更新 proxy-openresty.sh

proxy-openresty.sh

@@ -0,0 +1,148 @@
+#!/bin/bash
+export PATH=$PATH:/usr/sbin:/usr/local/openresty/bin
+
+# 遇到错误立即停止
+set -e
+
+CONF_DIR="/usr/local/openresty/nginx/conf"
+CONFD_DIR="${CONF_DIR}/conf.d"
+
+echo "=== 开始配置 OpenResty 配置文件 ==="
+
+# 1. 确保 www-data 用户存在
+echo "-> 检查运行用户 www-data..."
+if ! id -u www-data >/dev/null 2>&1; then
+    echo "创建 www-data 用户..."
+    groupadd www-data || true
+    useradd -M -s /usr/sbin/nologin -g www-data www-data || true
+fi
+
+# 2. 写入 nginx.conf
+echo "-> 写入主配置文件: ${CONF_DIR}/nginx.conf"
+cat > "${CONF_DIR}/nginx.conf" <<EOF
+user  www-data;
+worker_processes  auto;
+
+error_log  logs/error.log;
+error_log  logs/error.log  notice;
+error_log  logs/error.log  info;
+
+pid        logs/nginx.pid;
+
+events {
+    worker_connections  1024;
+}
+
+# 引入 Stream 模块配置 (TCP/UDP 分流)
+include stream.conf;
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    #log_format  main  '\$remote_addr - \$remote_user [\$time_local] "\$request" '
+    #                  '\$status \$body_bytes_sent "\$http_referer" '
+    #                  '"\$http_user_agent" "\$http_x_forwarded_for"';
+
+    #access_log  logs/access.log  main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    #keepalive_timeout  0;
+    keepalive_timeout  65;
+
+    gzip  on;
+    client_max_body_size  20m;
+    server_tokens off;
+
+    # 引入 conf.d 下的所有 HTTP 配置
+    include ${CONFD_DIR}/*.conf;
+}
+EOF
+
+# 3. 写入 stream.conf
+# 注意：这里会处理 SNI 分流，根据域名转发到不同端口
+echo "-> 写入流配置文件: ${CONF_DIR}/stream.conf"
+cat > "${CONF_DIR}/stream.conf" <<EOF
+stream {
+    map \$ssl_preread_server_name \$backend_name {
+        proxy.pabo.me    xray_direct;
+        warp.pabo.me     xray_warp;
+        default          nginx_web;
+    }
+
+    upstream xray_direct {
+        server 127.0.0.1:4443;
+    }
+
+    upstream xray_warp {
+        server 127.0.0.1:8443;
+    }
+
+    upstream nginx_web {
+        server 127.0.0.1:9443;
+    }
+
+    server {
+        listen 443 reuseport;
+        listen [::]:443 reuseport;
+
+        ssl_preread on;
+        proxy_pass \$backend_name;
+        proxy_protocol on;
+    }
+}
+EOF
+
+# 4. 写入 default.conf
+# 注意：这里对应 stream.conf 中的 nginx_web 上游
+echo "-> 写入站点配置文件: ${CONFD_DIR}/default.conf"
+# 确保目录存在
+mkdir -p "${CONFD_DIR}"
+
+cat > "${CONFD_DIR}/default.conf" <<EOF
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    listen 443 quic reuseport default_server;
+    listen [::]:443 quic reuseport default_server;
+    listen      127.0.0.1:9443 ssl default_server proxy_protocol;
+    http2 on;
+    
+    ssl_protocols TLSv1.3 TLSv1.2;
+    ssl_certificate      ${CONFD_DIR}/server.cer;
+    ssl_certificate_key  ${CONFD_DIR}/server.key;
+
+    set_real_ip_from 127.0.0.1;
+    real_ip_header proxy_protocol;
+
+    server_name _;
+    return 410;
+}
+EOF
+
+# 5. 权限调整
+echo "-> 调整目录权限..."
+# 确保 logs 目录存在且 www-data 可写
+mkdir -p /usr/local/openresty/nginx/logs
+chown -R www-data:www-data /usr/local/openresty/nginx/logs
+# 配置文件只要 root 可写，www-data 可读即可，保持默认安全权限
+
+# 6. 检查配置并重载
+echo "-> 检查 Nginx 配置语法..."
+/usr/local/openresty/bin/openresty -t
+
+if [ $? -eq 0 ]; then
+    echo "-> 语法检查通过，正在重启 OpenResty 服务..."
+    if systemctl is-active --quiet openresty; then
+        systemctl restart openresty
+    else
+        systemctl start openresty
+    fi
+    echo "=== 配置完成并已应用 ==="
+    systemctl status openresty --no-pager
+else
+    echo "!!! 配置文件语法错误，请检查输出日志 !!!"
+    exit 1
+fi