CentOS 7环境下使用Nginx托管.Net Core应用程序

sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc
sudo sh -c 'echo -e"[packages-microsoft-com-prod]\nname=packages-microsoft-com-prod \nbaseurl=https://packages.microsoft.com/yumrepos/microsoft-rhel7.3-prod\nenabled=1\ngpgcheck=1\ngpgkey=https://packages.microsoft.com/keys/microsoft.asc"> /etc/yum.repos.d/dotnetdev.repo'

sudo yum update
sudo yum install libunwind libicu
sudo yum install dotnet-sdk-2.0.0

dotnet --info

sudo mkdir -p /opt/dotnet && sudo tar zxf dotnet.tar.gz -C /opt/dotnet
# 可以设置一下环境变量，也可以采用下面的方式建立软链接，因为 /usr/local/bin 默认包含于 $PATH 中
sudo ln -s /opt/dotnet/dotnet /usr/local/bin
# 之后运行查看安装结果
dotnet --info

dotnet new mvc -o ntmvc

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
// 添加引用
using Microsoft.AspNetCore.HttpOverrides;

namespace ntmvc
{public class Startup
    {public Startup(IConfiguration configuration)
        {Configuration = configuration;
        }

        public IConfiguration Configuration {get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {services.AddMvc();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {if (env.IsDevelopment())
            {app.UseDeveloperExceptionPage();
            }
            else
            {app.UseExceptionHandler("/Home/Error");
            }

            app.UseStaticFiles();

            app.UseMvc(routes =>
            {
                routes.MapRoute(name: "default",
                    template: "{controller=Home}/{action=Index}/{id?}");
            });
            
            // 添加下面的代码
            app.UseForwardedHeaders(new ForwardedHeadersOptions
            {ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
            });

            app.UseAuthentication();
        }
    }
}

dotnet publish -c Release

dotnet nmvc.dll

vim /etc/systemd/system/kestrel-ntmvc.service

[Unit]
Description=Example .NET Web MVC Application running on Centos7

[Service]
WorkingDirectory=/root/ntmvc
ExecStart=/usr/bin/dotnet /root/ntmvc/bin/Release/netcoreapp2.0/publish/ntmvc.dll
Restart=always
RestartSec=10  # Restart service after 10 seconds if dotnet service crashes
SyslogIdentifier=dotnet-example
User=root
Environment=ASPNETCORE_ENVIRONMENT=Production 

[Install]
WantedBy=multi-user.target

systemctl enable kestrel-ntmvc.service 
systemctl start kestrel-ntmvc.service 
systemctl status kestrel-ntmvc.service

systemctl daemon-reload
systemctl restart kestrel-ntmvc.service

yum -y install gcc gcc-c++ pcre pcre-devel openssl openssl-devel zlib zlib-devel

wget http://nginx.org/download/nginx-1.13.5.tar.gz

mkdir nginxfiles
tar -zxvf nginx-1.13.5.tar.gz -C nginxfiles

cd nginxfiles/
cd nginx-1.13.5/

# 配置：这里需要安装额外的模块
./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-stream --with-mail=dynamic

# 编译
make
# 安装
make install

ln -s /usr/local/nginx/sbin/nginx /usr/local/bin

# 建立服务器私钥（过程需要输入密码，请记住这个密码）生成 RSA 密钥
openssl genrsa -des3 -out testcert.key 1024  

# 生成一个证书请求  需要依次输入国家，地区，组织，email，common name 等，common name 可以写你的名字或者域名。如果为了 https 申请，必须和域名吻合，否则会引发浏览器警报。openssl req -new -key testcert.key -out testcert.csr

# 生成不需要密码的 key
openssl rsa -in testcert.key -out testcert_nopwd.key  

# 生成 crt 文件
openssl x509 -req -days 365 -in testcert.csr -signkey testcert_nopwd.key -out testcert.crt

cp testcert.crt /etc/ssl/certs/
 cp testcert_nopwd.key /etc/ssl/certs/testcert.key

openssl dhparam -out dhparam.pem 4096

proxy_redirect             off;
proxy_set_header         Host             $host;
proxy_set_header        X-Real-IP         $remote_addr;
proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
proxy_set_header    X-Forwarded-Proto $scheme;
client_max_body_size     10m;
client_body_buffer_size 128k;
proxy_connect_timeout     90;
proxy_send_timeout         90;
proxy_read_timeout         90;
proxy_buffers            32 4k;

worker_processes  1;

events {worker_connections  1024;
}

http {include       proxy.conf;
    include       mime.types;
    default_type  application/octet-stream;  

    limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;
    server_tokens off;

    sendfile        on;
    #tcp_nopush     on;
    
    keepalive_timeout  29;
    client_body_timeout 10; 
    client_header_timeout 10; 
    send_timeout 10;   

    upstream ntmvc{server localhost:5000;
    }


    server {listen       80;
        add_header Strict-Transport-Security max-age=15768000;
        return 301 https://$host$request_uri;
    }  


    # HTTPS server
    #
    server {listen *:443    ssl;
        server_name     localhost;
        ssl_certificate /etc/ssl/certs/testcert.crt;
        ssl_certificate_key /etc/ssl/certs/testcert.key;
        ssl_protocols TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_ecdh_curve secp384r1;
        ssl_session_cache shared:SSL:10m;
        ssl_session_tickets off;
        ssl_stapling on; #ensure your cert is capable
        ssl_stapling_verify on; #ensure your cert is capable

        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;

        #Redirects all traffic
        location / {proxy_pass  http://ntmvc;
            limit_req   zone=one burst=10 nodelay;
            limit_req_status 503;
        }
    }


} 

# 设置 nginx 自启动，在 /lib/systemd/system/ 目录下创建一个服务文件
vim /lib/systemd/system/nginx.service

[Unit]
Description=nginx - high performance web server
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/usr/local/nginx/sbin/nginx -s stop

[Install]
WantedBy=multi-user.target

systemctl enable nginx.service
# 启动 nginx 服务
systemctl start nginx.service
# 查看状态
systemctl status nginx.service

# 如果修改了文件，这个是必须的
systemctl daemon-reload
# 重新启动服务
systemctl restart nginx.service

# 端口
firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=5000/tcp --permanent
firewall-cmd --zone=public --add-port=443/tcp --permanent
#开端口后必须重新加载
firewall-cmd --reload
# 查看所有打开的端口：firewall-cmd  --list-ports