ini 另一个nginx.conf

Posted 2021-05-24

# Basically the nginx configuration I use at konklone.com. 
# I check it using https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com
#
# To provide feedback, please tweet at @konklone or email [e-mail].
# Comments on gists don't notify the author. 
# 
# Thanks to WubTheCaptain (https://wubthecaptain.eu) for his help and ciphersuites.
# Thanks to Ilya Grigorik (https://www.igvita.com) for constant inspiration.

server {
    listen 80;
    server_name konklone.com;
    return 301 https://$host$request_uri;
}

# The 'spdy' at the end of the listen command below turns on SPDY support.

server {
    listen 443 ssl spdy;
    server_name konklone.com;

    # Path to certificate and private key.
    # The .crt may omit the root CA cert, if it's a standard CA that ships with clients.
    ssl_certificate /path/to/unified.crt;
    ssl_certificate_key /path/to/my-private-decrypted.key;

    # Tell browsers to require SSL (warning: difficult to change your mind)
    add_header Strict-Transport-Security max-age=31536000;

    # Prefer certain ciphersuites, to enforce Forward Secrecy and avoid known vulnerabilities.
    # 
    # Forces forward secrecy in all browsers and clients that can use TLS,
    # but with a small exception (DES-CBC3-SHA) for IE8/XP users.
    # 
    # Reference client: https://www.ssllabs.com/ssltest/analyze.html
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 kEDH+AES128 kEDH+AES256 DES-CBC3-SHA +SHA !aNULL !eNULL !LOW !MD5 !EXP !DSS !PSK !SRP !kECDH !CAMELLIA !RC4 !SEED';

    # Cut out (the old, broken) SSLv3 entirely. 
    # This **excludes IE6 users** and (apparently) Yandexbot.
    # Just comment out if you need to support IE6, bless your soul.
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;

    # Turn on session resumption, using a 10 min cache shared across nginx processes,
    # as recommended by http://nginx.org/en/docs/http/configuring_https_servers.html
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;
    keepalive_timeout   70;

    # Buffer size of 1400 bytes fits in one MTU.
    # nginx 1.5.9+ ONLY
    ssl_buffer_size 1400; 

    # SPDY header compression (0 for none, 9 for slow/heavy compression). Preferred is 6. 
    # 
    # BUT: header compression is flawed and vulnerable in SPDY versions 1 - 3.
    # Disable with 0, until using a version of nginx with SPDY 4.
    spdy_headers_comp 0;

    # Now let's really get fancy, and pre-generate a 2048 bit random parameter
    # for DH elliptic curves. If not created and specified, default is only 1024 bits. 
    #
    # Generated by OpenSSL with the following command:
    #   openssl dhparam -outform pem -out dhparam2048.pem 2048
    # 
    # Note: raising the bits to 2048 excludes Java 6 clients. Comment out if a problem.
    ssl_dhparam /path/to/dhparam2048.pem;


    # OCSP stapling - means nginx will poll the CA for signed OCSP responses, 
    # and send them to clients so clients don't make their own OCSP calls.
    # http://en.wikipedia.org/wiki/OCSP_stapling
    # 
    # while the ssl_certificate above may omit the root cert if the CA is trusted,
    # ssl_trusted_certificate below must point to a chain of **all** certs
    # in the trust path - (your cert, intermediary certs, root cert)
    #
    # 8.8.8.8 and 8.8.4.4 below are Google's public IPv4 DNS servers. 
    # nginx will use them to talk to the CA.
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=86400;
    resolver_timeout 10;
    ssl_trusted_certificate /path/to/all-certs-in-chain.crt;
}

ini nginx.conf

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   75;
    types_hash_max_size 2048;
    server_tokens       off;


    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    include /etc/nginx/conf.d/*.conf;


    add_header          Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header          X-Content-Type-Options nosniff;
    add_header          X-Frame-Options SAMEORIGIN;
    add_header          X-XSS-Protection "1; mode=block";

    ssl_stapling on;
    ssl_stapling_verify on;

    pagespeed on;
    pagespeed FileCachePath "/path/to/cache";
    pagespeed RewriteLevel OptimizeForBandwidth;
    #优化
    ## 启用压缩空白过滤器
    pagespeed EnableFilters collapse_whitespace;
    # 启用JavaScript库卸载
    pagespeed EnableFilters canonicalize_javascript_libraries;
    # 把多个CSS文件合并成一个CSS文件
    pagespeed EnableFilters combine_css;
    # 把多个JavaScript文件合并成一个JavaScript文件
    pagespeed EnableFilters combine_javascript;
    # 删除带默认属性的标签
    pagespeed EnableFilters elide_attributes;
    # 改善资源的可缓存性
    pagespeed EnableFilters extend_cache;
    # 更换被导入文件的@import，精简CSS文件
    pagespeed EnableFilters flatten_css_imports;
    pagespeed CssFlattenMaxBytes 5120;
    # 延时加载客户端看不见的图片
    pagespeed EnableFilters lazyload_images;
    # 启用JavaScript缩小机制
    pagespeed EnableFilters rewrite_javascript;
    # 启用图片优化机制,可能会压缩你的logo
    # pagespeed EnableFilters rewrite_images;
    # 预解析DNS查询
    pagespeed EnableFilters insert_dns_prefetch;
    # 重写CSS，首先加载渲染页面的CSS规则
    pagespeed EnableFilters prioritize_critical_css;

    #缓存设置
    proxy_cache_path /data/www/cache levels=1:2 keys_zone=one:10m max_size=500m inactive=24h use_temp_path=off;
    # proxy_cache_key "$scheme$request_method$host$request_uri";

    # 开启gzip
    gzip on;
    # 启用gzip压缩的最小文件，小于设置值的文件将不会压缩
    gzip_min_length 1k;
    # gzip 压缩级别，1-10，数字越大压缩的越好，也越占用CPU时间，后面会有详细说明
    gzip_comp_level 2;
    # 进行压缩的文件类型。javascript有多种形式。其中的值可以在 mime.types 文件中找到。
    gzip_types     text/plain application/javascript application/x-javascript text/javascript text/css application/xml application/xml+rss application/json;
    # 是否在http header中添加Vary: Accept-Encoding，建议开启
    gzip_vary on;
    gzip_proxied   expired no-cache no-store private auth;
    # 禁用IE 6 gzip
    gzip_disable "MSIE [1-6]\.";

    #ETag
    etag on;

  server {
    listen              80;
    listen              [::]:80;
    server_name         zinai.xyz www.zinai.xyz;
    return 301          https://zinai.xyz$request_uri;
    return 301          https://www.zinai.xyz$request_uri;
    }

# Settings for a TLS enabled server.

   server {
       listen       443 ssl http2 default_server;
       listen       [::]:443 ssl http2 default_server;
       server_name  zinai.xyz www.zinai.xyz;
       root         /path/to/yoursite;

       ssl_certificate "/path/to/yourcrt";
       ssl_certificate_key "/path/to/yourkey";
       ssl_session_cache shared:SSL:10m;
       ssl_session_timeout  10m;
       ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #按照这个协议配置
       ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; #按照这个套件配置
       ssl_prefer_server_ciphers on;

       pagespeed SslCertDirectory /etc/pki/tls/certs;
       pagespeed SslCertFile /etc/pki/tls/cert.pem;

       # Load configuration files for the default server block.
       include /etc/nginx/default.d/*.conf;

       location ~ "\.pagespeed\.([a-z]\.)?[a-z]{2}\.[^.]{10}\.[^.]+" {
        add_header "" "";
        }

        location ~ "^/pagespeed_static/" { }
        location ~ "^/ngx_pagespeed_beacon$" { }

        location / {
            proxy_cache one;
            proxy_cache_valid  200 206 304 301 302 10d;
            proxy_cache_key $uri;
            proxy_set_header Host $host:$server_port;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        #404公益
       error_page 404 /404.html;
        location = /404.html {
          root /path/to/your404page;
        }

       error_page 500 502 503 504 /50x.html;
           location = /50x.html {
       }
   }

}