find/var/cache/nginx/blog-typef|wc-l3/、/?v2、/force/test三个键各生成一个缓存文件levels1:2的多级目录结构也清晰可见。生产建议用proxy_cache_lock on防「缓存击穿」——高并发同时 miss 同一 key 时只放一个请求去回源。搭配add_header X-Cache-Status $upstream_cache_status做可观测性是排查「为什么没命中」最快的手段。注意默认只缓存 GET/HEADproxy_cache_methods可改带Set-Cookie的响应默认不缓存可用proxy_ignore_headers调整。三、HTTPS HTTP/21) 生成自签证书演示用$mkdir-p/etc/nginx/ssl $ openssl req-x509-nodes-days365-newkeyrsa:2048\-keyout/etc/nginx/ssl/blog.key-out/etc/nginx/ssl/blog.crt\-subj/CNnginx-blog-lab$ls-l/etc/nginx/ssl/ -rw-r--r--1root root1127... /etc/nginx/ssl/blog.crt -rw-------1root root1704... /etc/nginx/ssl/blog.key生产环境请用受信任 CA 签发的证书Let’s Encrypt 免费自签证书仅用于实验室验证 TLS 链路。2) 开启 443 SSL HTTP/2# /etc/nginx/conf.d/proxy_https.conf server { listen 443 ssl http2; server_name _; ssl_certificate /etc/nginx/ssl/blog.crt; ssl_certificate_key /etc/nginx/ssl/blog.key; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; add_header X-Upstream $upstream_addr always; location / { proxy_pass http://backend_rr; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # 告知后端原始是 https } }关键点listen 443 ssl http2;一条指令同时启用 TLS 与 HTTP/2nginx 1.25 还支持http2独立指令1.24 用 listen 参数写法即可。ssl_protocols TLSv1.2 TLSv1.3禁用不安全的 TLS 1.0/1.1。X-Forwarded-Proto $scheme后端据此知道原始请求是 HTTPS正确生成https://链接。3) 验证监听已起且响应头直接就是HTTP/2$ ss-ltn|grep:443LISTEN05110.0.0.0:4430.0.0.0:* $curl-k-s-Ihttps://127.0.0.1/|head-8HTTP/2200server: nginx/1.24.0(Ubuntu)date: Fri,24Jul202604:45:47 GMT content-type: text/plain x-backend: backend-8081 x-upstream:192.168.0.113:8081 $curl-k-s-o/dev/null-whttp_version%{http_version}\n--http2https://127.0.0.1/http_version2用openssl s_client显式协商h2确认 ALPN 真正生效$echo|openssl s_client-connect127.0.0.1:443-alpnh22/dev/null|grep-iEsubject|ALPN|issuersubjectCNnginx-blog-labissuerCNnginx-blog-lab ALPN protocol: h2ALPN protocol: h2说明客户端与 Nginx 在 TLS 握手阶段就协商出了 HTTP/2 协议。从公网访问同样正常$curl-k-s-o/dev/null-wcode%{http_code} version%{http_version}\nhttps://139.9.***.***/code200version1.1注示例里本地curlSchannel 后端公网探测回显为version1.1是因为该客户端实现未在握手时优先协商 h2而服务器侧的curl --http2与openssl -alpn h2均明确返回http/2/ALPN protocol: h2足以证明 HTTP/2 已生效。生产中以openssl s_client -alpn h2的 ALPN 结果为准。四、小结反向代理缓存proxy_cache_path共享内存索引 磁盘目录proxy_cacheproxy_cache_valid三件套即可生效用X-Cache-Status观测 MISS/HIT/BYPASSproxy_cache_lock防击穿proxy_ignore_headers可覆盖上游缓存策略。HTTPS/HTTP2自签证书或 CA 证书配listen 443 ssl http2ssl_protocols关掉旧协议X-Forwarded-Proto把「原始是 https」透给后端。验证用curl --http2看http_version2用openssl s_client -alpn h2看ALPN protocol: h2。两篇串联代理层 反向代理隐藏上游 负载均衡横向扩展 缓存减压提速 TLS/HTTP2安全与性能。四者叠加就是一套标准的「接入层 / 网关」雏形。附本实验部署的全部配置文件清单均已在真实服务器生效文件所在机器作用/etc/nginx/conf.d/backends.conf上游 192.168.0.1133 个后端 8081/8082/8083/etc/nginx/conf.d/proxy_upstreams.conf代理 192.168.0.1494 个 upstreamrr/weighted/ip_hash/least_conn均带zone/etc/nginx/conf.d/proxy_lb.conf代理:80 / :8091 / :8092 / :8093 负载均衡演示/etc/nginx/conf.d/proxy_cache.conf代理:8088 反向代理缓存/etc/nginx/conf.d/proxy_https.conf代理:443 ssl http2
Nginx 缓存与 HTTPS/HTTP2 实战（基于陶辉《深入理解 Nginx》第四章）
Nginx 缓存与 HTTPS/HTTP2 实战基于陶辉《深入理解 Nginx》第四章本文所有命令输出均来自两台真实云服务器Ubuntu 24.04.4 / nginx 1.24.0的现场回显未做任何编造。承接上一篇的反向代理拓扑本篇在同一台代理层上叠加两件事① 用proxy_cache给上游响应做反向代理缓存② 用listen 443 ssl http2提供 HTTPS 与 HTTP/2。一、架构回顾客户端 ──► 代理层 139.9.***.*** ├─ :80 反向代理 负载均衡上一章 ├─ :8088 反向代理「缓存」演示 ──┐ └─ :443 HTTPS HTTP/2 ├─► 上游 192.168.0.113:8081/8082/8083 缓存落在 /var/cache/nginx/blog ─┘缓存的核心价值让代理直接返回热点响应不再回源从而降低上游压力、缩短响应时间。二、反向代理缓存proxy_cache1) 配置缓存相关的指令分两处proxy_cache_path必须在http上下文这里放在conf.d被主配置include进 http 块proxy_cache系列在location内。# /etc/nginx/conf.d/proxy_cache.conf proxy_cache_path /var/cache/nginx/blog levels1:2 keys_zoneblog_cache:10m max_size1g inactive60m use_temp_pathoff; server { listen 8088; server_name _; add_header X-Cache-Status $upstream_cache_status always; # 透出命中状态 add_header X-Upstream $upstream_addr always; location / { proxy_pass http://backend_rr; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_cache blog_cache; proxy_cache_key $scheme$proxy_host$request_uri; proxy_cache_valid 200 302 10m; # 200/302 缓存 10 分钟 proxy_cache_valid 404 1m; proxy_cache_valid any 5m; proxy_cache_lock on; # 缓存击穿保护只放一个请求去回源 proxy_cache_bypass $http_cache_control; # 客户端可绕过 proxy_no_cache $http_pragma $http_authorization; } # 演示忽略上游 Cache-Control强制按本地规则缓存 location /force/ { proxy_pass http://backend_rr; proxy_ignore_headers Cache-Control Expires Set-Cookie; proxy_cache blog_cache; proxy_cache_key FORCE:$scheme$proxy_host$request_uri; proxy_cache_valid 200 30s; add_header X-Cache-Status $upstream_cache_status always; } }几个要点keys_zoneblog_cache:10m在共享内存划 10MB 存缓存索引与上一章upstream的zone同理必须共享。levels1:2多级目录避免单目录文件过多拖慢文件系统。$upstream_cache_statusMISS / HIT / BYPASS / EXPIRED / UPDATING / STALE是验证缓存效果的「显微镜」。2) 命中验证MISS → HIT对同一 URL 连续请求第一次回源MISS之后直接命中HIT$curl-s-ihttp://127.0.0.1:8088/|grep-iEX-Cache-Status|X-BackendX-Backend: backend-8083 X-Cache-Status: MISS $curl-s-ihttp://127.0.0.1:8088/|grep-iEX-Cache-Status|X-BackendX-Backend: backend-8083 X-Cache-Status: HIT $curl-s-ihttp://127.0.0.1:8088/|grep-iEX-Cache-Status|X-BackendX-Backend: backend-8083 X-Cache-Status: HIT注意第二次、第三次虽然是 HIT但X-Backend仍是backend-8083——这是缓存命中后直接读磁盘/内存、不再回源的证据若真回源轮询会把后端换成其它节点。3) 缓存键cache key随 URL 变化缓存键包含$request_uri所以不同查询串是独立缓存项$curl-s-ihttp://127.0.0.1:8088/?v2|grep-iEX-Cache-StatusX-Cache-Status: MISS $curl-s-ihttp://127.0.0.1:8088/?v2|grep-iEX-Cache-StatusX-Cache-Status: HIT4) 客户端绕过缓存通过proxy_cache_bypass $http_cache_control带Cache-Control: no-cache的请求会强制回源$curl-s-i-HCache-Control: no-cachehttp://127.0.0.1:8088/|grep-iEX-Cache-StatusX-Cache-Status: BYPASS5) 强制缓存忽略上游头上游若返回Cache-Control: no-store之类默认不会被缓存。用proxy_ignore_headers可让代理按自己的规则缓存$curl-s-ihttp://127.0.0.1:8088/force/test|grep-iEX-Cache-StatusX-Cache-Status: MISS $curl-s-ihttp://127.0.0.1:8088/force/test|grep-iEX-Cache-StatusX-Cache-Status: HIT6) 缓存真的落盘了$find/var/cache/nginx/blog-typef|head/var/cache/nginx/blog/3/65/4ec78dcd21eb44ed1326c79aceb9a653 /var/cache/nginx/blog/7/40/50550861c9c9b763e75dfd0cf6a14407 /var/cache/nginx/blog/a/f6/3d77faa614c79b2586bc1d0380b94f6a $find/var/cache/nginx/blog-typef|wc-l3/、/?v2、/force/test三个键各生成一个缓存文件levels1:2的多级目录结构也清晰可见。生产建议用proxy_cache_lock on防「缓存击穿」——高并发同时 miss 同一 key 时只放一个请求去回源。搭配add_header X-Cache-Status $upstream_cache_status做可观测性是排查「为什么没命中」最快的手段。注意默认只缓存 GET/HEADproxy_cache_methods可改带Set-Cookie的响应默认不缓存可用proxy_ignore_headers调整。三、HTTPS HTTP/21) 生成自签证书演示用$mkdir-p/etc/nginx/ssl $ openssl req-x509-nodes-days365-newkeyrsa:2048\-keyout/etc/nginx/ssl/blog.key-out/etc/nginx/ssl/blog.crt\-subj/CNnginx-blog-lab$ls-l/etc/nginx/ssl/ -rw-r--r--1root root1127... /etc/nginx/ssl/blog.crt -rw-------1root root1704... /etc/nginx/ssl/blog.key生产环境请用受信任 CA 签发的证书Let’s Encrypt 免费自签证书仅用于实验室验证 TLS 链路。2) 开启 443 SSL HTTP/2# /etc/nginx/conf.d/proxy_https.conf server { listen 443 ssl http2; server_name _; ssl_certificate /etc/nginx/ssl/blog.crt; ssl_certificate_key /etc/nginx/ssl/blog.key; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; add_header X-Upstream $upstream_addr always; location / { proxy_pass http://backend_rr; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # 告知后端原始是 https } }关键点listen 443 ssl http2;一条指令同时启用 TLS 与 HTTP/2nginx 1.25 还支持http2独立指令1.24 用 listen 参数写法即可。ssl_protocols TLSv1.2 TLSv1.3禁用不安全的 TLS 1.0/1.1。X-Forwarded-Proto $scheme后端据此知道原始请求是 HTTPS正确生成https://链接。3) 验证监听已起且响应头直接就是HTTP/2$ ss-ltn|grep:443LISTEN05110.0.0.0:4430.0.0.0:* $curl-k-s-Ihttps://127.0.0.1/|head-8HTTP/2200server: nginx/1.24.0(Ubuntu)date: Fri,24Jul202604:45:47 GMT content-type: text/plain x-backend: backend-8081 x-upstream:192.168.0.113:8081 $curl-k-s-o/dev/null-whttp_version%{http_version}\n--http2https://127.0.0.1/http_version2用openssl s_client显式协商h2确认 ALPN 真正生效$echo|openssl s_client-connect127.0.0.1:443-alpnh22/dev/null|grep-iEsubject|ALPN|issuersubjectCNnginx-blog-labissuerCNnginx-blog-lab ALPN protocol: h2ALPN protocol: h2说明客户端与 Nginx 在 TLS 握手阶段就协商出了 HTTP/2 协议。从公网访问同样正常$curl-k-s-o/dev/null-wcode%{http_code} version%{http_version}\nhttps://139.9.***.***/code200version1.1注示例里本地curlSchannel 后端公网探测回显为version1.1是因为该客户端实现未在握手时优先协商 h2而服务器侧的curl --http2与openssl -alpn h2均明确返回http/2/ALPN protocol: h2足以证明 HTTP/2 已生效。生产中以openssl s_client -alpn h2的 ALPN 结果为准。四、小结反向代理缓存proxy_cache_path共享内存索引 磁盘目录proxy_cacheproxy_cache_valid三件套即可生效用X-Cache-Status观测 MISS/HIT/BYPASSproxy_cache_lock防击穿proxy_ignore_headers可覆盖上游缓存策略。HTTPS/HTTP2自签证书或 CA 证书配listen 443 ssl http2ssl_protocols关掉旧协议X-Forwarded-Proto把「原始是 https」透给后端。验证用curl --http2看http_version2用openssl s_client -alpn h2看ALPN protocol: h2。两篇串联代理层 反向代理隐藏上游 负载均衡横向扩展 缓存减压提速 TLS/HTTP2安全与性能。四者叠加就是一套标准的「接入层 / 网关」雏形。附本实验部署的全部配置文件清单均已在真实服务器生效文件所在机器作用/etc/nginx/conf.d/backends.conf上游 192.168.0.1133 个后端 8081/8082/8083/etc/nginx/conf.d/proxy_upstreams.conf代理 192.168.0.1494 个 upstreamrr/weighted/ip_hash/least_conn均带zone/etc/nginx/conf.d/proxy_lb.conf代理:80 / :8091 / :8092 / :8093 负载均衡演示/etc/nginx/conf.d/proxy_cache.conf代理:8088 反向代理缓存/etc/nginx/conf.d/proxy_https.conf代理:443 ssl http2
