github/v2ray-examples
1
0
Fork 0
mirror of https://github.com/v2fly/v2ray-examples.git synced 2025-01-19 06:19:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add comments and configuration

Browse Source
This commit is contained in:
q158073378252010 2017-12-13 01:50:41 +08:00 committed by GitHub
parent 080cc162e0
commit 0daec119b3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 35 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
websocket+Nginx+TLS/Nginx.config
View File

@ -18,9 +18,10 @@
# Default server configuration # Default server configuration
# #
#####兼容客户端Firefox 27, Chrome 30, IE 11 on Windows 7, Edge, Opera 17, Safari 9, Android 5.0, and Java 8
server { server {
#listen 80 default_server; #listen 80 default_server;
listen 127.0.0.1:80;
#listen [::]:80 default_server; #listen [::]:80 default_server;
# SSL configuration # SSL configuration
@ -39,27 +40,49 @@ server {
# #
# include snippets/snakeoil.conf; # include snippets/snakeoil.conf;
listen 127.0.0.1:80 default_server;
server_name domain.Name; server_name domain.Name;
return 301 https://$server_name/$request_uri; return 301 https://$host/$request_uri;
} }
server { server {
#listen 443 ssl http2; #listen 443 ssl http2;
#listen [::]:443 ssl; #listen [::]:443 ssl;
listen 127.0.0.1:443 ssl; #要开启HTTP/2需要nginx版本在1.10.0以上且需要openssl版本在1.0.2以上编译
ssl on; #可以使用 nginx -V 检查
listen 127.0.0.1:443 ssl http2;
#证书配置
ssl_certificate PATH; ssl_certificate PATH;
ssl_certificate_key PATH; ssl_certificate_key PATH;
#openssl dhparam out dhparam.pem 2048
#openssl dhparam out dhparam.pem 4096
ssl_dhparam /home/acme/data/dhparam.pem;
ssl_session_cache shared:SSL:10m; ssl_session_cache shared:SSL:10m;
ssl_session_timeout 5m; ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_session_tickets off;
ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"; #屏蔽不安全的加密方式
#https://nginx.org/en/docs/http/ngx_http_ssl_module.html
ssl_protocols TLSv1.2;
###openssl ciphers
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; #屏蔽不安全的加密方式
ssl_prefer_server_ciphers on;
# HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
#
###测试前请使用较少的时间 此处以从 15768000 >>> 15
###https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/
#add_header Strict-Transport-Security max-age=15;
#openssl dhparam out dhparam.pem 2048
#openssl dhparam out dhparam.pem 4096
#ssl_dhparam /home/acme/data/dhparam.pem;
# OCSP Stapling ---
# fetch OCSP records from URL in ssl_certificate and cache them
#有条件就开
#ssl_stapling on;
#ssl_stapling_verify on;
root /var/www/html; root /var/www/html;
# Add index.php to the list if you are using PHP # Add index.php to the list if you are using PHP
@ -74,7 +97,9 @@ server {
proxy_set_header Connection "upgrade"; proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host; proxy_set_header Host $http_host;
#host判断
if ($http_host = "domain.Name" ) { if ($http_host = "domain.Name" ) {
#v 监听端口
proxy_pass http://127.0.0.1:10086; proxy_pass http://127.0.0.1:10086;
} }
} }