Created
February 24, 2019 12:01
-
-
Save qnnnnez/497d4af4b9a141e27cc8ec69e2505f8a to your computer and use it in GitHub Desktop.
nginx configuration for tls-alpn-01
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# using https://github.com/Neilpang/acme.sh | |
acme.sh --issue -d your.domain.1 --alpn --tlsport 30443 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
stream { | |
map $ssl_preread_alpn_protocols $is_acme { | |
~\bacme-tls/1\b 1; | |
default 0; | |
} | |
map $ssl_preread_server_name $name_valid { | |
your.domain.1 1; | |
your.domain.2 1; | |
default 0; | |
} | |
map $is_acme$name_valid $backend { | |
00 unwrap; | |
01 nginx-https; | |
10 unwrap; | |
11 unwrap; | |
default unwrap; | |
} | |
map $is_acme$name_valid $unwrap_backend { | |
10 acme; | |
11 acme; | |
default hide; | |
} | |
upstream unwrap { | |
server unix:/tmp/nginx-stream-proxy.sock; | |
} | |
upstream acme { | |
server 127.0.0.1:30443; | |
} | |
upstream nginx-https { | |
server unix:/tmp/nginx-https.sock; | |
} | |
upstream hide { | |
server www.xuexi.cn:443; # do not serve default cert if sni name unknown | |
} | |
server { | |
listen 443; | |
ssl_preread on; | |
proxy_protocol on; | |
proxy_pass $backend; | |
} | |
server { | |
# unwrap proxy protocol | |
listen unix:/tmp/nginx-stream-proxy.sock proxy_protocol; | |
ssl_preread on; | |
proxy_protocol off; | |
proxy_pass $unwrap_backend; | |
} | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
server { | |
server_name your.domain.1; | |
listen listen unix:/tmp/nginx-https.sock ssl proxy_protocol; | |
set_real_ip_from unix:; | |
real_ip_header proxy_protocol; | |
# ssl and other configurations | |
... | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment