4 changed files with 0 additions and 182 deletions
@ -1,35 +0,0 @@ |
|||||
version: '3.8' |
|
||||
|
|
||||
services: |
|
||||
marketing-site: |
|
||||
build: |
|
||||
context: . |
|
||||
dockerfile: Dockerfile |
|
||||
expose: |
|
||||
- "3000" |
|
||||
environment: |
|
||||
- NODE_ENV=production |
|
||||
restart: unless-stopped |
|
||||
container_name: marketing-site-https |
|
||||
networks: |
|
||||
- app-network |
|
||||
|
|
||||
nginx: |
|
||||
image: nginx:alpine |
|
||||
container_name: nginx-https |
|
||||
ports: |
|
||||
- "80:80" |
|
||||
- "443:443" |
|
||||
volumes: |
|
||||
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro |
|
||||
- ./ssl:/etc/nginx/ssl:ro |
|
||||
depends_on: |
|
||||
- marketing-site |
|
||||
restart: unless-stopped |
|
||||
networks: |
|
||||
- app-network |
|
||||
|
|
||||
networks: |
|
||||
app-network: |
|
||||
driver: bridge |
|
||||
|
|
||||
@ -1,76 +0,0 @@ |
|||||
events { |
|
||||
worker_connections 1024; |
|
||||
} |
|
||||
|
|
||||
http { |
|
||||
# 上游服务器配置 |
|
||||
upstream marketing-site { |
|
||||
server marketing-site:3000; |
|
||||
} |
|
||||
|
|
||||
# HTTP 重定向到 HTTPS |
|
||||
server { |
|
||||
listen 80; |
|
||||
server_name _; |
|
||||
|
|
||||
# 允许 Let's Encrypt 验证 |
|
||||
location /.well-known/acme-challenge/ { |
|
||||
root /var/www/certbot; |
|
||||
} |
|
||||
|
|
||||
# 其他所有请求重定向到 HTTPS |
|
||||
location / { |
|
||||
return 301 https://$host$request_uri; |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
# HTTPS 服务器配置 |
|
||||
server { |
|
||||
listen 443 ssl http2; |
|
||||
server_name _; |
|
||||
|
|
||||
# SSL 证书配置 |
|
||||
ssl_certificate /etc/nginx/ssl/cert.pem; |
|
||||
ssl_certificate_key /etc/nginx/ssl/key.pem; |
|
||||
|
|
||||
# SSL 安全配置 |
|
||||
ssl_protocols TLSv1.2 TLSv1.3; |
|
||||
ssl_ciphers HIGH:!aNULL:!MD5; |
|
||||
ssl_prefer_server_ciphers on; |
|
||||
ssl_session_cache shared:SSL:10m; |
|
||||
ssl_session_timeout 10m; |
|
||||
|
|
||||
# 安全头 |
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; |
|
||||
add_header X-Frame-Options "SAMEORIGIN" always; |
|
||||
add_header X-Content-Type-Options "nosniff" always; |
|
||||
add_header X-XSS-Protection "1; mode=block" always; |
|
||||
|
|
||||
# 代理配置 |
|
||||
location / { |
|
||||
proxy_pass http://marketing-site; |
|
||||
proxy_http_version 1.1; |
|
||||
proxy_set_header Upgrade $http_upgrade; |
|
||||
proxy_set_header Connection 'upgrade'; |
|
||||
proxy_set_header Host $host; |
|
||||
proxy_set_header X-Real-IP $remote_addr; |
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
|
||||
proxy_set_header X-Forwarded-Proto $scheme; |
|
||||
proxy_cache_bypass $http_upgrade; |
|
||||
|
|
||||
# 超时设置 |
|
||||
proxy_connect_timeout 60s; |
|
||||
proxy_send_timeout 60s; |
|
||||
proxy_read_timeout 60s; |
|
||||
} |
|
||||
|
|
||||
# 静态文件缓存 |
|
||||
location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ { |
|
||||
proxy_pass http://marketing-site; |
|
||||
proxy_cache_valid 200 30d; |
|
||||
expires 30d; |
|
||||
add_header Cache-Control "public, immutable"; |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
@ -1,9 +0,0 @@ |
|||||
*.pem |
|
||||
*.key |
|
||||
*.crt |
|
||||
*.cert |
|
||||
*.p12 |
|
||||
*.pfx |
|
||||
!README.md |
|
||||
!.gitignore |
|
||||
|
|
||||
@ -1,62 +0,0 @@ |
|||||
# SSL 证书目录 |
|
||||
|
|
||||
此目录用于存放 SSL 证书文件。 |
|
||||
|
|
||||
## 文件要求 |
|
||||
|
|
||||
请将以下文件放置在此目录中: |
|
||||
|
|
||||
- `cert.pem` - SSL 证书文件(或 `fullchain.pem`) |
|
||||
- `key.pem` - SSL 私钥文件 |
|
||||
|
|
||||
## 获取 SSL 证书 |
|
||||
|
|
||||
### 方式 1: 使用 Let's Encrypt (免费) |
|
||||
|
|
||||
1. 安装 certbot: |
|
||||
```bash |
|
||||
# Ubuntu/Debian |
|
||||
sudo apt-get update |
|
||||
sudo apt-get install certbot |
|
||||
|
|
||||
# 或使用 Docker |
|
||||
docker run -it --rm -v $(pwd)/ssl:/etc/letsencrypt certbot/certbot certonly --standalone |
|
||||
``` |
|
||||
|
|
||||
2. 获取证书后,将证书文件复制到此目录: |
|
||||
```bash |
|
||||
# Let's Encrypt 证书通常在 /etc/letsencrypt/live/your-domain.com/ |
|
||||
cp /etc/letsencrypt/live/your-domain.com/fullchain.pem ./ssl/cert.pem |
|
||||
cp /etc/letsencrypt/live/your-domain.com/privkey.pem ./ssl/key.pem |
|
||||
``` |
|
||||
|
|
||||
### 方式 2: 使用自签名证书 (仅用于测试) |
|
||||
|
|
||||
```bash |
|
||||
# 生成自签名证书(仅用于开发测试) |
|
||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ |
|
||||
-keyout ssl/key.pem \ |
|
||||
-out ssl/cert.pem \ |
|
||||
-subj "/C=CN/ST=State/L=City/O=Organization/CN=localhost" |
|
||||
``` |
|
||||
|
|
||||
### 方式 3: 使用商业证书 |
|
||||
|
|
||||
将您购买的 SSL 证书文件重命名为: |
|
||||
- 证书文件 → `cert.pem` |
|
||||
- 私钥文件 → `key.pem` |
|
||||
|
|
||||
## 文件权限 |
|
||||
|
|
||||
确保私钥文件权限正确(仅所有者可读): |
|
||||
```bash |
|
||||
chmod 600 ssl/key.pem |
|
||||
chmod 644 ssl/cert.pem |
|
||||
``` |
|
||||
|
|
||||
## 注意事项 |
|
||||
|
|
||||
- ⚠️ **不要将私钥文件提交到版本控制系统** |
|
||||
- 生产环境请使用有效的 SSL 证书 |
|
||||
- 自签名证书会导致浏览器显示安全警告 |
|
||||
|
|
||||
Loading…
Reference in new issue