openresty - 簡書

1媒殉、openResty安裝

centos 安裝

    ### yum安裝
    yum -y install readline-devel pcre-devel openssl-devel
    sudo yum install -y yum-utils
    sudo yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo
    sudo yum install -y openresty
    
    ### 源碼編譯
    #  172.24.138.8 
    yum install -y gcc gcc-c++ pcre-devel openssl openssl-devel
    cd /data
    curl -O http://mirrors.d.com/software/openresty/1.13.6/openresty-1.13.6.1.tar.gz
    tar -zxvf openresty-1.13.6.1.tar.gz
    cd openresty-1.13.6.1
    #./configure 
    # 指定libressl  tls1.3  http2
    ./configure  --with-openssl=/usr/local/libressl-2.6.4 --with-openssl-opt=enable-tls1_3 --with-http_v2_module
    make 
    sudo  make install 

    #默認安裝在/usr/local/openresty目錄下

    #將conf  和  log目錄移到/data/openresty下
    mkdir -p /data/openresty
    cp -R /usr/local/openresty/nginx/conf  /data/openresty
    rm -rf /usr/local/openresty/nginx/conf
    ln -s /data/openresty/conf /usr/local/openresty/nginx/conf

    mkdir -p /data/openresty/logs
    rm -rf /usr/local/openresty/nginx/logs
    ln -s /data/openresty/logs /usr/local/openresty/nginx/logs

    #啟動
    /usr/local/openresty/nginx/sbin/nginx
    #檢查配置是否正確
    # /usr/local/openrestry/nginx/sbin/nginx  -t
    #重新加載配置文件
    # /usr/local/openrestry/nginx/sbin/nginx  -s reload

2诡壁、openresty配置

nginx匹配規(guī)則

=       # 精確匹配
~       # 正則匹配  區(qū)分大小寫
~*      # 正則匹配 不區(qū)分大小寫
^~      # 普通字符匹配，

location  = / {
 # 只匹配"/".
 [ configuration A ] 
}
location  / {
 # 匹配任何請求，因為所有請求都是以"/"開始
 # 但是更長字符匹配或者正則表達式匹配會優(yōu)先匹配
 [ configuration B ] 
}
location ^~ /images/ {
 # 匹配任何以 /images/ 開始的請求娜饵，并停止匹配 其它location
 [ configuration C ] 
}
location ~* .(gif|jpg|jpeg)$ {
 # 匹配以 gif, jpg, or jpeg結(jié)尾的請求. 
 # 但是所有 /images/ 目錄的請求將由 [Configuration C]處理.   
 [ configuration D ] 
}

服務端獲得客戶端的真實ip

location /{  
                proxy_pass http://192.168.1.111:8080;  
                proxy_set_header Host $host;  
                proxy_set_header X-Real-IP $remote_addr;  
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }  

## node 
var real_ip = req.get("X-Real-IP") || req.get("X-Forwarded-For") || req.ip;

openresty 隱藏服務器名稱及版本，復寫http server頭

http{
    server_tokens off;  #隱藏server版本
}

location / {
        #復寫http server
        header_filter_by_lua 'ngx.header.server = "apache/2.4"';
}

圖片服務官辈，靜態(tài)文件

    server {
        listen       80;
        server_name  10.0.12.75;

        #charset koi8-r;
        #access_log  logs/host.access.log  main;
        ###  path  /data/image/test.jpg 

        location /image {

            add_header 'Access-Control-Allow-Origin' '*';
            add_header Cache-Control no-store;

            root   /data/;
            autoindex on;   #預覽
            #index  index.html index.htm;
        }
    }

配置強制跳轉(zhuǎn)到https

server{

    listen 80;
    server_name www.m.com;
    return 301 https://$server_name/$request_uri;

}

server{
    listen 443 ssl http2;
    server_name www.m.com;
    ssl on;
    ssl_certificate cert/www.m.com.crt;
    ssl_certificate_key cert/www.m.com.key;
    #內(nèi)部跳轉(zhuǎn) 307
    #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
    ssl_protocols  TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:!3DES:!DHE";
    ssl_prefer_server_ciphers on;

    location / {

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        expires 1h;
        root  /data/volume/DMP/frontend/dist;
        error_page  404 400           /404.html;
    }
    #location ~* .(js|jpg|jpeg)$ {
    #   root  /data/volume/DMP/frontend/dist;
    #    error_page  404 400           /404.html;
    #    expires 3h;
    #}

    location = /404.html {
            root html;
    }
}

注意：請求的url匹配 listen端口和server_name箱舞，如果能匹配端口但是沒有server_name與之對應的遍坟，會匹配第一個listen端口，忽視server_name晴股，如上面的配置愿伴，直接訪問http://ip會跳轉(zhuǎn)到https://www.m.com
注意：chrome瀏覽器在開發(fā)者模式選中disable cache情況下，301跳轉(zhuǎn)仍然繼續(xù)會用 cache from disk电湘，需手動清除緩存 ctrl + shift +delete公般，chrome的緩存可通過chrome://net-internals/查看。

內(nèi)部跳轉(zhuǎn)到https

在網(wǎng)站全站HTTPS后胡桨，如果用戶手動敲入網(wǎng)站的HTTP地址官帘，或者從其它地方點擊了網(wǎng)站的HTTP鏈接，通常依賴于服務器端的301/302重定向跳轉(zhuǎn)才能使用HTTPS服務昧谊。而第一次的HTTP請求就有可能被劫持喳魏，導致請求無法到達服務器闯狱，從而構(gòu)成HTTPS降級劫持。這個問題目前可以通過HSTS(HTTP Strict Transport Security，RFC6797)來解決碴开。
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";

3当辐、緩存

nginx設(shè)置瀏覽器緩存
nginx設(shè)置代理緩存

4鼻种、https

openssl安裝

#下載openssl
curl -O https://www.openssl.org/source/openssl-1.0.2n.tar.gz

#解壓
#指定安裝目錄
./config --prefix=/usr/local/openssl
./config -t
make
make install

#將/usr/local/openssl/bin添加到環(huán)境變量
# vim  /etc/profile
export OPENSSL_HOME=/usr/local/openssl
export PATH=$PATH:$OPENSSL_HOME/bin
# source /etc/profile

# openssl version

openssl實現(xiàn)私有CA

參考 https://www.cnblogs.com/AloneSword/p/4656492.html

TLS1.3

TLS1.3是一種新的加密協(xié)議立倍，我們把使互聯(lián)網(wǎng)實現(xiàn)安全通信的基礎(chǔ)性技術(shù)稱為傳輸層安全協(xié)議（TLS）。TLS是安全套接層協(xié)議（SSL）的進化版本狗唉，SSL是由Netscape公司在1990年代研發(fā)的初烘。
參考 http://www.reibang.com/p/365cb6057387