50 lines
1.7 KiB
Plaintext
50 lines
1.7 KiB
Plaintext
# 部署前替换管理域名、证书路径和端口占位符，不能直接加载本文件。
|
||
# 管理域名由部署环境决定，不在应用代码中固定。
|
||
# 与其他站点共用监听端口，不重复声明 default_server。
|
||
|
||
server {
|
||
listen __HTTP_PORT__;
|
||
listen [::]:__HTTP_PORT__;
|
||
server_name __MANAGEMENT_HOST__;
|
||
|
||
# 不能使用 server 级 return，否则会先于挑战路径反代执行。
|
||
# 将 http-challenge.conf.example 替换占位符后保存到此绝对路径。
|
||
include __HTTP_CHALLENGE_SNIPPET_PATH__;
|
||
|
||
location / {
|
||
return 308 __MANAGEMENT_ORIGIN__$request_uri;
|
||
}
|
||
}
|
||
|
||
server {
|
||
listen __HTTPS_PORT__ ssl;
|
||
listen [::]:__HTTPS_PORT__ ssl;
|
||
server_name __MANAGEMENT_HOST__;
|
||
ssl_certificate __FULLCHAIN_PATH__;
|
||
ssl_certificate_key __PRIVATE_KEY_PATH__;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
client_max_body_size 64m;
|
||
access_log /var/log/nginx/scert-access.log combined;
|
||
error_log /var/log/nginx/scert-error.log warn;
|
||
|
||
location / {
|
||
proxy_pass https://127.0.0.1:__UPSTREAM_PORT__;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $remote_addr;
|
||
proxy_set_header X-Forwarded-Proto https;
|
||
proxy_set_header X-Forwarded-Host $http_host;
|
||
proxy_set_header X-Forwarded-Port __HTTPS_PORT__;
|
||
proxy_set_header Connection '';
|
||
proxy_ssl_server_name on;
|
||
proxy_ssl_name __MANAGEMENT_HOST__;
|
||
proxy_ssl_verify on;
|
||
proxy_ssl_verify_depth 3;
|
||
proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
|
||
proxy_connect_timeout 5s;
|
||
proxy_read_timeout 180s;
|
||
proxy_send_timeout 90s;
|
||
}
|
||
}
|