nginx配置参考

Tue, 23 Dec 2025 00:00:00 +0800

nginx配置文件位于/etc/nginx目录，其中核心配置是/etc/nginx/nginx.conf，一般默认加载/etc/nginx/sites-enabled/目录中的站点配置。

站点配置文件内容可参考以下内容。

# 站点配置: example.com

# 站点证书 example.com *.example.com
ssl_certificate     /path/to/cert/example.com/cert.pem;
ssl_certificate_key /path/to/cert/example.com/key.pem;

# 支持常规连接和WebSocket连接
map $http_connection $connection_upgrade {
  "~*Upgrade" $http_connection;
  default keep-alive;
}

# HTTP服务 重定向到HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com *.example.com;
    return 301 https://$server_name$request_uri;
}

# example.com 站点服务
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name example.com;

    # 默认跳转到博客站(也可以直接跳转)
    location / {
        #add_header Content-Type 'text/plain; charset=utf-8';
        #return 200 'maybe you are lost, please visit: https://blog.example.com ?';
        return 302 https://example.com/blog;
    }
    location /blog {
        return 301 https://blog.example.com;
    }

    # 反向代理内部业务(仅接口代理)
    location /service-name/ {
        proxy_http_version 1.1;
        proxy_set_header   Host $host;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        # 配置方式与实际转发效果如下:
        # 带后缀`/`: https://exmaple.com/service-name/abc/def?g=123&h=456  -> http://127.0.0.1:12345/abc/def?g=123&h=456
        # 无后缀`/`: https://exmaple.com/service-name/abc/def?g=123&h=456  -> http://127.0.0.1:12345/service-name/abc/def?g=123&h=456
        proxy_pass         http://127.0.0.1:12345/;
    }
}

# ws.example.com 站点服务
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name ws.example.com;
    location / {
        add_header Content-Type 'text/plain; charset=utf-8';
        return 200 'hello, this is ws.example.com';
    }
    # 反向代理内部业务(接口+WebSocket)
    location /ws-path/ {
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection $connection_upgrade;
        proxy_set_header   Host $host;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        proxy_pass         http://127.0.0.1:12345;
    }
}

# grpc.example.com 站点服务
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name grpc.example.com;
    location / {
        add_header Content-Type 'text/plain; charset=utf-8';
        return 200 'hello, this is grpc.example.com';
    }
    # 反向代理内部业务(gRPC)
    location /<grpc-service-name>/ {
        grpc_pass        grpc://127.0.0.1:12345;
    }
}

# blog.example.com 站点服务
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name blog.example.com;
    root /path/to/blog/root;
    location / {
        index index.html;
    }
}

# pxy.example.com 站点服务
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name pxy.example.com;
    location / {
        proxy_redirect off;
        proxy_ssl_server_name on;
        proxy_pass https://jmsnet;
    }
}

# *.example.com 站点服务
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name *.example.com;
    error_page 404 = /error;
    location / {
        add_header Content-Type 'text/plain; charset=utf-8';
        return 200 'hello, goodbye';
    }
    location /error {
        add_header Content-Type 'text/plain; charset=utf-8';
        return 404 'maybe you are lost';
    }
}

代理配置

Fri, 12 Dec 2025 00:00:00 +0800

数据链路

大致数据链路如下图所示，基本思路是客户端经两级跳转访问服务端。

  sequenceDiagram
    Client->>In: 1. 客户端请求代理入口
    In->>Out: 2. 代理入口请求代理出口
    Out->>Server: 3. 代理出口访问目标服务
    Server->>Out: 4. 目标服务回复代理出口
    Out->>In: 5. 代理出口回复代理入口
    In->>Client: 6. 代理入口回复客户端

具备以下特点：

完整链路信息只有客户端得知，客户端看起来只是在访问In
只有In知道在访问Out，也只知道在访问Out，不知道实际目标
服务端只知道请求来自Out，不知道客户端存在

客户端配置

参考文档: dialer-proxy

代理节点部分核心配置如下:

proxies:
  - name: in  # 代理入口，常规配置
    type: ...
  - name: out # 代理出口，需要声明代理入口
    dialer-proxy: in
    type: ...

rules:
  - MATCH,out # 此处选择`out`节点

代理组部分核心配置如下:

proxy-groups:
  - name: PROXY # 默认代理策略，可以SAFE优先，也可以原生优先，推荐保证可用
    type: select
    proxies:
      - PROXY-SAFE
      - RAW
  - name: PROXY-CHEAP # 低计费策略，优先低倍率节点，推荐保证可用
    type: select / url-test / fallback
    proxies:
      - <node-name>
      - RAW
  - name: PROXY-SAFE # 稳定出口策略，不推荐自动回落
    type: select
    proxies:
      - <node-name>
  - name: dialer-in # 代理入口组，推荐保证可用且整体低延迟
    type: select / url-test / fallback
    hidden: true # 可以隐藏
    proxies:
      - <node-name>
  - name: RAW # 原生节点组
    type: select
    proxies:
      - <node-name>

服务端配置

# 代理服务端，以直连模式运行
mode: direct
listeners:
  # 服务协议：VMess
  # 传输方式：WebSocket 
  - name: vmess-ws&grpc
    type: vmess
    # 仅允许本机(反向代理)访问
    listen: 127.0.0.1
    # 服务端口
    port: 10800
    users:
      - username: 1
        uuid: <uuid>
        alterId: 0
    # WebSocket路径
    ws-path: /<websocket-path>/
    # gRPC服务名称
    grpc-service-name: <grpc-server-name>

# SSL证书配置
ssl_certificate     /path/to/cert.pem;
ssl_certificate_key /path/to/cert.key;

map $http_connection $connection_upgrade {
  "~*Upgrade" $http_connection;
  default keep-alive;
}

server {
    # 监听443端口，启用SSL加密，启用HTTP2(以支持gRPC)
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    # 服务器名称
    server_name <server-name>;
    # 常规站点配置
    location / {
        add_header Content-Type 'text/plain; charset=utf-8';
        return 200 'hello, this is my site';
    }
    # 反向代理WebSocket
    location /<websocket-path>/ {
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection $connection_upgrade;
        proxy_set_header   Host $host;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        proxy_pass         http://127.0.0.1:10800;
    }
    # 反向代理gRPC
    location /<grpc-server-name>/ {
        grpc_pass        grpc://127.0.0.1:10800;
    }
}

其他配置(客户端规则)

路由规则如下:

rules:
  # 拦截广告规则
  - RULE-SET,reject,REJECT
  # 直连私网、境内服务等
  - RULE-SET,private,DIRECT
  - RULE-SET,icloud,DIRECT
  - RULE-SET,apple,DIRECT
  - RULE-SET,direct,DIRECT
  - RULE-SET,lancidr,DIRECT
  - RULE-SET,cncidr,DIRECT
  - DOMAIN-SUFFIX,cn,DIRECT
  - DOMAIN-KEYWORD,-cn,DIRECT
  - GEOSITE,CN,DIRECT
  - GEOIP,LAN,DIRECT
  - GEOIP,CN,DIRECT
  # 本地共享、大流量传输优先低计费节点
  - RULE-SET,share,PROXY-CHEAP
  - RULE-SET,download,PROXY-CHEAP
  # 确保稳定出口的服务优先SAFE节点
  - RULE-SET,safe,PROXY-SAFE
  - RULE-SET,telegramcidr,PROXY-SAFE
  # 已知服务和无匹配默认代理访问
  - RULE-SET,gfw,PROXY
  - RULE-SET,proxy,PROXY
  - MATCH,PROXY

路由规则集合如下所示:
在线规则集合参考项目: Loyalsoldier/clash-rules