這裡有篇nginx配置的博客,寫得挺詳細(xì)的,而且非常新,2016.3.21發(fā)布的。但是裡面配置項(xiàng)目太多,很多項(xiàng)不太清楚什麼作用,能否麻煩幫解釋一下。原文連結(jié):https://imququ.com/post/my-nginx-conf.ht...
需要解釋的設(shè)定檔如下,需要解釋的項(xiàng)以註解標(biāo)註。不太好意思,內(nèi)容有點(diǎn)多,可以選擇性的隨便答一些。
server {
listen 443 ssl http2 fastopen=3 reuseport;
server_name www.imququ.com imququ.com;
server_tokens off;
include /home/jerry/www/nginx_conf/ip.blacklist;
//能否幫解釋一下下面一堆ssl各項(xiàng)意思?
ssl_ct on;
ssl_ct_static_scts /home/jerry/www/scts;
ssl_certificate /home/jerry/www/ssl/chained.pem;
ssl_certificate_key /home/jerry/www/ssl/domain.key;
ssl_dhparam /home/jerry/www/ssl/dhparams.pem;
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 1d;
ssl_session_tickets on;
ssl_session_ticket_key /home/jerry/www/ssl/session_ticket.key;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /home/jerry/www/ssl/full_chained.pem;
//下面兩項(xiàng)需要解釋,不太懂
resolver 114.114.114.114 valid=300s;
resolver_timeout 10s;
access_log /home/jerry/www/nginx_log/imququ_com.log;
//麻煩解釋一下下面 “兩個(gè)” if語句
if ($request_method !~ ^(GET|HEAD|POST|OPTIONS)$ ) {
return 444;
}
if ($host != 'imququ.com' ) {
rewrite ^/(.*)$ https://imququ.com/ permanent;
}
//這個(gè)location語句需要解釋一下,主要是括號(hào)里面的內(nèi)容不太明白
location ~* (robots\.txt|favicon\.ico|crossdomain\.xml|google4c90d18e696bdcf8\.html|BingSiteAuth\.xml)$ {
root /home/jerry/www/imququ.com/www/static;
expires 1d;
}
//下面這個(gè)location語句,可能每句話都需要幫解釋一下
location ~ ^/static/uploads/ {
root /home/jerry/www/imququ.com/www;
add_header Access-Control-Allow-Origin *;
set $expires_time max;
valid_referers blocked none server_names *.qgy18.com *.inoreader.com feedly.com *.feedly.com www.udpwork.com theoldreader.com digg.com *.feiworks.com *.newszeit.com r.mail.qq.com yuedu.163.com *.w3ctech.com;
if ($invalid_referer) {
set $expires_time -1;
rewrite ^/ https://imququ.com/static/img/blog/403.png redirect;
}
expires $expires_time;
}
//下面這個(gè)location語句,作用是什么?
location ~ ^/static/ {
root /home/jerry/www/imququ.com/www;
add_header Access-Control-Allow-Origin *;
expires max;
}
//下面這個(gè)location語句,也是可能每句話都需要幫解釋一下。
location ~ ^/admin {
proxy_http_version 1.1;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
add_header X-Frame-Options deny;
add_header X-Content-Type-Options nosniff;
proxy_set_header X-Via QingDao.Aliyun;
proxy_set_header Connection "";
proxy_set_header Host imququ.com;
proxy_set_header X-Real_IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://127.0.0.1:9095;
}
//下面這個(gè)location語句應(yīng)該不需要解釋了,項(xiàng)目都是上面出現(xiàn)過的。
location / {
proxy_http_version 1.1;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
add_header X-Frame-Options deny;
add_header X-Content-Type-Options nosniff;
add_header Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: https:; img-src data: https: http://ip.qgy18.com:81; style-src 'unsafe-inline' https:; child-src https:; connect-src 'self' https://translate.googleapis.com; frame-src https://disqus.com https://www.slideshare.net";
add_header Public-Key-Pins 'pin-sha256="aef6IF2UF6jNEwA2pNmP7kpgT6NFSdt7Tqf5HzaIGWI="; pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; max-age=2592000; includeSubDomains';
add_header Cache-Control no-cache;
proxy_ignore_headers Set-Cookie;
proxy_hide_header Vary;
proxy_hide_header X-Powered-By;
proxy_set_header X-Via QingDao.Aliyun;
proxy_set_header Connection "";
proxy_set_header Host imququ.com;
proxy_set_header X-Real_IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://127.0.0.1:9095;
}
}
//為什么這個(gè)server里面的域名和上面server里面一樣,弄兩個(gè)server干啥?
server {
server_name www.imququ.com imququ.com;
server_tokens off;
access_log /dev/null;
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
return 444;
}
location ^~ /.well-known/acme-challenge/ {
alias /home/jerry/www/challenges/;
try_files $uri =404;
}
location / {
rewrite ^/(.*)$ https://imququ.com/ permanent;
}
}
個(gè)人感覺,對(duì)於SSL的問題題主不如去直接翻nginx的文檔來的快
http://nginx.org/en/docs/http/ngx_http_s...
其實(shí)下面的問題也都一樣,包括resolver,location和最下面server的rewrite,這些完全都可以透過檢查手冊(cè)來解決。推薦去通讀一遍nginx官方的文檔,相信這個(gè)配置就很好理解了。例如$request_method這種變數(shù)什麼意思,$host變數(shù)又是什麼意思,HTTP 444是什麼狀態(tài)碼。
說句不太好聽的話,RTFM
對(duì)於這個(gè)問題,我有幾個(gè)建議。我也是在該部落格上學(xué)習(xí)的HTTPS部署。
第一,請(qǐng)將該博主的幾篇關(guān)於HTTPS部署的文章都看一看,我記得有安全篇,性能篇等好幾篇,寫得很不錯(cuò),你耐心看完,這裡大部分問題就可以得到解答。之所以選項(xiàng)很多,就是因?yàn)檫@是部落客多篇文章的總結(jié),你要真想知道原理,就需要把那些文章都看了。
第二,關(guān)於location部分,建議單獨(dú)搜尋Nginx location部分的配置,然後再回過頭來看這裡的配置。
第三,resolver部分我也不太懂,但似乎是跟ssl配置有關(guān)的,也就是說他是跟ssl一起設(shè)定的。