|
|
@@ -1,131 +0,0 @@
|
|
|
-##
|
|
|
-# You should look at the following URL's in order to grasp a solid understanding
|
|
|
-# of Nginx configuration files in order to fully unleash the power of Nginx.
|
|
|
-# https://www.nginx.com/resources/wiki/start/
|
|
|
-# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
|
|
|
-# https://wiki.debian.org/Nginx/DirectoryStructure
|
|
|
-#
|
|
|
-# In most cases, administrators will remove this file from sites-enabled/ and
|
|
|
-# leave it as reference inside of sites-available where it will continue to be
|
|
|
-# updated by the nginx packaging team.
|
|
|
-#
|
|
|
-# This file will automatically load configuration files provided by other
|
|
|
-# applications, such as Drupal or Wordpress. These applications will be made
|
|
|
-# available underneath a path with that package name, such as /drupal8.
|
|
|
-#
|
|
|
-# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
|
|
|
-##
|
|
|
-
|
|
|
-# Default server configuration
|
|
|
-#
|
|
|
-#####本配置使用正常环境 debian9_x64 nginx_1.10.3 openssl_1.1.0f v2ray_4.2
|
|
|
-#####兼容客户端Firefox 27, Chrome 30, IE 11 on Windows 7, Edge, Opera 17, Safari 9, Android 5.0, and Java 8
|
|
|
-#####注:切勿修改<nginx.conf>中的内容,但<该文件>与<nginx.conf>中的<参数重叠>那么会<遵从前者>
|
|
|
-
|
|
|
-server {
|
|
|
- # 禁用不需要的请求方式 以下只允许 get、post
|
|
|
- if ($request_method !~ ^(POST|GET)$) {
|
|
|
- return 444;
|
|
|
- }
|
|
|
-
|
|
|
- listen 127.0.0.1:80;
|
|
|
- server_name domain.Name; #注:填写自己的域名
|
|
|
- return 301 https://$host/;
|
|
|
-}
|
|
|
-
|
|
|
-upstream v2ray {
|
|
|
- server 127.0.0.1:10086; #注:v2ray后端监听地址、端口
|
|
|
- keepalive 2176; # 链接池空闲链接数
|
|
|
-}
|
|
|
-
|
|
|
-map $http_upgrade $connection_upgrade {
|
|
|
- default upgrade;
|
|
|
- '' close;
|
|
|
-}
|
|
|
-
|
|
|
-
|
|
|
-server {
|
|
|
- #要开启 HTTP/2 注意nginx版本
|
|
|
- #可以使用 nginx -V 检查
|
|
|
- listen 127.0.0.1:443 ssl http2 backlog=1024 so_keepalive=120s:60s:10 reuseport; # backlog是nginx 监听队列 默认是511 使用命令 ss -tnl查看(Send-Q);
|
|
|
- #设置编码
|
|
|
- charset utf-8;
|
|
|
-
|
|
|
- #证书配置
|
|
|
- ssl_certificate PATH; #注:填写自己证书路径
|
|
|
- ssl_certificate_key PATH; #注:填写密钥路径
|
|
|
-
|
|
|
- ssl_session_cache shared:SSL:50m;
|
|
|
- ssl_session_timeout 1d;
|
|
|
- ssl_session_tickets off;
|
|
|
-
|
|
|
- # https://nginx.org/en/docs/http/ngx_http_ssl_module.html
|
|
|
- ssl_protocols TLSv1.2;
|
|
|
- #openssl ciphers
|
|
|
- #注:懒人配置 https://mozilla.github.io/server-side-tls/ssl-config-generator/
|
|
|
- ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
|
|
|
- ssl_prefer_server_ciphers on;
|
|
|
-
|
|
|
- #安全设定
|
|
|
- #屏蔽请求类型
|
|
|
- if ($request_method !~ ^(POST|GET)$) {
|
|
|
- return 444;
|
|
|
- }
|
|
|
- add_header X-Frame-Options DENY;
|
|
|
- add_header X-XSS-Protection "1; mode=block";
|
|
|
- add_header X-Content-Type-Options nosniff;
|
|
|
- # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
|
|
|
- ###测试前请使用较少的时间
|
|
|
- ### https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/
|
|
|
- add_header Strict-Transport-Security max-age=15 always;
|
|
|
-
|
|
|
- #openssl dhparam -out dhparam.pem 2048
|
|
|
- #openssl dhparam -out dhparam.pem 4096
|
|
|
- #ssl_dhparam /home/dhparam.pem;
|
|
|
- #ssl_ecdh_curve secp384r1;
|
|
|
-
|
|
|
- # OCSP Stapling ---
|
|
|
- # fetch OCSP records from URL in ssl_certificate and cache them
|
|
|
- #ssl_stapling on;
|
|
|
- #ssl_stapling_verify on;
|
|
|
- #resolver_timeout 10s;
|
|
|
- #resolver [去掉括号并将文字改成你希望的dns服务器ip地址] valid=300s;
|
|
|
- #范例 resolver 2.2.2.2 valid=300s;
|
|
|
-
|
|
|
- root /var/www/html;
|
|
|
-
|
|
|
- # Add index.php to the list if you are using PHP
|
|
|
- index index.html index.htm index.php ;
|
|
|
-
|
|
|
- server_name domain.Name; #注: 将domain.Name 替换成你的域名
|
|
|
-
|
|
|
-
|
|
|
- location /GLMzpX/ { #注:修改路径
|
|
|
- proxy_http_version 1.1;
|
|
|
- proxy_set_header Upgrade $http_upgrade;
|
|
|
- proxy_set_header Connection $connection_upgrade; #此处与<map>对应
|
|
|
- proxy_set_header Host $http_host;
|
|
|
-
|
|
|
- # 向后端传递访客ip
|
|
|
- proxy_set_header X-Real-IP $remote_addr;
|
|
|
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
-
|
|
|
-
|
|
|
- sendfile on;
|
|
|
- tcp_nopush on;
|
|
|
- tcp_nodelay on;
|
|
|
- keepalive_requests 25600;
|
|
|
- keepalive_timeout 300 300;
|
|
|
- proxy_buffering off;
|
|
|
- proxy_buffer_size 8k;
|
|
|
-
|
|
|
- #后端错误重定向
|
|
|
- proxy_intercept_errors on;
|
|
|
- error_page 400 = URL; # url是一个网站地址。例如:https://www.xxxx.com/
|
|
|
- if ($http_host = "domain.Name" ) { #注: 修改 domain.Name 为自己的域名
|
|
|
- #v2ray 后端 查看上面"upstream"字段
|
|
|
- proxy_pass http://v2ray;
|
|
|
- }
|
|
|
- }
|
|
|
-}
|
|
|
-
|