mkdkir -p ~/tmp/my-nginx/conf/conf.d
mkdkir -p ~/tmp/my-nginx/logs
mkdkir -p ~/tmp/my-nginx/html


docker pull nginx:1.11.8
docker run -d --name my-nginx nginx:1.11.8
docker cp my-nginx:/etc/nginx/nginx.conf ~/tmp/my-nginx/conf/nginx.conf
docker cp my-nginx:/etc/nginx/conf.d ~/tmp/my-nginx/conf/
docker cp my-nginx:/usr/share/nginx/html ~/tmp/my-nginx/
docker stop my-nginx
docker rm my-nginx

docker run \
    --name my-nginx \
    -d \
    -p 80:80 \
    -p 443:443 \
    -v /Users/zll:/Users/zll:ro \
    -v ~/tmp/my-nginx/conf/nginx.conf:/etc/nginx/nginx.conf:ro \
    -v ~/tmp/my-nginx/conf/conf.d:/etc/nginx/conf.d:ro \
    -v ~/tmp/my-nginx/html/:/usr/share/nginx/html:ro \
    -v ~/tmp/my-nginx/logs/:/etc/nginx/logs:rw \
    --link mq:mq \
    nginx:1.11.8
   

docker exec -it my-nginx bash

worker_processes      auto;
worker_rlimit_nofile  100000;

events {
    use                   epoll;
    worker_connections    2048;
    multi_accept          on;
}

http {
    server_tokens            off;
    sendfile                 on;
    tcp_nopush               on;
    tcp_nodelay              on;
    access_log               off;
    keepalive_timeout        30s;
    client_header_timeout    20s;
    client_body_timeout      20s;
    send_timeout             20s;
    reset_timedout_connection on;
    limit_conn_zone          $binary_remote_addr zone=addr:10m;
    limit_conn               addr 100;
    charset                  UTF-8;
    default_type             application/octet-stream;

    gzip                     on;
    gzip_disable             "msie6";
    # gzip_static            on;
    gzip_proxied             any;
    gzip_min_length          1000;
    gzip_comp_level          4;
    gzip_types  text/plain
                text/css
                text/js
                text/xml
                text/javascript
                application/javascript
                application/x-javascript
                application/json
                application/xml
                application/xml+rss;


    open_file_cache         max=10000 inactive=600s;
    open_file_cache_valid   30s;
    open_file_cache_min_uses 1;
    open_file_cache_errors  on;

    fastcgi_buffers          32      8k;
    client_body_buffer_size  1024k;
    client_max_body_size     10m;
}

# nginx 使用的ssl的版本是？
ldd /path/to/nginx | grep ssl
strings /lib64/libssl.so.10 | grep "^OpenSSL "

# nginx 使用的是静态链接还是动态链接？
/path/to/nginx -V

```bash
[root@locahost ~]# vi /etc/nginx/nginx.conf
      log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                             '$status $body_bytes_sent "$http_referer" '
                         '"$http_user_agent" "$http_x_forwarded_for" $upstream_addr';           # 追加 $upstream_addr 以方便追踪转给了哪一个后台服务。


``` ## 1.  为sso配置。该示例与[tomcat 虚拟主机](centos-tomcat)的配置相呼应

```bash
[root@locahost ~]# vi /etc/nginx/conf.d/sso.conf
```
内容示例如下：
```xml
upstream sso {
    server                          10.1.10.213:8080  weight=1 max_fails=1 fail_timeout=60s;
    server                          10.1.10.214:8080  weight=1 max_fails=1 fail_timeout=60s;
}

server {
    listen                          80;
    server_name                     ssolocal.eyar.com;
    access_log                      /data/outputs/log/nginx/sso.access.log     main;
    error_log                       /data/outputs/log/nginx/sso.error.log      notice;

    location /admin {
        proxy_next_upstream         http_500 http_502 http_503 http_504 timeout error invalid_header;
        proxy_pass                  http://sso;
        proxy_set_header            Host ssolocal.eyar.com;           #如果tomcat使用虚拟主机的话，则需要加上该行。
    }

    location / {
        proxy_next_upstream         http_500 http_502 http_503 http_504 timeout error invalid_header;
        proxy_pass                  http://sso;
        proxy_set_header            Host ssolocal.eyar.com;
    }

}
```

server{
    listen *:80;
    listen *:443 ssl;

    server_name kingsilk.net;
    ssl_certificate     conf.d/kingsilk.net_213467004770525.pem;
    ssl_certificate_key conf.d/kingsilk.net_213467004770525.key;

location ~ ^/api(.*)$ {
    proxy_pass                  http://wap-zll$1;
}

server {
  listen *:80;
  server_name wiki.kingsilk.xyz;
  rewrite ^(.*)$  http://git.kingsilk.xyz$1 permanent;
}

server {
  location = / {
    add_header Cache-Control no-cache;
    return 302 $scheme://kingsilk.net/qh/mall/;
  }
}

# 最后追加以下配置
stream {
    include /etc/nginx/conf.d/*.conf.stream;
}

upstream mqtt_1883 {
    server mq:1883;
}
upstream mqtts_8883 {
    server mq:8883;
}

# 完全 tcp 转发
server {
    listen 11883;
    proxy_connect_timeout       20s;
    proxy_timeout               5m;
    proxy_pass                  mqtt_1883;
}
server {
    listen 18883;
    proxy_connect_timeout       20s;
    proxy_timeout               5m;
    proxy_pass                  mqtts_8883;
}

# 代为TSL
server {
    listen 19883 ssl;
    ssl_certificate             conf.d/mq/server.pem.cer;
    ssl_certificate_key         conf.d/mq/server.pem.key;
    ssl_session_cache           shared:SSL:10m;
    ssl_session_timeout         10m;
    #ssl_ciphers                HIGH:!aNULL:!MD5;
    #ssl_prefer_server_ciphers  on;
    proxy_connect_timeout       20s;
    proxy_timeout               5m;
    proxy_pass                  mqtt_1883;
}