Nginx 反向代理配置详解与性能优化实践 前言Nginx 作为高性能 HTTP 服务器和反向代理，在生产环境中应用极为广泛。本文将系统讲解 Nginx 反向代理的核心配置，并分享实际项目中的性能优化经验。一、反向代理基础配置1.1 基本反向代理server { listen 80; server_name example.com; location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } }1.2 负载均衡配置upstream backend { server 192.168.1.10:3000 weight=3; server 192.168.1.11:3000 weight=2; server 192.168.1.12:3000 weight=1; keepalive 32; } server { listen 80; location / { proxy_pass http://backend; proxy_http_version 1.1; proxy_set_header Connection ""; } }二、性能优化要点2.1 Worker 进程配置worker_processes auto; worker_cpu_affinity auto; events { worker_connections 10240; use epoll; multi_accept on; }2.2 Gzip 压缩gzip on; gzip_min_length 1k; gzip_comp_level 6; gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript image/svg+xml; gzip_vary on; gzip_proxied any;2.3 静态文件缓存location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2)$ { expires 30d; add_header Cache-Control "public, immutable"; access_log off; }三、SSL/TLS 配置server { listen 443 ssl http2; server_name example.com; ssl_certificate /etc/nginx/ssl/fullchain.pem; ssl_certificate_key /etc/nginx/ssl/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; ssl_session_timeout 1d; add_header Strict-Transport-Security "max-age=63072000" always; }四、常见问题排查4.1 502 Bad Gateway通常原因：后端服务未启动、端口不通、网络问题。# 检查后端服务 curl -I http://127.0.0.1:3000 # 查看错误日志 tail -f /var/log/nginx/error.log # 检查端口 ss -tlnp | grep 30004.2 504 Gateway Timeout后端响应超时，适当调大 proxy_read_timeout。五、总结Nginx 反向代理配置看似简单，但要在生产环境中跑出最佳性能，需要在 worker 模型、连接复用、压缩缓存、SSL 优化等多个维度精细调优。建议每次修改配置后用 nginx -t 检查语法，逐步调整观察效果。