更新 proxy-openresty.sh
This commit is contained in:
lishichen committed
1 parent
c07c6f6055
commit
b09c10913a
2 files changed
+148
-85
No files matched your search
@@ -1,85 +0,0 @@
|
||||
#!/bin/bash
|
||||
export PATH=$PATH:/usr/sbin
|
||||
|
||||
# =================配置区域=================
|
||||
# 严格按照你的要求定义变量
|
||||
OPENRESTY_VERSION="1.27.1.2"
|
||||
OPENSSL_VERSION="3.6.0"
|
||||
# =========================================
|
||||
|
||||
# 设置遇到错误立即停止
|
||||
set -e
|
||||
|
||||
# 获取 CPU 核心数
|
||||
JOBS=$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 2)
|
||||
|
||||
echo "=== 准备编译 OpenResty ${OPENRESTY_VERSION} 与 OpenSSL ${OPENSSL_VERSION} ==="
|
||||
echo "=== 使用 ${JOBS} 个线程进行编译 ==="
|
||||
|
||||
# 0. 基础依赖检查 (简单提示)
|
||||
if [ -f /etc/debian_version ]; then
|
||||
echo "检测到 Debian/Ubuntu，建议安装: build-essential libpcre3-dev zlib1g-dev curl"
|
||||
elif [ -f /etc/redhat-release ]; then
|
||||
echo "检测到 CentOS/RHEL，建议安装: gcc gcc-c++ pcre-devel zlib-devel perl make curl"
|
||||
fi
|
||||
|
||||
# 1. 创建临时目录 (在用户主目录 ~ 下)
|
||||
# 使用 mktemp 在 $HOME 下创建安全目录
|
||||
WORK_DIR=$(mktemp -d -p "$HOME" -t openresty_build.XXXXXX)
|
||||
echo "=== 进入临时工作目录: ${WORK_DIR} ==="
|
||||
cd "${WORK_DIR}"
|
||||
|
||||
# 2. 下载源码
|
||||
echo "=== 正在下载源码... ==="
|
||||
curl -fL --retry 5 -O "https://openresty.org/download/openresty-${OPENRESTY_VERSION}.tar.gz"
|
||||
curl -fL --retry 5 -O "https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz"
|
||||
|
||||
# 3. 解压源码
|
||||
echo "=== 正在解压源码... ==="
|
||||
tar -zxvf "openresty-${OPENRESTY_VERSION}.tar.gz"
|
||||
tar -zxvf "openssl-${OPENSSL_VERSION}.tar.gz"
|
||||
|
||||
# 清理压缩包
|
||||
rm *.tar.gz
|
||||
|
||||
# 4. 进入 OpenResty 目录
|
||||
cd "openresty-${OPENRESTY_VERSION}"
|
||||
|
||||
# 5. 配置 (Configure)
|
||||
# 严格使用你指定的参数
|
||||
echo "=== 开始配置 (Configure)... ==="
|
||||
./configure \
|
||||
--with-http_ssl_module \
|
||||
--with-http_v2_module \
|
||||
--with-http_v3_module \
|
||||
--with-http_realip_module \
|
||||
--with-http_sub_module \
|
||||
--with-stream \
|
||||
--with-stream_ssl_module \
|
||||
--with-stream_ssl_preread_module \
|
||||
--with-openssl="../openssl-${OPENSSL_VERSION}"
|
||||
|
||||
# 6. 编译 (Make)
|
||||
echo "=== 开始编译 (Make)... ==="
|
||||
if command -v gmake >/dev/null; then
|
||||
gmake -j"${JOBS}"
|
||||
else
|
||||
make -j"${JOBS}"
|
||||
fi
|
||||
|
||||
# 7. 安装 (Install)
|
||||
echo "=== 开始安装 (Install)... ==="
|
||||
if command -v gmake >/dev/null; then
|
||||
sudo gmake install
|
||||
else
|
||||
sudo make install
|
||||
fi
|
||||
|
||||
# 8. 清理
|
||||
echo "=== 清理临时文件... ==="
|
||||
cd ~
|
||||
rm -rf "${WORK_DIR}"
|
||||
|
||||
echo "=============================================="
|
||||
echo "OpenResty ${OPENRESTY_VERSION} (with OpenSSL ${OPENSSL_VERSION}) 安装完成！"
|
||||
echo "=============================================="
|
||||
@@ -0,0 +1,148 @@
|
||||
#!/bin/bash
|
||||
export PATH=$PATH:/usr/sbin:/usr/local/openresty/bin
|
||||
|
||||
# 遇到错误立即停止
|
||||
set -e
|
||||
|
||||
CONF_DIR="/usr/local/openresty/nginx/conf"
|
||||
CONFD_DIR="${CONF_DIR}/conf.d"
|
||||
|
||||
echo "=== 开始配置 OpenResty 配置文件 ==="
|
||||
|
||||
# 1. 确保 www-data 用户存在
|
||||
echo "-> 检查运行用户 www-data..."
|
||||
if ! id -u www-data >/dev/null 2>&1; then
|
||||
echo "创建 www-data 用户..."
|
||||
groupadd www-data || true
|
||||
useradd -M -s /usr/sbin/nologin -g www-data www-data || true
|
||||
fi
|
||||
|
||||
# 2. 写入 nginx.conf
|
||||
echo "-> 写入主配置文件: ${CONF_DIR}/nginx.conf"
|
||||
cat > "${CONF_DIR}/nginx.conf" <<EOF
|
||||
user www-data;
|
||||
worker_processes auto;
|
||||
|
||||
error_log logs/error.log;
|
||||
error_log logs/error.log notice;
|
||||
error_log logs/error.log info;
|
||||
|
||||
pid logs/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
# 引入 Stream 模块配置 (TCP/UDP 分流)
|
||||
include stream.conf;
|
||||
|
||||
http {
|
||||
include mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
#log_format main '\$remote_addr - \$remote_user [\$time_local] "\$request" '
|
||||
# '\$status \$body_bytes_sent "\$http_referer" '
|
||||
# '"\$http_user_agent" "\$http_x_forwarded_for"';
|
||||
|
||||
#access_log logs/access.log main;
|
||||
|
||||
sendfile on;
|
||||
#tcp_nopush on;
|
||||
|
||||
#keepalive_timeout 0;
|
||||
keepalive_timeout 65;
|
||||
|
||||
gzip on;
|
||||
client_max_body_size 20m;
|
||||
server_tokens off;
|
||||
|
||||
# 引入 conf.d 下的所有 HTTP 配置
|
||||
include ${CONFD_DIR}/*.conf;
|
||||
}
|
||||
EOF
|
||||
|
||||
# 3. 写入 stream.conf
|
||||
# 注意：这里会处理 SNI 分流，根据域名转发到不同端口
|
||||
echo "-> 写入流配置文件: ${CONF_DIR}/stream.conf"
|
||||
cat > "${CONF_DIR}/stream.conf" <<EOF
|
||||
stream {
|
||||
map \$ssl_preread_server_name \$backend_name {
|
||||
proxy.pabo.me xray_direct;
|
||||
warp.pabo.me xray_warp;
|
||||
default nginx_web;
|
||||
}
|
||||
|
||||
upstream xray_direct {
|
||||
server 127.0.0.1:4443;
|
||||
}
|
||||
|
||||
upstream xray_warp {
|
||||
server 127.0.0.1:8443;
|
||||
}
|
||||
|
||||
upstream nginx_web {
|
||||
server 127.0.0.1:9443;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 reuseport;
|
||||
listen [::]:443 reuseport;
|
||||
|
||||
ssl_preread on;
|
||||
proxy_pass \$backend_name;
|
||||
proxy_protocol on;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# 4. 写入 default.conf
|
||||
# 注意：这里对应 stream.conf 中的 nginx_web 上游
|
||||
echo "-> 写入站点配置文件: ${CONFD_DIR}/default.conf"
|
||||
# 确保目录存在
|
||||
mkdir -p "${CONFD_DIR}"
|
||||
|
||||
cat > "${CONFD_DIR}/default.conf" <<EOF
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
listen 443 quic reuseport default_server;
|
||||
listen [::]:443 quic reuseport default_server;
|
||||
listen 127.0.0.1:9443 ssl default_server proxy_protocol;
|
||||
http2 on;
|
||||
|
||||
ssl_protocols TLSv1.3 TLSv1.2;
|
||||
ssl_certificate ${CONFD_DIR}/server.cer;
|
||||
ssl_certificate_key ${CONFD_DIR}/server.key;
|
||||
|
||||
set_real_ip_from 127.0.0.1;
|
||||
real_ip_header proxy_protocol;
|
||||
|
||||
server_name _;
|
||||
return 410;
|
||||
}
|
||||
EOF
|
||||
|
||||
# 5. 权限调整
|
||||
echo "-> 调整目录权限..."
|
||||
# 确保 logs 目录存在且 www-data 可写
|
||||
mkdir -p /usr/local/openresty/nginx/logs
|
||||
chown -R www-data:www-data /usr/local/openresty/nginx/logs
|
||||
# 配置文件只要 root 可写，www-data 可读即可，保持默认安全权限
|
||||
|
||||
# 6. 检查配置并重载
|
||||
echo "-> 检查 Nginx 配置语法..."
|
||||
/usr/local/openresty/bin/openresty -t
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "-> 语法检查通过，正在重启 OpenResty 服务..."
|
||||
if systemctl is-active --quiet openresty; then
|
||||
systemctl restart openresty
|
||||
else
|
||||
systemctl start openresty
|
||||
fi
|
||||
echo "=== 配置完成并已应用 ==="
|
||||
systemctl status openresty --no-pager
|
||||
else
|
||||
echo "!!! 配置文件语法错误，请检查输出日志 !!!"
|
||||
exit 1
|
||||
fi
|
||||
Reference in new issue
Block a user