银河麒麟(Kylin)离线安装Nginx并部署多服务完整步骤_Redis

本文介绍如何在 银河麒麟操作系统（kylin v10）上进行 nginx 的离线安装与配置，包括依赖包下载、https 配置、多端口站点部署等完整步骤。

1. 准备环境

由于是离线安装，需要提前下载 nginx 及其依赖的 rpm 包。

银河麒麟官方镜像地址示例：https://update.cs2c.com.cn/ns/v10/v10sp3/os/adv/lic/updates/x86_64/packages/

其中 v10、v10sp3、x86_64 根据你的系统版本和 cpu 架构调整。

需要下载以下 rpm 包（注意版本匹配）：

gperftools-libs-.......rpm
nghttp2-.......rpm
nginx-.......rpm
nginx-all-modules-.......rpm
nginx-filesystem-.......rpm
openssl-.......rpm
openssl-libs-.......rpm
pcre2-.......rpm
zlib-.......rpm

2. 安装 nginx 及依赖

将下载好的 rpm 包放到 /tmp/nginx_rpm/ 目录：

cd /tmp/nginx_rpm/
rpm -ivh *.rpm --force --nodeps

3. 生成 ssl 证书

创建证书目录：

mkdir -p /etc/nginx/ssl
cd /etc/nginx/ssl

生成自签名证书（有效期 365 天）：

openssl req -newkey rsa:2048 -nodes -keyout test.key \
    -x509 -days 365 -out test.crt \
    -subj "/c=cn/st=beijing/l=beijing/o=test/ou=it/cn=localhost"

4. 创建测试站点目录

mkdir -p /var/www/test-web
mkdir -p /var/www/test-app
echo "web index" > /var/www/test-web/index.html
echo "app index" > /var/www/test-app/index.html

5. 配置 nginx

编辑 /etc/nginx/nginx.conf（替换原内容）：

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    # gzip 压缩
    gzip on;
    gzip_min_length 1k;
    gzip_comp_level 6;
    gzip_types text/plain text/css application/json application/javascript application/xml;
    gzip_vary on;

    sendfile        on;
    keepalive_timeout  65;

    include /etc/nginx/conf.d/*.conf;
}

6. 新建多站点配置文件

新建 /etc/nginx/conf.d/project.conf：

# web http → https
server {
    listen 80;
    server_name localhost;
    return 301 https://$server_name$request_uri;
}

# web https
server {
    listen 443 ssl http2;
    server_name localhost;

    client_max_body_size 1024m;

    ssl_certificate     /etc/nginx/ssl/test.crt;
    ssl_certificate_key /etc/nginx/ssl/test.key;
    ssl_protocols       tlsv1.2 tlsv1.3;
    ssl_ciphers         high:!anull:!md5;

    location / {
        root /var/www/test-web;
        index index.html;
        try_files $uri $uri/ /index.html;
    }

    location /test/ {
        proxy_pass http://192.168.2.67:9652;
        proxy_http_version 1.1;
        proxy_set_header connection "";
        proxy_set_header host $host;
        proxy_set_header x-real-ip $remote_addr;
    }
}

# app http → https
server {
    listen 3000;
    server_name localhost;
    return 301 https://$server_name:3001$request_uri;
}

# app https
server {
    listen 3001 ssl http2;
    server_name localhost;

    client_max_body_size 1024m;

    ssl_certificate     /etc/nginx/ssl/test.crt;
    ssl_certificate_key /etc/nginx/ssl/test.key;
    ssl_protocols       tlsv1.2 tlsv1.3;
    ssl_ciphers         high:!anull:!md5;

    location / {
        root /var/www/test-app;
        index index.html;
        try_files $uri $uri/ /index.html;
    }

    location /test/ {
        proxy_pass http://192.168.2.67:9652;
        proxy_http_version 1.1;
        proxy_set_header connection "";
        proxy_set_header host $host;
        proxy_set_header x-real-ip $remote_addr;
    }
}

测试配置文件：nginx -t

7. 注册服务并启动 nginx

创建服务文件：
vim /etc/systemd/system/nginx.service
写入以下内容：

[unit]
description=the nginx http and reverse proxy server
after=network.target remote-fs.target nss-lookup.target

[service]
type=forking
pidfile=/run/nginx.pid
# nginx will fail to start if /run/nginx.pid already exists but has the wrong
# selinux context. this might happen when running `nginx -t` from the cmdline.
execstartpre=/usr/bin/rm -f /run/nginx.pid
execstartpre=/usr/sbin/nginx -t
execstart=/usr/sbin/nginx
execreload=/bin/kill -s hup $mainpid
killsignal=sigquit
timeoutstopsec=5
killmode=mixed
privatetmp=true

[install]
wantedby=multi-user.target

设置开机启动并启动 nginx：

systemctl enable nginx
systemctl start nginx
systemctl status nginx

8. 开放防火墙端口

sudo firewall-cmd --add-port=80/tcp --permanent
sudo firewall-cmd --add-port=443/tcp --permanent
sudo firewall-cmd --add-port=3000/tcp --permanent
sudo firewall-cmd --add-port=3001/tcp --permanent
sudo firewall-cmd --reload