Nginx防盗链与服务优化配置分析

一、Nginx防盗链配置

防盗链(Referer)是防止其他网站直接链接你的资源(如图片、视频等)的有效方法，以下是几种常见的配置方式：

1. 基础防盗链配置

server {
    listen 80;
    server_name example.com;

    location ~* \.(jpg|jpeg|png|gif|mp4|flv)$ {
        valid_referers none blocked example.com *.example.com;

        if ($invalid_referer) {
            return 403;
            # 或者可以重定向到警告图片
            # rewrite ^ /anti-hotlinking.jpg;
        }
    }
}

2. 使用签名防盗链（更安全的方式）

location /protected/ {
    # 检查签名参数
    secure_link $arg_md5,$arg_expires;
    secure_link_md5 "$secure_link_expires$uri$remote_addr secret";

    if ($secure_link = "") {
        return 403;
    }

    if ($secure_link = "0") {
        return 410;
    }
}

3. 结合地理位置限制

location /media/ {
    valid_referers none blocked example.com *.example.com;

    # 允许特定国家访问
    geoip_country /usr/share/GeoIP/GeoIP.dat;
    if ($invalid_referer) {
        if ($geoip_country_code != CN) {
            return 403;
        }
    }
}

二、Nginx服务优化配置

1. 性能优化配置

# 工作进程与连接数
worker_processes auto; # 自动根据CPU核心数设置
worker_rlimit_nofile 100000; # 每个worker能打开的文件描述符数量

events {
    worker_connections 4096; # 每个worker最大连接数
    multi_accept on; # 一次接受所有新连接
    use epoll; # Linux高性能事件模型
}

http {
    # 基础优化
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 1000;

    # 关闭不必要的信息
    server_tokens off;

    # MIME类型缓存
    include mime.types;
    default_type application/octet-stream;

    # 日志优化
    access_log off; # 生产环境可关闭或限制
    # 或使用缓冲日志
    # access_log /var/log/nginx/access.log main buffer=32k flush=1m;

    # 文件传输优化
    client_max_body_size 10m;
    client_body_buffer_size 128k;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 4k;

    # 超时设置
    client_body_timeout 12;
    client_header_timeout 12;
    send_timeout 10;

    # Gzip压缩
    gzip on;
    gzip_min_length 1024;
    gzip_proxied expired no-cache no-store private auth;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_comp_level 6;
    gzip_buffers 16 8k;

    # 静态文件缓存
    open_file_cache max=100000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;
}

2. 安全优化配置

server {
    # 禁用不安全的HTTP方法
    if ($request_method !~ ^(GET|HEAD|POST)$ ) {
        return 405;
    }

    # 防止点击劫持
    add_header X-Frame-Options "SAMEORIGIN";

    # XSS保护
    add_header X-XSS-Protection "1; mode=block";

    # 禁用内容类型嗅探
    add_header X-Content-Type-Options "nosniff";

    # CSP策略
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.trusted.com; img-src 'self' data: *.trusted.com;";

    # 安全传输策略
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # 防止MIME类型混淆攻击
    types {
        text/html html htm shtml;
        text/css css;
        # 其他类型...
    }
}

3. SSL/TLS优化配置

server {
    listen 443 ssl http2;

    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;

    # 协议与加密套件优化
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';

    # 会话缓存优化
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;

    # OCSP装订
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # DH参数
    ssl_dhparam /path/to/dhparam.pem;

    # HSTS预加载
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
}

三、实际应用示例

1. 图片服务器优化配置

server {
    listen 80;
    server_name img.example.com;

    # 防盗链
    location ~* \.(jpg|jpeg|png|gif|webp)$ {
        valid_referers none blocked example.com *.example.com;

        if ($invalid_referer) {
            return 403;
        }

        # 缓存优化
        expires 30d;
        add_header Cache-Control "public, no-transform";

        # WebP自动适配
        if ($http_accept ~* "webp") {
            rewrite ^(.*)\.(jpg|jpeg|png)$ $1.webp break;
        }
    }

    # WebP图片服务
    location ~* \.webp$ {
        try_files $uri $uri/ =404;
        expires 30d;
        add_header Vary Accept;
    }

    # 访问限制
    location / {
        limit_req zone=img_limit burst=20 nodelay;
        limit_conn img_conn 10;
    }
}

2. 视频流媒体服务器配置

server {
    listen 80;
    server_name video.example.com;

    # HLS流媒体配置
    location /hls/ {
        types {
            application/vnd.apple.mpegurl m3u8;
            video/mp2t ts;
        }
        root /var/media;
        add_header Cache-Control no-cache;

        # 防盗链
        secure_link $arg_token,$arg_expires;
        secure_link_md5 "$secure_link_expires$uri$remote_addr secret_key";

        if ($secure_link = "") {
            return 403;
        }

        if ($secure_link = "0") {
            return 410;
        }
    }

    # MP4视频文件
    location ~* \.mp4$ {
        mp4;
        mp4_buffer_size 1m;
        mp4_max_buffer_size 5m;

        # 防盗链
        valid_referers none blocked example.com *.example.com;
        if ($invalid_referer) {
            return 403;
        }
    }
}

四、监控与维护建议

1. 日志分析：使用GoAccess、ELK等工具分析访问日志
2. 性能监控：配置Nginx status模块或使用Prometheus+Grafana监控
3. 定期审计：检查配置安全性和性能瓶颈
4. 自动化部署：使用Ansible、Chef等工具管理配置
5. CDN集成：考虑将静态资源部署到CDN，减轻服务器负载

以上配置可根据实际业务需求进行调整，建议在测试环境验证后再应用到生产环境。