CloudQuery 安全系列（一）： Http 与 Https

sudo mkdir /tmp/ssl

worker_processes 1;

events{

worker_connections 1024;

}

http{

include mime.types;

default_type application/octet-stream;

sendfile on;

keepalive_timeout 65;

gzip on;

gzip_min_length 1k;

gzip_comp_level 5;

gzip_types text/plain application/javascript application/x-javascript test/javascript text/css text/xml;

gzip_disable "MSIE [1-6]\.";

gzip_vary on;

server {

listen   80;

server_name   www.cqcommunity.club;

rewrite ^ https://$http_host$request_uri? permanent;   # force redirect http to https

#return 301 https://$http_host$request_uri;

}

server {

listen 443 ssl;

charset utf-8;

ssl_certificate /etc/nginx/ssl/nginx.crt; # 这里填自己的证书

ssl_certificate_key /etc/nginx/ssl/nginx.key; # 这里填自己的证书

keepalive_timeout   70;

server_name www.cqcommunity.club;   # 这里填自己的域名

server_tokens off;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;

access_log   /var/log/nginx/wiki.xby1993.net.access.log;

error_log   /var/log/nginx/wiki.xby1993.net.error.log;

location / {

proxy_set_header Host $host;

proxy_set_header Cookie $http_cookie;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_pass http://172.17.0.1:9898;   #这里的地址通过容器访问宿主机的ip ,9898是cloudquery使用的端口

proxy_set_header X-Forwarded-Proto $scheme;

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection "upgrade";

}

}

include servers/*;

}

# 下载 nginx 镜像

docker pull nginx

# 启动 nginx 并监听 80 和 443 端口

docker run --name cloudquery_https_nginx -p 80:80 -p 443:443 -d nginx

# 容器内部创建文件夹,用来存放证书文件

docker exec -t cloudquery_https_nginx sh -c 'mkdir /etc/nginx/ssl'

# 将刚才生成的证书文件复制到容器内部

docker cp /tmp/ssl/nginx.key cloudquery_https_nginx:/etc/nginx/ssl/

docker cp /tmp/ssl/nginx.crt cloudquery_https_nginx:/etc/nginx/ssl/

docker cp /tmp/ssl/nginx.conf cloudquery_https_nginx:/etc/nginx/ssl/

# 重启容器

docker restart cloudquery_https_nginx

# 如果你使用的备案过的域名,则不必添加这个配置

sudo sh -c "echo '${ip} www.cqcommunity.club' >> /etc/hosts"