Nginx_Tomcat综合案例
要求
需求：通过 nginx 来代理两个 tomcat 服务器（反向代理），然后通过 https://www.nginx.com 来进行访问。
| 主机名 | IP | 软件 |
|---|---|---|
| nginx | 192.168.30.10 | nginx |
| tomcat1 | 192.168.30.11 | java，tomcat |
| tomcat2 | 192.168.30.12 | java，tomcat |
准备工作
1.先下载一下工具
（这是一个简装版，最初始）
现在应该也没有仓库，没有挂载。
1.检查仓库：
[root@nginx ~]# ls /etc/yum.repos.d/
base.repo redhat.repo
#base.repo 和 redhat.repo，基本是最小化安装时系统自动创建的默认配置文件
2.检查挂载情况：
[root@nginx ~]# ls /mnt
hgfs#没有
3.创建dnf.repo仓库
[root@nginx ~]# vim /etc/yum.repos.d/dnf.repo
[root@nginx ~]# cat /etc/yum.repos.d/dnf.repo
[baseOS]
name=baseos
baseurl=/mnt/BaseOS
gpgcheck=0
enabled=1[appSteam]
name=appstream
baseurl=/mnt/AppStream
gpgcheck=0
enabled=1
4.挂载仓库&检查
[root@nginx ~]# mount /dev/sr0 /mnt
mount: /mnt: WARNING: source write-protected, mounted read-only.[root@nginx ~]# ls /mnt
AppStream EULA images RPM-GPG-KEY-redhat-beta
BaseOS extra_files.json isolinux RPM-GPG-KEY-redhat-release
EFI GPL media.repo
5.下载补全工具bash-completion（tab）
[root@nginx ~]# dnf install bash-completion -y
Updating Subscription Management repositories.
Unable to read consumer identityThis system is not registered with an entitlement server. You can use subscription-manager to register.Repository baseOS is listed more than once in the configuration
BaseOS 2.7 MB/s | 2.7 kB 00:00
AppStream 3.1 MB/s | 3.2 kB 00:00
appstream 76 MB/s | 6.5 MB 00:00 Dependencies resolved.
====================================================================================Package Architecture Version Repository Size
====================================================================================Installing:bash-completion noarch 1:2.11-4.el9 baseOS 459 k
Installing dependencies:libpkgconf x86_64 1.7.3-10.el9 baseOS 37 kpkgconf x86_64 1.7.3-10.el9 baseOS 45 kpkgconf-m4 noarch 1.7.3-10.el9 baseOS 16 kpkgconf-pkg-config x86_64 1.7.3-10.el9 baseOS 12 kTransaction Summary
====================================================================================Install 5 PackagesTotal size: 569 k
Installed size: 1.2 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transactionPreparing : 1/1 Installing : pkgconf-m4-1.7.3-10.el9.noarch 1/5 Installing : libpkgconf-1.7.3-10.el9.x86_64 2/5 Installing : pkgconf-1.7.3-10.el9.x86_64 3/5 Installing : pkgconf-pkg-config-1.7.3-10.el9.x86_64 4/5 Installing : bash-completion-1:2.11-4.el9.noarch 5/5 Running scriptlet: bash-completion-1:2.11-4.el9.noarch 5/5 Verifying : bash-completion-1:2.11-4.el9.noarch 1/5 Verifying : libpkgconf-1.7.3-10.el9.x86_64 2/5 Verifying : pkgconf-1.7.3-10.el9.x86_64 3/5 Verifying : pkgconf-m4-1.7.3-10.el9.noarch 4/5 Verifying : pkgconf-pkg-config-1.7.3-10.el9.x86_64 5/5
Installed products updated.Installed:bash-completion-1:2.11-4.el9.noarch libpkgconf-1.7.3-10.el9.x86_64 pkgconf-1.7.3-10.el9.x86_64 pkgconf-m4-1.7.3-10.el9.noarch pkgconf-pkg-config-1.7.3-10.el9.x86_64 Complete!
2.关闭防火墙和selinux
（Nginx & Tomcat）
[root@bogon ~]# systemctl stop firewalld
[root@bogon ~]# systemctl stop selinux #这里写错了，导致后面检验时curl不上，进行了一堆排错
[root@nginx ~]# setenforce 0 #正确关闭
Failed to stop selinux.service: Unit selinux.service not loaded.
配置Nginx主机
1.改主机名
[root@bogon ~]# hostnamectl hostname nginx
[root@bogon ~]# exit
2.改ip地址
[root@nginx ~]# nmcli c modify ens160 ipv4.method manual ipv4.addresses 192.168.30.10/24 ipv4.gateway 192.168.30.2 ipv4.dns 223.5.5.5 connection.autoconnect yes
[root@nginx ~]# nmcli c up ens160
3.安装nginx
[root@nginx ~]# dnf install nginx -y
Updating Subscription Management repositories.
Unable to read consumer identityThis system is not registered with an entitlement server. You can use subscription-manager to register.Repository baseOS is listed more than once in the configuration
Last metadata expiration check: 0:17:48 ago on Sun 14 Sep 2025 04:46:31 PM CST.Dependencies resolved.
====================================================================================Package Arch Version Repository Size
====================================================================================Installing:nginx x86_64 1:1.20.1-14.el9_2.1 appStream 40 k
Installing dependencies:nginx-core x86_64 1:1.20.1-14.el9_2.1 appStream 574 knginx-filesystem noarch 1:1.20.1-14.el9_2.1 appStream 11 kredhat-logos-httpd noarch 90.4-2.el9 appStream 18 kTransaction Summary
====================================================================================Install 4 PackagesTotal size: 643 k
Installed size: 1.8 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transactionPreparing : 1/1 Running scriptlet: nginx-filesystem-1:1.20.1-14.el9_2.1.noarch 1/4 Installing : nginx-filesystem-1:1.20.1-14.el9_2.1.noarch 1/4 Installing : nginx-core-1:1.20.1-14.el9_2.1.x86_64 2/4 Installing : redhat-logos-httpd-90.4-2.el9.noarch 3/4 Installing : nginx-1:1.20.1-14.el9_2.1.x86_64 4/4 Running scriptlet: nginx-1:1.20.1-14.el9_2.1.x86_64 4/4 Verifying : nginx-1:1.20.1-14.el9_2.1.x86_64 1/4 Verifying : nginx-core-1:1.20.1-14.el9_2.1.x86_64 2/4 Verifying : nginx-filesystem-1:1.20.1-14.el9_2.1.noarch 3/4 Verifying : redhat-logos-httpd-90.4-2.el9.noarch 4/4
Installed products updated.Installed:nginx-1:1.20.1-14.el9_2.1.x86_64 nginx-core-1:1.20.1-14.el9_2.1.x86_64nginx-filesystem-1:1.20.1-14.el9_2.1.noarch redhat-logos-httpd-90.4-2.el9.noarch Complete!
4.主机映射
[root@nginx ~]# vim /etc/hosts
[root@nginx ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.30.10 www.web.com
[root@nginx ~]# vim /etc/hosts
[root@nginx ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.30.10 www.web.com #配置的5.生成证书和密钥（HTTPS密钥服务）
[root@nginx ~]# cd /etc/pki/tls/cert/
-bash: cd: /etc/pki/tls/cert/: No such file or directory
[root@nginx ~]# cd /etc/pki/tls/certs/
[root@nginx certs]# openssl genrsa > web.com.key
[root@nginx certs]# ls
ca-bundle.crt ca-bundle.trust.crt web.com.key
[root@nginx certs]# openssl req -new -key web.com.key -x509 -days 365 -out web.com.crt
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:chongqing
Locality Name (eg, city) [Default City]:banan
Organization Name (eg, company) [Default Company Ltd]:ck
Organizational Unit Name (eg, section) []:xxzx
Common Name (eg, your name or your server's hostname) []:www.web.com
Email Address []:
[root@nginx certs]# mv web.com.key ../private/6.配置nginx（.conf）
[root@nginx certs]# vim /etc/nginx/conf.d/web.conf
[root@nginx certs]# cat /etc/nginx/conf.d/web.conf
upstream tomcat {server 192.168.30.11:8080;server 192.168.30.12:8080;
}server {listen 443 ssl;server_name www.web.com;ssl_certificate "/etc/pki/certs/web.com.crt";ssl_certificate_key "/etc/pki/certs/web.com.key";location / {proxy_pass http://tomcat}
}7.启动nginx
[root@nginx certs]# systemctl start nginx遇到问题：启动失败
[root@nginx certs]# systemctl start nginx
Job for nginx.service failed because the control process exited with error code.
See "systemctl status nginx.service" and "journalctl -xeu nginx.service" for details.
#提示用systemctl status nginx.service && journalctl -xeu nginx.service检查[root@nginx certs]# systemctl status nginx.service
× nginx.service - The nginx HTTP and reverse proxy serverLoaded: loaded (/usr/lib/systemd/system/nginx.service; disabled; preset: disab>Active: failed (Result: exit-code) since Sun 2025-09-14 17:27:15 CST; 19s agoProcess: 13053 ExecStartPre=/usr/bin/rm -f /run/nginx.pid (code=exited, status=>Process: 13055 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=1/FAILURE)CPU: 13msSep 14 17:27:15 nginx systemd[1]: Starting The nginx HTTP and reverse proxy server.>
Sep 14 17:27:15 nginx nginx[13055]: nginx: [emerg] unexpected "}" in /etc/nginx/con>
#emerg] 是 Nginx 配置错误的紧急级别提示，通常表示配置文件存在无法忽略的语法问题，导致 Nginx 无法启动。
#unexpected "}" 直接说明：在配置文件中出现了未预期的 } 符号（可能是多写了 }，或 } 位置错误，导致括号不匹配）。
Sep 14 17:27:15 nginx nginx[13055]: nginx: configuration file /etc/nginx/nginx.conf>
Sep 14 17:27:15 nginx systemd[1]: nginx.service: Control process exited, code=exite>
Sep 14 17:27:15 nginx systemd[1]: nginx.service: Failed with result 'exit-code'.
Sep 14 17:27:15 nginx systemd[1]: Failed to start The nginx HTTP and reverse proxy >
[root@nginx certs]# 针对这种语法问题我们可以防御，在配置写完后用nginx -t检查
这时我们用一下：
[root@nginx certs]# nginx -t
nginx: [emerg] unexpected "}" in /etc/nginx/conf.d/web.conf:13
nginx: configuration file /etc/nginx/nginx.conf test failed改正后：
[root@nginx certs]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful#表示没问题[root@nginx certs]# cat /etc/nginx/conf.d/web.conf
upstream tomcat {server 192.168.30.11:8080;server 192.168.30.12:8080;
}server {listen 443 ssl;server_name www.web.com;ssl_certificate "/etc/pki/tls/certs/web.com.crt";#改后ssl_certificate_key "/etc/pki/tls/private/web.com.key";#改后location / {proxy_pass http://tomcat;#改后}
}重新启动nginx
[root@nginx certs]# systemctl restart nginx
[root@nginx certs]#
#没提示，没问题也可以自己看nginx状态
[root@nginx certs]# systemctl status nginx
● nginx.service - The nginx HTTP and reverse proxy serverLoaded: loaded (/usr/lib/systemd/system/nginx.service; disabled; preset: disab>Active: active (running) since Sun 2025-09-14 17:42:37 CST; 44s agoProcess: 13078 ExecStartPre=/usr/bin/rm -f /run/nginx.pid (code=exited, status=>Process: 13081 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)Process: 13082 ExecStart=/usr/sbin/nginx (code=exited, status=0/SUCCESS)Main PID: 13083 (nginx)Tasks: 5 (limit: 12043)Memory: 5.2MCPU: 34msCGroup: /system.slice/nginx.service├─13083 "nginx: master process /usr/sbin/nginx"├─13084 "nginx: worker process"├─13085 "nginx: worker process"├─13086 "nginx: worker process"└─13087 "nginx: worker process"Sep 14 17:42:37 nginx systemd[1]: Starting The nginx HTTP and reverse proxy server.>
Sep 14 17:42:37 nginx nginx[13081]: nginx: the configuration file /etc/nginx/nginx.>
Sep 14 17:42:37 nginx nginx[13081]: nginx: configuration file /etc/nginx/nginx.conf>
Sep 14 17:42:37 nginx systemd[1]: Started The nginx HTTP and reverse proxy server.配置Tomcat1
先添加一下补全工具（tab方便）
#略(上面有)
准备工作：
修改主机名，ip，关防火墙等（和配置nginx一样）
关防火墙等
[root@bogon ~]# systemctl stop firewalld修改主机名
[root@bogon ~]# hostnamectl hostname tomcat1
[root@bogon ~]# exit #退出重进修改ip
[root@tomcat1 ~]# nmcli c modify ens160 ipv4.method manual ipv4.addresses 192.168.30.11/24 ipv4.gateway 192.168.30.2 ipv4.dns 223.5.5.5 connection.autoconnect yes
[root@tomcat1 ~]# nmcli c up ens160
#自动退出，用新ip重进
安装软件（JDK和Tomcat）
安装JDK
1.dnf安装wget。jdk不能dnf安装，要源码安装，用到wget
[root@tomcat1 ~]# dnf install wget
Updating Subscription Management repositories.
Unable to read consumer identityThis system is not registered with an entitlement server. You can use subscription-manager to register.Repository baseOS is listed more than once in the configuration
Last metadata expiration check: 0:13:44 ago on Sun 14 Sep 2025 05:49:35 PM CST.
Package wget-1.21.1-7.el9.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!2.下载JDK
[root@tomcat1 ~]# wget https://download.oracle.com/java/21/latest/jdk-21_linux-x64_bin.tar.gz
--2025-09-14 18:04:42-- https://download.oracle.com/java/21/latest/jdk-21_linux-x64_bin.tar.gz
Resolving download.oracle.com (download.oracle.com)... 92.123.44.100
Connecting to download.oracle.com (download.oracle.com)|92.123.44.100|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 197018367 (188M) [application/x-gzip]
Saving to: ‘jdk-21_linux-x64_bin.tar.gz’jdk-21_linux-x64_bin 100%[======================>] 187.89M 5.32MB/s in 37s 2025-09-14 18:05:20 (5.09 MB/s) - ‘jdk-21_linux-x64_bin.tar.gz’ saved [197018367/197018367][root@tomcat1 ~]# ls
a2 aa jdk-21_linux-x64_bin.tar.gz test2 test4
a3 anaconda-ks.cfg test1 3.在/usr/local（专门放自主安装的软件）安装JDK
#先解压到/usr/local
[root@tomcat1 ~]# tar -xzf jdk-21_linux-x64_bin.tar.gz -C /usr/local/#进入/usr/local && 安装
[root@tomcat1 ~]# cd /usr/local/
[root@tomcat1 local]# ls
bin etc games include jdk-21.0.8 lib lib64 libexec sbin share src
[root@tomcat1 local]# cd jdk-21.0.8/
[root@tomcat1 jdk-21.0.8]# 4.配置JDK（源码安装就是这样麻烦）
[root@tomcat1 jdk-21.0.8]# vim /etc/profile
.....
export JAVA_HOME=/usr/local/jdk-21.0.6
export PATH=$PATH:$JAVA_HOME/bin5.JDK配置生效 && 检查
[root@tomcat1 jdk-21.0.8]# source /etc/profile[root@tomcat1 jdk-21.0.8]# java -version
java version "21.0.8" 2025-07-15 LTS
Java(TM) SE Runtime Environment (build 21.0.8+12-LTS-250)
Java HotSpot(TM) 64-Bit Server VM (build 21.0.8+12-LTS-250, mixed mode, sharing)
安装tomcat
6.安装tomcat
[root@tomcat1 ~]# dnf install tomcat
Updating Subscription Management repositories.
Unable to read consumer identityThis system is not registered with an entitlement server. You can use subscription-manager to register.baseos 2.7 MB/s | 2.7 kB 00:00
appstream 3.1 MB/s | 3.2 kB 00:00 Dependencies resolved.
====================================================================================Package Arch Version Repository Size
====================================================================================Installing:tomcat noarch 1:9.0.62-37.el9_3 appSteam 101 k
Installing dependencies:alsa-lib x86_64 1.2.9-1.el9 appSteam 523 kavahi-libs x86_64 0.8-15.el9 baseOS 71 kcopy-jdk-configs noarch 4.0-3.el9 appSteam 29 kcups-libs x86_64 1:2.3.3op2-21.el9 baseOS 265 kecj noarch 1:4.20-11.el9 appSteam 1.9 Mjava-11-openjdk-headless x86_64 1:11.0.20.0.8-3.el9 appSteam 40 Mjavapackages-filesystem noarch 6.0.0-4.el9 appSteam 17 kjavapackages-tools noarch 6.0.0-4.el9 appSteam 29 klksctp-tools x86_64 1.0.19-2.el9 baseOS 98 klua x86_64 5.4.4-4.el9 appSteam 192 klua-posix x86_64 35.0-8.el9 appSteam 155 ktomcat-el-3.0-api noarch 1:9.0.62-37.el9_3 appSteam 108 ktomcat-jsp-2.3-api noarch 1:9.0.62-37.el9_3 appSteam 67 ktomcat-lib noarch 1:9.0.62-37.el9_3 appSteam 5.8 Mtomcat-servlet-4.0-api noarch 1:9.0.62-37.el9_3 appSteam 286 ktzdata-java noarch 2023c-1.el9 appSteam 234 kTransaction Summary
====================================================================================Install 17 PackagesTotal size: 50 M
Installed size: 191 M
Is this ok [y/N]: y
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transactionRunning scriptlet: copy-jdk-configs-4.0-3.el9.noarch 1/1 Running scriptlet: java-11-openjdk-headless-1:11.0.20.0.8-3.el9.x86_64 1/1 Preparing : 1/1 Installing : javapackages-filesystem-6.0.0-4.el9.noarch 1/17 Installing : tzdata-java-2023c-1.el9.noarch 2/17 Installing : lua-posix-35.0-8.el9.x86_64 3/17 Installing : lua-5.4.4-4.el9.x86_64 4/17 Installing : copy-jdk-configs-4.0-3.el9.noarch 5/17 Installing : alsa-lib-1.2.9-1.el9.x86_64 6/17 Installing : lksctp-tools-1.0.19-2.el9.x86_64 7/17 Installing : avahi-libs-0.8-15.el9.x86_64 8/17 Installing : cups-libs-1:2.3.3op2-21.el9.x86_64 9/17 Installing : java-11-openjdk-headless-1:11.0.20.0.8-3.el9.x86_64 10/17 Running scriptlet: java-11-openjdk-headless-1:11.0.20.0.8-3.el9.x86_64 10/17 Installing : javapackages-tools-6.0.0-4.el9.noarch 11/17 Installing : tomcat-el-3.0-api-1:9.0.62-37.el9_3.noarch 12/17 Running scriptlet: tomcat-el-3.0-api-1:9.0.62-37.el9_3.noarch 12/17 Installing : tomcat-servlet-4.0-api-1:9.0.62-37.el9_3.noarch 13/17 Running scriptlet: tomcat-servlet-4.0-api-1:9.0.62-37.el9_3.noarch 13/17 Installing : tomcat-jsp-2.3-api-1:9.0.62-37.el9_3.noarch 14/17 Running scriptlet: tomcat-jsp-2.3-api-1:9.0.62-37.el9_3.noarch 14/17 Installing : ecj-1:4.20-11.el9.noarch 15/17 Installing : tomcat-lib-1:9.0.62-37.el9_3.noarch 16/17 Running scriptlet: tomcat-1:9.0.62-37.el9_3.noarch 17/17 Installing : tomcat-1:9.0.62-37.el9_3.noarch 17/17 Running scriptlet: tomcat-1:9.0.62-37.el9_3.noarch 17/17 Running scriptlet: copy-jdk-configs-4.0-3.el9.noarch 17/17 Running scriptlet: java-11-openjdk-headless-1:11.0.20.0.8-3.el9.x86_64 17/17 Running scriptlet: tomcat-1:9.0.62-37.el9_3.noarch 17/17 Verifying : avahi-libs-0.8-15.el9.x86_64 1/17 Verifying : cups-libs-1:2.3.3op2-21.el9.x86_64 2/17 Verifying : lksctp-tools-1.0.19-2.el9.x86_64 3/17 Verifying : alsa-lib-1.2.9-1.el9.x86_64 4/17 Verifying : copy-jdk-configs-4.0-3.el9.noarch 5/17 Verifying : ecj-1:4.20-11.el9.noarch 6/17 Verifying : java-11-openjdk-headless-1:11.0.20.0.8-3.el9.x86_64 7/17 Verifying : javapackages-filesystem-6.0.0-4.el9.noarch 8/17 Verifying : javapackages-tools-6.0.0-4.el9.noarch 9/17 Verifying : lua-5.4.4-4.el9.x86_64 10/17 Verifying : lua-posix-35.0-8.el9.x86_64 11/17 Verifying : tomcat-1:9.0.62-37.el9_3.noarch 12/17 Verifying : tomcat-el-3.0-api-1:9.0.62-37.el9_3.noarch 13/17 Verifying : tomcat-jsp-2.3-api-1:9.0.62-37.el9_3.noarch 14/17 Verifying : tomcat-lib-1:9.0.62-37.el9_3.noarch 15/17 Verifying : tomcat-servlet-4.0-api-1:9.0.62-37.el9_3.noarch 16/17 Verifying : tzdata-java-2023c-1.el9.noarch 17/17
Installed products updated.Installed:alsa-lib-1.2.9-1.el9.x86_64 avahi-libs-0.8-15.el9.x86_64 copy-jdk-configs-4.0-3.el9.noarch cups-libs-1:2.3.3op2-21.el9.x86_64 ecj-1:4.20-11.el9.noarch java-11-openjdk-headless-1:11.0.20.0.8-3.el9.x86_64 javapackages-filesystem-6.0.0-4.el9.noarch javapackages-tools-6.0.0-4.el9.noarch lksctp-tools-1.0.19-2.el9.x86_64 lua-5.4.4-4.el9.x86_64 lua-posix-35.0-8.el9.x86_64 tomcat-1:9.0.62-37.el9_3.noarch tomcat-el-3.0-api-1:9.0.62-37.el9_3.noarch tomcat-jsp-2.3-api-1:9.0.62-37.el9_3.noarch tomcat-lib-1:9.0.62-37.el9_3.noarch tomcat-servlet-4.0-api-1:9.0.62-37.el9_3.noarch tzdata-java-2023c-1.el9.noarch Complete!7.改变首页
#找到tomcat
[root@tomcat1 ~]# rpm -ql tomcat
/etc/logrotate.d/tomcat.disabled
/etc/sysconfig/tomcat
/etc/tomcat
/etc/tomcat/Catalina
/etc/tomcat/Catalina/localhost
/etc/tomcat/catalina.policy
/etc/tomcat/catalina.properties
/etc/tomcat/conf.d
/etc/tomcat/conf.d/README
/etc/tomcat/conf.d/java-9-start-up-parameters.conf
/etc/tomcat/context.xml
/etc/tomcat/jaspic-providers.xml
/etc/tomcat/jaspic-providers.xsd
/etc/tomcat/logging.properties
/etc/tomcat/server.xml
/etc/tomcat/tomcat-users.xml
/etc/tomcat/tomcat-users.xsd
/etc/tomcat/tomcat.conf
/etc/tomcat/web.xml
/usr/bin/tomcat-digest
/usr/bin/tomcat-tool-wrapper
/usr/lib/systemd/system/tomcat.service
/usr/lib/systemd/system/tomcat@.service
/usr/libexec/tomcat
/usr/libexec/tomcat/functions
/usr/libexec/tomcat/preamble
/usr/libexec/tomcat/server
/usr/sbin/tomcat
/usr/share/doc/tomcat
/usr/share/doc/tomcat/LICENSE
/usr/share/doc/tomcat/NOTICE
/usr/share/doc/tomcat/RELEASE-NOTES
/usr/share/tomcat
/usr/share/tomcat/bin/bootstrap.jar
/usr/share/tomcat/bin/catalina-tasks.xml
/usr/share/tomcat/conf
/usr/share/tomcat/lib
/usr/share/tomcat/logs
/usr/share/tomcat/temp
/usr/share/tomcat/webapps
/usr/share/tomcat/work
/var/cache/tomcat
/var/cache/tomcat/temp
/var/cache/tomcat/work
/var/lib/tomcat
/var/lib/tomcat/webapps
/var/lib/tomcats
/var/log/tomcat找到并改变首页（webapps中ROOT/index.jsp）
一般在/var/lib/tomcat/webapps
[root@tomcat1 webapps]# cd /var/lib/tomcat/webapps
[root@tomcat1 webapps]# ls
[root@tomcat1 webapps]# 空白
遇到问题：/var/lib/tomcat/webapps为空
[root@tomcat1 webapps]# cd /var/lib/tomcat/webapps
[root@tomcat1 webapps]# ls
[root@tomcat1 webapps]# 空白原因：未安装 tomcat-webapps 组件
检测是否安装
[root@tomcat1 webapps]# rpm -ql tomcat-webapps
package tomcat-webapps is not installed安装tomcat-webapps
[root@tomcat1 webapps]# dnf install -y tomcat-webapps
Updating Subscription Management repositories.
Unable to read consumer identityThis system is not registered with an entitlement server. You can use subscription-manager to register.Last metadata expiration check: 0:14:29 ago on Sun 14 Sep 2025 06:32:32 PM CST.Dependencies resolved.
====================================================================================Package Architecture Version Repository Size
====================================================================================Installing:tomcat-webapps noarch 1:9.0.62-37.el9_3 appSteam 83 kTransaction Summary
====================================================================================Install 1 PackageTotal size: 83 k
Installed size: 146 k
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transactionPreparing : 1/1 Installing : tomcat-webapps-1:9.0.62-37.el9_3.noarch 1/1 Verifying : tomcat-webapps-1:9.0.62-37.el9_3.noarch 1/1
Installed products updated.Installed:tomcat-webapps-1:9.0.62-37.el9_3.noarch Complete![root@tomcat1 webapps]# ls
ROOT
[root@tomcat1 webapps]# cd ROOT
[root@tomcat1 ROOT]# ls
asf-logo-wide.svg bg-nav.png index.jsp tomcat.svg
bg-button.png bg-upper.png RELEASE-NOTES.txt WEB-INF
bg-middle.png favicon.ico tomcat.css
[root@tomcat1 ROOT]# echo $(hostname -I) > index.jsp
检验：
tomcat1弄好，尝试一下能不能curl
正常结果：回应192.168.130.11（tomcat1的ip）
问题：启动后curl不正确
启动后curl不正确
[root@nginx ~]# curl https://www.web.com -k
<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.20.1</center>
</body>
</html>
排错：
（1）去看nginx服务开启没有
--->开启了（2）既然 Nginx 本身已正常运行，之前出现的 502 错误就可以完全排除 Nginx 自身启动失败的原因，问题必然出在 Nginx 与后端服务的通信环节（即反向代理配置的上游服务，如 Tomcat）。
# 1. 查看 Tomcat 服务状态（dnf 安装的 Tomcat）
systemctl status tomcat[root@tomcat1 ~]# systemctl status tomcat
● tomcat.service - Apache Tomcat Web Application ContainerLoaded: loaded (/usr/lib/systemd/system/tomcat.service; disabled; preset: disa>Active: active (running) since Sun 2025-09-14 18:52:53 CST; 6min agoMain PID: 13189 (java)Tasks: 34 (limit: 12043)Memory: 111.6MCPU: 3.574sCGroup: /system.slice/tomcat.service└─13189 /usr/lib/jvm/jre/bin/java -Djavax.sql.DataSource.Factory=org.a># 2. 若 Tomcat 是手动安装，查看进程是否存在
ps -ef | grep tomcat
[root@tomcat1 ~]# ps -ef | grep tomcat
tomcat 13189 1 0 18:52 ? 00:00:03 /usr/lib/jvm/jre/bin/java -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar: -Dcatalina.base=/usr/share/tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat/temp -Djava.util.logging.config.file=/usr/share/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start
root 13244 12680 0 19:00 pts/1 00:00:00 grep --color=auto tomcat# 3. 检查 8080 端口是否监听（确认服务可被访问）
ss -tuln | grep 8080
[root@tomcat1 ~]# ss -tuln | grep 8080
tcp LISTEN 0 100 *:8080 *:* （3）直接定位 Nginx 反向代理配置文件
--->正确(4)若仍失败：最后排查 Nginx 错误日志
# 查看最新 20 条错误日志，聚焦与 443 端口、proxy_pass 相关的内容
cat /var/log/nginx/error.log | tail -20
[root@nginx ~]# cat /var/log/nginx/error.log | tail -20
2025/09/14 17:27:15 [emerg] 13055#13055: unexpected "}" in /etc/nginx/conf.d/web.conf:13
2025/09/14 17:34:15 [emerg] 13062#13062: unexpected "}" in /etc/nginx/conf.d/web.conf:13
2025/09/14 17:36:40 [emerg] 13064#13064: unexpected end of file, expecting "}" in /etc/nginx/conf.d/web.conf:15
2025/09/14 17:37:08 [emerg] 13066#13066: cannot load certificate "/etc/pki/certs/web.com.crt": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/pki/certs/web.com.crt, r) error:10000080:BIO routines::no such file)
2025/09/14 18:52:07 [crit] 13085#13085: *1 connect() to 192.168.30.11:8080 failed (13: Permission denied) while connecting to upstream, client: 192.168.30.10, server: www.web.com, request: "GET / HTTP/1.1", upstream: "http://192.168.30.11:8080/", host: "www.web.com"
2025/09/14 18:52:07 [crit] 13085#13085: *1 connect() to 192.168.30.12:8080 failed (13: Permission denied) while connecting to upstream, client: 192.168.30.10, server: www.web.com, request: "GET / HTTP/1.1", upstream: "http://192.168.30.12:8080/", host: "www.web.com"
2025/09/14 18:52:59 [crit] 13085#13085: *4 connect() to 192.168.30.12:8080 failed (13: Permission denied) while connecting to upstream, client: 192.168.30.10, server: www.web.com, request: "GET / HTTP/1.1", upstream: "http://192.168.30.12:8080/", host: "www.web.com"
2025/09/14 18:52:59 [crit] 13085#13085: *4 connect() to 192.168.30.11:8080 failed (13: Permission denied) while connecting to upstream, client: 192.168.30.10, server: www.web.com, request: "GET / HTTP/1.1", upstream: "http://192.168.30.11:8080/", host: "www.web.com"
2025/09/14 18:55:04 [crit] 13085#13085: *7 connect() to 192.168.30.12:8080 failed (13: Permission denied) while connecting to upstream, client: 192.168.30.10, server: www.web.com, request: "GET / HTTP/1.1", upstream: "http://192.168.30.12:8080/", host: "www.web.com"
2025/09/14 18:55:04 [crit] 13085#13085: *7 connect() to 192.168.30.11:8080 failed (13: Permission denied) while connecting to upstream, client: 192.168.30.10, server: www.web.com, request: "GET / HTTP/1.1", upstream: "http://192.168.30.11:8080/", host: "www.web.com"
2025/09/14 19:12:51 [crit] 13178#13178: *1 connect() to 192.168.30.11:8080 failed (13: Permission denied) while connecting to upstream, client: 192.168.30.10, server: www.web.com, request: "GET / HTTP/1.1", upstream: "http://192.168.30.11:8080/", host: "www.web.com"
2025/09/14 19:12:51 [crit] 13178#13178: *1 connect() to 192.168.30.12:8080 failed (13: Permission denied) while connecting to upstream, client: 192.168.30.10, server: www.web.com, request: "GET / HTTP/1.1", upstream: "http://192.168.30.12:8080/", host: "www.web.com"#从 Nginx 错误日志可以看到核心错误：connect() to 192.168.30.11:8080 failed (13: Permission denied)，这表明 Nginx 进程没有权限连接到后端 Tomcat 服务器的 8080 端口，导致 502 错误。#这是典型的 SELinux 或防火墙权限限制 问题
[root@nginx ~]# getenforce
Enforcing
[root@nginx ~]# setenforce 0#验证
[root@nginx ~]# curl https://www.web.com -k
192.168.30.11#成功配置Tomcat2
克隆Tomcat1
改主机名，ip，主页
[root@tomcat1 ~]# hostnamectl hostname tomcat2
[root@tomcat1 ~]# exit[root@tomcat2 ~]# nmcli c modify ens160 ipv4.method manual ipv4.addresses 192.168.30.12/24 ipv4.gateway 192.168.30.2 ipv4.dns 223.5.5.5 connection.autoconnect yes
[root@tomcat2 ~]# nmcli c up ens160[root@tomcat2 ~]# cd /var/lib/tomcat/webapps/ROOT
[root@tomcat2 ROOT]# ls
asf-logo-wide.svg bg-nav.png index.jsp tomcat.svg
bg-button.png bg-upper.png RELEASE-NOTES.txt WEB-INF
bg-middle.png favicon.ico tomcat.css
[root@tomcat2 ROOT]# echo $(hostname -I) > index.jsp 测试
准备工作：
确保nginx和tomcat服务都打开，防火墙和selinux都关闭
测试
[root@nginx ~]# curl https://www.web.com -k
192.168.30.11
[root@nginx ~]# curl https://www.web.com -k
192.168.30.11
[root@nginx ~]# curl https://www.web.com -k
192.168.30.12
[root@nginx ~]# curl https://www.web.com -k
192.168.30.11
[root@nginx ~]# curl https://www.web.com -k
192.168.30.12
[root@nginx ~]# curl https://www.web.com -k
192.168.30.11