linux配置 nginx

# Generated by nginxconfig.io
# https://nginxconfig.io/?0.domain=131071.tk&0.path=%2Fusr%2Fshare%2Fnginx%2Fhtml&0.non_www=false&0.redirect=false&0.cert_type=custom&0.php=false&0.proxy&0.proxy_path=%2Fa&0.proxy_pass=http:%2F%2F127.0.0.1:3001&0.root=false&0.fallback_html&0.access_log_domain&0.error_log_domain&ssl_profile=C&file_structure=unified&symlink=false

user www-data;
pid /run/nginx.pid;
worker_processes auto;
worker_rlimit_nofile 65535;

events {
	multi_accept on;
	worker_connections 65535;
}

http {
	charset utf-8;
	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;
	server_tokens off;
	log_not_found off;
	types_hash_max_size 2048;
	client_max_body_size 16M;

	# MIME
	include mime.types;
	default_type application/octet-stream;

	# logging
	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log warn;

	# SSL
	ssl_session_timeout 1d;
	ssl_session_cache shared:SSL:50m;
	ssl_session_tickets off;

	# Diffie-Hellman parameter for DHE ciphersuites
	ssl_dhparam /etc/nginx/dhparam.pem;

	# OWASP C (Widest Compatibility) configuration
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
	ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
	ssl_prefer_server_ciphers on;

	# OCSP Stapling
	ssl_stapling on;
	ssl_stapling_verify on;
	resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
	resolver_timeout 2s;

	# load configs
	# include /etc/nginx/conf.d/*.conf;

	# www.131071.tk
	server {
		listen 443 ssl http2;
		listen [::]:443 ssl http2;
	
		server_name www.131071.tk;
	
		# SSL
		ssl_certificate /etc/nginx/ssl/131071.tk.crt;
		ssl_certificate_key /etc/nginx/ssl/131071.tk.key;
	
		# logging
		access_log /var/log/nginx/131071.tk.access.log;
		error_log /var/log/nginx/131071.tk.error.log warn;
	

        root   /usr/share/nginx/html;
        index  index.html index.htm;

      error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
		# reverse proxy
		location /a {
			proxy_pass http://127.0.0.1:3001/;
			proxy_http_version	1.1;
			proxy_cache_bypass	$http_upgrade;
			
			proxy_set_header Upgrade			$http_upgrade;
			proxy_set_header Connection 		"upgrade";
			proxy_set_header Host				$host;
			proxy_set_header X-Real-IP			$remote_addr;
			proxy_set_header X-Forwarded-For	$proxy_add_x_forwarded_for;
			proxy_set_header X-Forwarded-Proto	$scheme;
			proxy_set_header X-Forwarded-Host	$host;
			proxy_set_header X-Forwarded-Port	$server_port;
		}
		location /b {
			proxy_pass http://127.0.0.1:3001/;
			proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
		}
		# security headers
		add_header X-Frame-Options "SAMEORIGIN" always;
		add_header X-XSS-Protection "1; mode=block" always;
		add_header X-Content-Type-Options "nosniff" always;
		add_header Referrer-Policy "no-referrer-when-downgrade" always;
		add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
		add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
		
		# . files
		location ~ /\.(?!well-known) {
			deny all;
		}
		
		# favicon.ico
		location = /favicon.ico {
			log_not_found off;
			access_log off;
		}
		
		# robots.txt
		location = /robots.txt {
			log_not_found off;
			access_log off;
		}
		
		# gzip
		gzip on;
		gzip_vary on;
		gzip_proxied any;
		gzip_comp_level 6;
		gzip_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;
	}
	
	# HTTP redirect
	server {
		listen 80;
		listen [::]:80;
	
		server_name .131071.tk;
	
		return 301 https://www.131071.tk$request_uri;
	}
}

# HTTPS: create Diffie-Hellman keys
openssl dhparam -dsaparam -out /etc/nginx/dhparam.pem 2048

/etc/nginx/ssl/131071.tk.crt

/etc/nginx/ssl/131071.tk.key

sudo nginx -t

#重启

sudo nginx -s reload