第17章 附录

setting 常用设置

官方地址： https://docs.djangoproject.com/zh-hans/2.0/ref/settings/

DATABASES

默认值： 空字典 {}，包含要与django一起使用的所有数据库的设置的字典。是一个嵌套字段，其内容将数据库别名映射到包含单个数据选项的字典。

该DATABAES必须设置default数据库，还可以指定任意数量的其他附加的数据库

  1. # sqlite3
  2. DATABASES = {
  3.     'default': {
  4.         'ENGINE': 'django.db.backends.sqlite3',
  5.         'NAME': 'mydatabase',
  6.     }
  7. }
  10. # postgresql
  11. DATABASES = {
  12.     'default': {
  13.         'ENGINE': 'django.db.backends.postgresql',
  14.         'NAME': 'mydatabase',
  15.         'USER': 'mydatabaseuser',
  16.         'PASSWORD': 'mypassword',
  17.         'HOST': '127.0.0.1',
  18.         'PORT': '5432',
  19.     }
  20. }

可以使用以下内部选项来进行更复杂的配置：

TIME_ZONE

默认 None，表示存储在此数据库中的日期时间的字符串（假设它不支持时区）或者None。该DATABASES设置的内部选项接受与掌握TIME_ZONE设置相同的值

TEST

默认值： 空字典，测试数据库的设置字典；有关测试数据库的创建和使用的更多详细信息，请参阅测试数据库

APPEND_SLASH

默认 True， 如果请求URL与URLconf中的任何模式都不匹配，并且它不心斜杠结尾，则 django 会向相同的URL发出HTTP重定向，并附加斜杠。请注意，重定向可能导致POST请求中提交的任何数据丢失。

APPEND_SLASH设置项由中间件 CommonMiddleware 提供支持。

nginx设置

官方地址：https://nginx.org/en/docs/dirindex.html

Syntax: uwsgi_pass [protocol://]address;
Default: —
Context: location
, if in location

设置uwsgi服务器的协议和地址。地址支持域名或者IP以及端口号，当然也可以使用UNIX套接字路径 uwsgi_pass unix:/tmp/uwsgi.socket;

如果域名解析为多个地址，则所有这些地址将以循环方式使用。此外，可以将地址指定为 服务器组 server group。

  1. upstream backend {    # backend 上游服务器组名字
  2.     server backend1.example.com       weight=5;
  3.     server backend2.example.com:8080;
  4.     server unix:/tmp/backend3;
  6.     server backup1.example.com:8080   backup;
  7.     server backup2.example.com:8080   backup;
  8. }
  10. server {
  11.     location / {
  12.         proxy_pass http://backend;
  13.     }
  14. }

location语法

  1. location [=|~|~*|^~] pattern {
  2. }
  3. # = 精确匹配
  4. # ^~ 以某个常规字符串开头，不是正则匹配
  5. # ~  区分大小写的正则匹配
  6. # ~* 不区分大小写的正则匹配
  7. # /  通用匹配，匹配所有

规则解释：

  1. location = 精确匹配 > location 完整路径 > location ^~ 路径 > location ~,~* 正则顺序 > location 部分起始路径 > location /
  3. # location ^~ 路径         # 以某个字符串开头，不是正则匹配
  6. location = / {
  7.     proxy_pass http://tomcat:8080/index   
  8.     }
  10. location ^~ /static/ {
  11.     root /webroot/static/;   
  12.     }
  14. location / {
  15.     proxy_pass http://tomcat:8080/;   
  16.     }

location配置优先级

  • 普通匹配与顺序无关，因为按照匹配的长短来取匹配结果。
  • 正则匹配与顺序有关，因为是从上往下匹配。(首先匹配，取其之。结束解析过程)

nginx conf 配置参考

  1. http重定向到https

  1. # the upstream component nginx needs to connect to
  2. upstream django {
  3.     #server unix:///tmp/uwsgi.sock;
  4.     #server unix:/tmp/uwsgi.sock;
  5. #server 192.168.0.152:8080; # for a web port socket (we'll use this first)
  6.     server 127.0.0.1:8080; # for a web port socket (we'll use this first)
  7. }
  9. # http site conf
  10. server {
  11.     listen 80;
  12.       server_name 192.168.0.152;
  13.     charset     utf-8;
  15.     # max upload size
  16.     client_max_body_size 75M;   # adjust to taste
  18.     # Django media
  19.     location /media  {
  20.         alias /srv/WEME_BE/weme/media/; 
  21.     }
  23.     location /static {
  24.         alias /srv/WEME_BE/weme/static/; 
  25.     }
  27.     location /xadmin {
  28.        proxy_pass http://127.0.0.1:8080/xadmin;
  29.     }
  31.     location /api/v1 {
  32.        proxy_pass http://127.0.0.1:8080;
  33.     }
  35.     location / {
  36.          if ($request_method = 'OPTIONS') {
  37.             add_header 'Access-Control-Allow-Origin' '*';
  38.             add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
  39.             add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
  40.             add_header 'Access-Control-Max-Age' 1728000;
  41.             add_header 'Content-Type' 'text/plain; charset=utf-8';
  42.             add_header 'Content-Length' 0;
  43.             return 204;
  44.          }
  45.         root /srv/weme_http/;
  46.         index index.html index.htm;
  47.     }
  48. }
  50. # configuration of the server
  51. # https site conf
  52. server {
  53.     # the port your site will be served on
  54.     listen 443 ssl;
  55.     server_name 192.168.0.152; # substitute your machine's IP address or FQDN
  56.     charset     utf-8;
  58.     ssl on;
  59.     ssl_certificate /etc/nginx/ssl/192.168.0.152.crt;
  60.     ssl_certificate_key /etc/nginx/ssl/192.168.0.152.key;
  62.     proxy_request_buffering off;
  63.     proxy_buffering off;
  64.     proxy_connect_timeout 75s;
  65.     proxy_read_timeout 300s;
  67.     # max upload size
  68.     client_max_body_size 75M;   # adjust to taste
  70.     # Django media
  71.     location /media  {
  72.         alias /srv/WEME_BE/weme/media/;  # your Django project's media files - amend as required
  73.     }
  75.     location /static {
  76.         alias /srv/WEME_BE/weme/static/; # your Django project's static files - amend as required
  77.     }
  79.     location /xadmin {
  80.        proxy_pass http://127.0.0.1:8080/xadmin; 
  81.     }
  83.     location /api/v1 {
  84.        proxy_pass http://127.0.0.1:8080; 
  85.     }
  87.     location / {
  88.          if ($request_method = 'OPTIONS') {
  89.             add_header 'Access-Control-Allow-Origin' '*';
  90.             add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
  91.             add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
  92.             add_header 'Access-Control-Max-Age' 1728000;
  93.             add_header 'Content-Type' 'text/plain; charset=utf-8';
  94.             add_header 'Content-Length' 0;
  95.             return 204;
  96.          }
  97.         root /srv/weme/;
  98.         index index.html index.htm;
  99.     }
  100. }

需要根据站点配置做相应修改

  1. # /etc/nginx/conf.d/mysite_nginx.conf
  3. # the upstream component nginx needs to connect to
  4. upstream django {
  5.     # server unix:///path/to/your/mysite/mysite.sock; # for a file socket
  6.     server 127.0.0.1:8001; # for a web port socket (we'll use this first)
  7. }
  9. # configuration of the server
  10. server {
  11.     # the port your site will be served on
  12.     listen      80;
  13.     # the domain name it will serve for
  14.     server_name .example.com; # substitute your machine's IP address or FQDN
  15.     charset     utf-8;
  17.     # max upload size
  18.     client_max_body_size 75M;   # adjust to taste
  20.     # Django media
  21.     location /media  {
  22.         alias /path/to/your/mysite/media;  # your Django project's media files - amend as required
  23.     }
  25.     location /static {
  26.         alias /path/to/your/mysite/static_dist; # your Django project's static files - amend as required
  27.     }
  29.     # Finally, send all non-media requests to the Django server.
  30.     location / {
  31.         uwsgi_pass  django;    # go to [upstream django]
  32.         include     /etc/nginx/uwsgi_params; # the uwsgi_params file you installed
  33.     }
  34. }

项目实例1 - uwsgi

  1. upstream django {
  2.     server 127.0.0.1:3031;
  3. }
  5. server {
  6.     listen      80;
  7.     #server_name .example.com;
  8.     server_name 192.168.0.130;
  9.     client_max_body_size 75M;
  10.     charset utf-8;
  12.     #access_log /var/log/nginx/ebee_access.log;
  13.     error_log /var/log/nginx/ebee_error.log;
  15.     location /media  {
  16.         alias /var/www/ebee/static/media/;
  17.     }
  19.     location /static {
  20.         alias /var/www/ebee/static/;
  21.     }
  23.     # Finally, send all non-media requests to the Django server.
  24.     location / {
  25.         uwsgi_pass django;
  26.     #include /var/www/ebee/ebee/uwsgi_params;
  27.     include /etc/nginx/uwsgi_params;
  28.     }
  29. }

错误信息很好理解，就是说 Access-Control-Allow-Origin 有两个值，但是浏览器只准许有一个值，所以报错。

增强nginx性能方法


优化代码逻辑的极限是移除所有逻辑；


优化请求的极限是不发送任何请求。

这两点通过缓存都可以实现。

项目实例

  1. # vim /etc/nginx/nginx.conf
  2. user www-data;
  3. worker_processes auto;
  4. pid /run/nginx.pid;
  6. events {
  7.     worker_connections 768;
  8.     # multi_accept on;
  9. }
  11. http {
  13.       # Basic Settings
  14.       # sendfile 提高 Nginx 静态资源托管效率。sendfile 是一个系统调用，直接在内核空间完成文件发送，不需要先 read 再 write，没有上下文切换开销。
  15.       sendfile on;
  16.       # socket选项，只有在启用了 sendfile 之后才生效；启用它之后，数据包会累计到一定大小之后才会发送，减小了额外开销，提高网络效率。
  17.       tcp_nopush on;
  18.       tcp_nodelay on;    # socket选项，启用后禁用 Nagle 算法
  19.       keepalive_timeout 65;
  20.       types_hash_max_size 2048;
  21.       server_tokens off;
  23.       # server_names_hash_bucket_size 64;
  24.       # server_name_in_redirect off;
  26.       include /etc/nginx/mime.types;
  27.       default_type application/octet-stream;
  29.       # SSL Settings
  30.       ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
  31.       ssl_prefer_server_ciphers on;
  32.       ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GC$
  34.       # gzip settings
  35.       gzip on;
  36.       # gizp_disable 接受一个正则表达式，当请求头中的UserAgent满足这个正则时，响应不会启用gzip
  37.       # 特别地，指令值 msie6 等价于 MSIE [4-6]\.，但性能更好一些。
  38.       gzip_disable "msie6";        
  39.       gzip_vary on;        # 输出Vary响应头，用来解决某些缓存服务的一个问题
  40.       gzip_proxied any;
  41.       gzip_comp_level 2;
  42.       gzip_buffers 32 16k;
  43.       # 默认 Nginx 只会针对 HTTP/1.1 及以上的请求才会启用 GZip，因为部分早期的 HTTP/1.0 客户端在处理 GZip 时有 Bug。现在基本上可以忽略这种情况，于是可以指定 gzip_http_version 1.0 来针对 HTTP/1.0 及以上的请求开启 GZip。
  44.       gzip_http_version 1.0;
  45.       gzip_min_length 250;
  46.       gzip_types image/jpeg image/bmp image/svg+xml text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript image/x-icon;
  48.       # brotli settings
  49.       # brotli google开发的编码算法，比gzip高效20%；最适合静态文件
  50.       brotli on;
  51.       brotli_comp_level 4;
  52.       brotli_buffers 32 8k;
  53.       brotli_min_length 100;
  54.       brotli_static on;
  55.       brotli_types image/jpeg image/bmp image/svg+xml text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript image/x-icon;
  57.       # Optimize session cache
  58.       ssl_session_cache shared:SSL:50m;
  59.       ssl_session_timeout 1d;
  61.       # Enable session tickets
  62.       ssl_session_tickets on;
  64.       # OCSP Stapling
  65.       ssl_stapling on;
  66.       ssl_stapling_verify on;
  67.       resolver 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
  68.       resolver_timeout 2s;
  70.       # security headers
  71.       # for HTTP Strict Transport Security HSTS
  72.       # 防止 downgrade attacks https://en.wikipedia.org/wiki/Downgrade_attack
  73.       add_header X-Frame-Options "SAMEORIGIN" always;
  74.       add_header X-XSS-Protection "1; mode=block" always;
  75.       add_header X-Content-Type-Options "nosniff" always;
  76.       add_header Referrer-Policy "no-referrer-when-downgrade" always;
  77.       add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
  78.       add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
  79.       add_header X-Cache-Status $upstream_cache_status;
  81.       # Logging Settings
  82.       access_log /var/log/nginx/access.log;
  83.       error_log /var/log/nginx/error.log;
  85.       # limits
  86.       limit_req_log_level warn;
  87.       limit_req_zone $binary_remote_addr zone=reqlimit:10m rate=10r/m;
  88.       limit_conn_zone $binary_remote_addr zone=connlimit:100m;
  89.       limit_conn servers 1000; # Simultaneous Connections
  91.       include /etc/nginx/conf.d/*.conf;
  92.       include /etc/nginx/sites-enabled/*;
  93. }

针对域名配置

  1. proxy_cache_path /tmp/cacheapi levels=1:2 keys_zone=microcacheapi:100m max_size=1g inactive=1d use_temp_path=off;
  2. server {
  3.     listen 443 ssl http2 default_server;
  4.     listen [::]:443 ssl http2 default_server;
  5.     server_name example.com;
  7.     location /api/ {
  8.         # Rate Limiting
  9.         limit_req zone=reqlimit burst=20; # Max burst of request
  10.         limit_req_status 460; # Status to send
  11.         # Connections Limiting
  12.         limit_conn connlimit 20; # Number ofdownloads per IP        
  14.         # Bandwidth Limiting
  15.         limit_rate 4096k; # Speed limit (here is on kb/s)
  17.         # Micro caching
  18.         proxy_cache microcacheapi;
  19.         proxy_cache_valid 200 1s;
  20.         proxy_cache_use_stale updating;
  21.         proxy_cache_background_update on;
  22.         proxy_cache_lock on;
  24.         proxy_pass http://localhost:8080;
  25.         proxy_set_header X-Real-IP $remote_addr;
  26.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  27.         proxy_set_header Host $http_host;
  28.         proxy_set_header X-NginX-Proxy true;
  30.     }
  31.     location / {
  32.         proxy_pass http://localhost:3000;
  33.         proxy_set_header Host $host;
  34.         proxy_set_header X-Real-IP $remote_addr;
  35.     }
  37.     location ~* \.(jpg|jpeg|png|gif|ico)$ {        # client-side Caching
  38.        expires 30d;
  39.     }
  40.     location ~* \.(css|js)$ {        # client-side Caching
  41.        expires 7d;
  42.     }
  44.     ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
  45.     ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
  47.     # Pagespeed Module
  48.     pagespeed on;
  49.     pagespeed FileCachePath /var/cache/ngx_pagespeed_cache;
  50.     location ~ "\.pagespeed\.([a-z]\.)?[a-z]{2}\.[^.]{10}\.[^.]+" {
  51.     add_header "" "";
  52.     }
  53.     location ~ "^/pagespeed_static/" { }
  54.     location ~ "^/ngx_pagespeed_beacon$" { }
  55.     pagespeed RewriteLevel PassThrough;
  56.     pagespeed EnableCachePurge on;
  57.     pagespeed PurgeMethod PURGE;
  58.     pagespeed EnableFilters prioritize_critical_css;
  59. }
  60. server {
  61.     listen 80;
  62.     listen [::]:80;
  63.     server_name example.com;
  64.     return 301 https://$server_name$request_uri;
  65. }
  66. server {
  67.     listen [::]:80;
  68.     listen [::]:443  ssl;
  69.     server_name www.example.com;
  70.     return 301 https://example.com$request_uri;
  71.     ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
  72.     ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
  73. }

参考文章：

https://imququ.com/post/my-nginx-conf-for-wpo.html

https://medium.freecodecamp.org/powerful-ways-to-supercharge-your-nginx-server-and-improve-its-performance-a8afdbfde64d

http https

index 刷新方法

  1. $ curl baidu.com -vv 
  2.     * Rebuilt URL to: baidu.com/
  3.     *   Trying 220.181.57.217...
  4.     * TCP_NODELAY set
  5.     * Connected to baidu.com (220.181.57.217) port 80 (#0)
  6.         > GET / HTTP/1.1
  7.         > Host: baidu.com
  8.         > User-Agent: curl/7.51.0
  9.         > Accept: */*
  10.         > 
  11.         < HTTP/1.1 200 OK
  12.         < Date: Sat, 01 Apr 2017 06:32:35 GMT
  13.         < Server: Apache
  14.         < Last-Modified: Tue, 12 Jan 2010 13:48:00 GMT
  15.         < ETag: "51-47cf7e6ee8400"
  16.         < Accept-Ranges: bytes
  17.         < Content-Length: 81
  18.         < Cache-Control: max-age=86400
  19.         < Expires: Sun, 02 Apr 2017 06:32:35 GMT
  20.         < Connection: Keep-Alive
  21.         < Content-Type: text/html
  22.         < 
  23.         <html>
  24.         <meta http-equiv="refresh" content="0;url=http://www.baidu.com/">
  25.         </html>
  26. * Curl_http_done: called premature == 0
  27. * Connection #0 to host baidu.com left intact

实现代码 example.cn.conf

  1. server {
  2.     listen 80;
  3.     server_name docs.lvrui.io;
  5.     location / {
  6.         # 将 index.html 文件放到下面的目录下
  7.         root /var/www/html/refresh/;
  8.     }
  9. }
  11. server {
  12.     listen 443 ssl;
  13.     server_name docs.lvrui.io;
  14.     index index.html index.htm;
  15.     access_log  /var/log/nginx/docs.log  main;
  16.     ssl on;
  17.     ssl_certificate /etc/ssl/docs.20150509.cn.crt;
  18.     ssl_certificate_key  /etc/ssl/docs.20150509.cn.key;
  19.     error_page 404 /404.html;
  20.     location / {
  21.         root /var/www/html/docs;
  22.     }
  23. }

uwsgi_pass 支持两种方法：

  • 直接读取对方建立的sock file
  • 直接使用socket传到指定的port（uwsgi会在那边监听）