Nginx-Konfigurations-https-Problem

Hier ist ein Blog über die Nginx-Konfiguration, der sehr detailliert und sehr neu ist. Er wurde am 21. März 2016 veröffentlicht. Aber es sind zu viele Konfigurationselemente darin und ich weiß nicht, welche Funktionen viele davon haben. Könnten Sie es mir bitte erklären? Ursprünglicher Link: https://imququ.com/post/my-nginx-conf.ht...

Die Konfigurationsdateien, die einer Erklärung bedürfen, sind wie folgt, und die Elemente, die einer Erklärung bedürfen, sind mit Kommentaren markiert. Leider ist der Inhalt sehr umfangreich, sodass ich einige ausgewählte Fragen beantworten kann.

server {
    listen               443 ssl http2 fastopen=3 reuseport;

    server_name          www.imququ.com imququ.com;
    server_tokens        off;

    include              /home/jerry/www/nginx_conf/ip.blacklist;

//能否帮解释一下下面一堆ssl各项意思？
    ssl_ct               on;
    ssl_ct_static_scts   /home/jerry/www/scts;
    ssl_certificate      /home/jerry/www/ssl/chained.pem;
    ssl_certificate_key  /home/jerry/www/ssl/domain.key;
    ssl_dhparam          /home/jerry/www/ssl/dhparams.pem;
    ssl_ciphers                EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
    ssl_prefer_server_ciphers  on;
    ssl_protocols              TLSv1 TLSv1.1 TLSv1.2;
    ssl_session_cache          shared:SSL:50m;
    ssl_session_timeout        1d;
    ssl_session_tickets        on;
    ssl_session_ticket_key     /home/jerry/www/ssl/session_ticket.key;
    ssl_stapling               on;
    ssl_stapling_verify        on;
    ssl_trusted_certificate    /home/jerry/www/ssl/full_chained.pem;

//下面两项需要解释，不太懂
    resolver                   114.114.114.114 valid=300s;
    resolver_timeout           10s;

    access_log                 /home/jerry/www/nginx_log/imququ_com.log;

//麻烦解释一下下面 “两个” if语句
    if ($request_method !~ ^(GET|HEAD|POST|OPTIONS)$ ) {
        return           444;
    }
    if ($host != 'imququ.com' ) {
        rewrite          ^/(.*)$  https://imququ.com/ permanent;
    }

//这个location语句需要解释一下，主要是括号里面的内容不太明白
    location ~* (robots\.txt|favicon\.ico|crossdomain\.xml|google4c90d18e696bdcf8\.html|BingSiteAuth\.xml)$ {
        root             /home/jerry/www/imququ.com/www/static;
        expires          1d;
    }

//下面这个location语句，可能每句话都需要帮解释一下
    location ~ ^/static/uploads/ {
        root             /home/jerry/www/imququ.com/www;
        add_header       Access-Control-Allow-Origin *;

        set              $expires_time max;

        valid_referers blocked none server_names *.qgy18.com *.inoreader.com feedly.com *.feedly.com www.udpwork.com theoldreader.com digg.com *.feiworks.com *.newszeit.com r.mail.qq.com yuedu.163.com *.w3ctech.com;
        if ($invalid_referer) {
            set          $expires_time -1;
            rewrite      ^/ https://imququ.com/static/img/blog/403.png redirect;
        }

        expires          $expires_time;
    }

//下面这个location语句，作用是什么？
    location ~ ^/static/ {
        root             /home/jerry/www/imququ.com/www;
        add_header       Access-Control-Allow-Origin *;      
        expires          max;
    }


//下面这个location语句，也是可能每句话都需要帮解释一下。
    location ~ ^/admin {
        proxy_http_version       1.1;

        add_header               Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
        add_header               X-Frame-Options deny;
        add_header               X-Content-Type-Options nosniff;

        proxy_set_header         X-Via            QingDao.Aliyun;
        proxy_set_header         Connection       "";
        proxy_set_header         Host             imququ.com;
        proxy_set_header         X-Real_IP        $remote_addr;
        proxy_set_header         X-Forwarded-For  $proxy_add_x_forwarded_for;

        proxy_pass               http://127.0.0.1:9095;
    }

//下面这个location语句应该不需要解释了，项目都是上面出现过的。
    location / {
        proxy_http_version       1.1;

        add_header               Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
        add_header               X-Frame-Options deny;
        add_header               X-Content-Type-Options nosniff;
        add_header               Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: https:; img-src data: https: http://ip.qgy18.com:81; style-src 'unsafe-inline' https:; child-src https:; connect-src 'self' https://translate.googleapis.com; frame-src https://disqus.com https://www.slideshare.net";
        add_header               Public-Key-Pins 'pin-sha256="aef6IF2UF6jNEwA2pNmP7kpgT6NFSdt7Tqf5HzaIGWI="; pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; max-age=2592000; includeSubDomains';
        add_header               Cache-Control no-cache;

        proxy_ignore_headers     Set-Cookie;

        proxy_hide_header        Vary;
        proxy_hide_header        X-Powered-By;

        proxy_set_header         X-Via            QingDao.Aliyun;
        proxy_set_header         Connection       "";
        proxy_set_header         Host             imququ.com;
        proxy_set_header         X-Real_IP        $remote_addr;
        proxy_set_header         X-Forwarded-For  $proxy_add_x_forwarded_for;

        proxy_pass               http://127.0.0.1:9095;
    }
}

//为什么这个server里面的域名和上面server里面一样，弄两个server干啥？
server {
    server_name       www.imququ.com imququ.com;
    server_tokens     off;

    access_log        /dev/null;

    if ($request_method !~ ^(GET|HEAD|POST)$ ) {
        return        444;
    }

    location ^~ /.well-known/acme-challenge/ {
        alias         /home/jerry/www/challenges/;
        try_files     $uri =404;
    }

    location / {
        rewrite       ^/(.*)$ https://imququ.com/ permanent;
    }
}

某草草2754 Tage vor492

Nginx-Konfigurations-https-Problem

Antworte allen(2)Ich werde antworten