43 lines
1.5 KiB
Plaintext
43 lines
1.5 KiB
Plaintext
# 部署前替换管理域名、证书路径和端口占位符，不能直接加载本文件。
|
|
# 管理域名由部署环境决定，不在应用代码中固定。
|
|
# 与其他站点共用监听端口，不重复声明 default_server。
|
|
|
|
server {
|
|
listen __HTTP_PORT__;
|
|
listen [::]:__HTTP_PORT__;
|
|
server_name __MANAGEMENT_HOST__;
|
|
return 308 __MANAGEMENT_ORIGIN__$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen __HTTPS_PORT__ ssl;
|
|
listen [::]:__HTTPS_PORT__ ssl;
|
|
server_name __MANAGEMENT_HOST__;
|
|
ssl_certificate __FULLCHAIN_PATH__;
|
|
ssl_certificate_key __PRIVATE_KEY_PATH__;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
client_max_body_size 64m;
|
|
access_log /var/log/nginx/scert-access.log combined;
|
|
error_log /var/log/nginx/scert-error.log warn;
|
|
|
|
location / {
|
|
proxy_pass https://127.0.0.1:__UPSTREAM_PORT__;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-Host $http_host;
|
|
proxy_set_header X-Forwarded-Port __HTTPS_PORT__;
|
|
proxy_set_header Connection '';
|
|
proxy_ssl_server_name on;
|
|
proxy_ssl_name __MANAGEMENT_HOST__;
|
|
proxy_ssl_verify on;
|
|
proxy_ssl_verify_depth 3;
|
|
proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
|
|
proxy_connect_timeout 5s;
|
|
proxy_read_timeout 180s;
|
|
proxy_send_timeout 90s;
|
|
}
|
|
}
|