26 lines
1.1 KiB
Plaintext
26 lines
1.1 KiB
Plaintext
# 替换占位符后，将本文件 include 到每个 HTTP-01 域名现有的 80 端口 server 块。
|
||
# 只匹配挑战路径；不要新增 default_server，不改动现有业务 location。
|
||
# server 级 return/rewrite 必须移到非挑战 location 中，避免抢先重定向。
|
||
location ^~ /.well-known/acme-challenge/ {
|
||
proxy_pass https://127.0.0.1:__UPSTREAM_PORT__;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header Connection '';
|
||
proxy_set_header Cookie '';
|
||
proxy_set_header Authorization '';
|
||
proxy_set_header X-Forwarded-For $remote_addr;
|
||
proxy_set_header X-Forwarded-Proto http;
|
||
proxy_ssl_server_name on;
|
||
proxy_ssl_name __MANAGEMENT_HOST__;
|
||
proxy_ssl_verify on;
|
||
proxy_ssl_verify_depth 3;
|
||
proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
|
||
proxy_cache off;
|
||
proxy_intercept_errors off;
|
||
proxy_connect_timeout 5s;
|
||
proxy_read_timeout 10s;
|
||
proxy_send_timeout 10s;
|
||
# 挑战令牌不进入常规访问日志；应用层仍检查 Host、令牌与订单有效期。
|
||
access_log off;
|
||
}
|