07.Nginx_Config.md

title
Nginx 使用 Nginx 访问 Http Https 配置文件

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
  #listen 80 default_server;
  #listen [::]:80 default_server;

  # SSL configuration
  #
  # listen 443 ssl default_server;
  # listen [::]:443 ssl default_server;
  #
  # Note: You should disable gzip for SSL traffic.
  # See: https://bugs.debian.org/773332
  #
  # Read up on ssl_ciphers to ensure a secure configuration.
  # See: https://bugs.debian.org/765782
  #
  # Self signed certs generated by the ssl-cert package
  # Don't use them in a production server!
  #
  # include snippets/snakeoil.conf;

  #root /var/www/html;

  # Add index.php to the list if you are using PHP
  #index index.html index.htm index.nginx-debian.html;


  listen 443 ssl;
  server_name www.achinesepainter.com;

  keepalive_timeout   70;
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

  ssl_certificate      cert/2303054_www.achinesepainter.com.pem;
  ssl_certificate_key  cert/2303054_www.achinesepainter.com.key;

  # 储存SSL会话的缓存type和大小
  ssl_session_cache    shared:SSL:1m;
  ssl_session_timeout 5m;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  # 为建立安全连接，服务器所允许的密码格式列表
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
  # 依赖SSLv3和TLSv1协议的服务器密码将优先于客户端密码
  ssl_prefer_server_ciphers  on;

  location / {
      proxy_pass http://127.0.0.1:5000;

      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Real-IP         $remote_addr;
      proxy_set_header X-Forwarded-Host  $host;
      proxy_set_header X-Forwarded-Port  $server_port;

      access_log /var/log/nginx/access.log;
      error_log  /var/log/nginx/error.log;
      # First attempt to serve request as file, then
      # as directory, then fall back to displaying a 404.
      try_files $uri $uri/ =404;
  }


  # pass PHP scripts to FastCGI server
  #
  #location ~ \.php$ {
  #	include snippets/fastcgi-php.conf;
  #
  #	# With php-fpm (or other unix sockets):
  #	fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
  #	# With php-cgi (or other tcp sockets):
  #	fastcgi_pass 127.0.0.1:9000;
  #}

  # deny access to .htaccess files, if Apache's document root
  # concurs with nginx's one
  #
  #location ~ /\.ht {
  #	deny all;
  #}
}


# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
server {
  listen 80;
  server_name www.achinesepainter.com;

  location / {
      proxy_pass http://127.0.0.1:5000;

      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Real-IP         $remote_addr;
      proxy_set_header X-Forwarded-Host  $host;
      proxy_set_header X-Forwarded-Port  $server_port;

      access_log /var/log/nginx/access.log;
      error_log  /var/log/nginx/error.log;
      try_files $uri $uri/ =404;
  }
}

部署