修改 域名.com.conf、偽靜態 rewrite

修改 域名.com.conf、偽靜態 rewrite

--------------------------
修改 域名.com.conf
--------------------------

vi /etc/nginx/sites-available/域名.com.conf

之前的步驟，有寫幾行，全部刪除，更改為

server {
	listen 443 ssl;
	http2 on;
	server_name 域名.com;

	root /var/www/域名.com;
	index index.html index.htm index.php default.html default.htm default.php;

	ssl_certificate /etc/nginx/ssl/fullchain.cer;
	ssl_certificate_key /etc/nginx/ssl/域名.com.key;
	ssl_trusted_certificate /etc/nginx/ssl/chain.cer;


	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_session_cache shared:SSL:10m;
	ssl_session_timeout 1d;

	ssl_prefer_server_ciphers on;

	ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';

	#暫時關掉OCSP
	ssl_stapling off;
	ssl_stapling_verify off;
	#ssl_stapling on;
	#ssl_stapling_verify on;

	resolver 1.1.1.1 8.8.8.8 valid=300s;
	resolver_timeout 10s;

    include rewrite/ips.conf;

	#可提升握手效能
	ssl_ecdh_curve X25519:secp384r1;

	add_header Strict-Transport-Security "max-age=31536000";
	add_header Content-Security-Policy "...";
	add_header X-Frame-Options "SAMEORIGIN";
	add_header X-Content-Type-Options "nosniff";
	add_header X-XSS-Protection "1; mode=block";

                location ~ \.php$ {
                    include snippets/fastcgi-php.conf;
                    fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
                }

                 brotli on;
                 brotli_types text/css text/x-component application/x-javascript application/javascript text/javascript text/x-js text/richtext image/svg+xml text/plain text/xsd text/xsl text/xml image/x-icon application/octet-stream;

                gzip on;
               gzip_types text/css text/x-component application/x-javascript application/javascript text/javascript text/x-js text/richtext image/svg+xml text/plain text/xsd text/xsl text/xml image/x-icon application/octet-stream;


        location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
        {
            expires      30d;
        }

        location ~ .*\.(js|css)?$
        {
            expires      12h;
        }

        location ^~ /.well-known/acme-challenge/ {
            allow all;
        }

        location ~ /\.
        {
            deny all;
        }
}





ESC儲存並離開
:wq




--------------------------
偽靜態 rewrite
--------------------------

建立偽靜態 rewrite 存放的目錄
mkdir -p /etc/nginx/rewrite


寫入ips論壇的偽靜態
vi /etc/nginx/rewrite/ips.conf


location / {
        try_files  $uri $uri/ /index.php;
  }

location ~^(/page/).*(.php)$ {
    try_files  $uri $uri/ /index.php;
}

location /api/ {
  if (!-e $request_filename){
    rewrite ^/api/(.*)$ /api/index.php;
  }
}



ESC儲存並離開
:wq





------------------
重新載入Nginx
------------------

重新載入Nginx

nginx -t


nginx -s reload

本帖最后于1小时前1小时，由Jack编辑

卡了好幾天在 PC/手機 的瀏覽器顯示 ERR_SSL_PROTOCOL_ERROR

有部分還殘留著Nginx的 HTTP/3 QUIC配置

與acme.sh不正確的配置

最後還是暫時關掉OCSP

ssl_stapling off;

ssl_stapling_verify off;