github/v2ray-examples
1
0
Fork 0
mirror of https://github.com/v2fly/v2ray-examples.git synced 2025-11-04 11:55:38 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4 from q158073378252010/2017.12.12

Browse Source 
Add comments and configuration
This commit is contained in:
KiriKira
2017-12-13 16:34:55 +08:00
committed by GitHub
parent 3519e6b4ed 288c6e6759
commit 72f5017930
1 changed files with 37 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
websocket+Nginx+TLS/Nginx.config
View File

@@ -18,9 +18,12 @@
# Default server configuration
#
#####兼容客户端Firefox 27, Chrome 30, IE 11 on Windows 7, Edge, Opera 17, Safari 9, Android 5.0, and Java 8
#####此文件的真身路径是 /etc/nginx/sites-available/default 如果你修改了 /etc/nginx/nginx.conf 中的内容，但
#####/etc/nginx/sites-available/default 中的 参数 与 前者 重叠 那么 会 遵从 后者
server {
#listen 80 default_server;
listen 127.0.0.1:80;
#listen [::]:80 default_server;
# SSL configuration
@@ -39,27 +42,49 @@ server {
#
# include snippets/snakeoil.conf;
listen 127.0.0.1:80 default_server;
server_name domain.Name;
return 301 https://$server_name/$request_uri;
return 301 https://$host/$request_uri;
}
server {
#listen 443 ssl http2;
#listen 443 ssl http2;
#listen [::]:443 ssl;
listen 127.0.0.1:443 ssl;
ssl on;
#要开启HTTP/2需要nginx版本在1.10.0以上且需要openssl版本在1.0.2以上编译
#可以使用 nginx -V 检查
listen 127.0.0.1:443 ssl http2;
#证书配置
ssl_certificate PATH;
ssl_certificate_key PATH;
#openssl dhparam out dhparam.pem 2048
#openssl dhparam out dhparam.pem 4096
ssl_dhparam /home/acme/data/dhparam.pem;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"; #屏蔽不安全的加密方式
ssl_session_tickets off;
#https://nginx.org/en/docs/http/ngx_http_ssl_module.html
ssl_protocols TLSv1.2;
###openssl ciphers
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; #屏蔽不安全的加密方式
ssl_prefer_server_ciphers on;
# HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
#
###测试前请使用较少的时间 此处以从 15768000 >>> 15
###https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/
#add_header Strict-Transport-Security max-age=15;
#openssl dhparam out dhparam.pem 2048
#openssl dhparam out dhparam.pem 4096
#ssl_dhparam /home/acme/data/dhparam.pem;
# OCSP Stapling ---
# fetch OCSP records from URL in ssl_certificate and cache them
#有条件就开
#ssl_stapling on;
#ssl_stapling_verify on;
root /var/www/html;
# Add index.php to the list if you are using PHP
@@ -74,7 +99,9 @@ server {
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
#host判断
if ($http_host = "domain.Name" ) {
#v 监听端口
proxy_pass http://127.0.0.1:10086;
}
}