144 lines
3.2 KiB
Bash
144 lines
3.2 KiB
Bash
#!/bin/bash
|
|
|
|
|
|
|
|
if [ "$EUID" -ne 0 ]; then
|
|
echo "错误: 本脚本必须以 root 权限运行。"
|
|
echo "请使用 'sudo ./脚本名.sh' 或切换到 root 用户后运行。"
|
|
exit 1
|
|
fi
|
|
|
|
export PATH=$PATH:/usr/sbin:/usr/local/openresty/bin
|
|
INSTALL_PREFIX="/usr/local/openresty"
|
|
NGINX_CONF_DIR="${INSTALL_PREFIX}/nginx/conf"
|
|
CONFD_DIR="${NGINX_CONF_DIR}/conf.d"
|
|
|
|
set -e
|
|
|
|
/usr/local/bin/proxy-update
|
|
|
|
service xray restart
|
|
|
|
echo "=== [5/8] 写入 Nginx 配置文件 ==="
|
|
|
|
# 5.1 写入 nginx.conf
|
|
cat > "${NGINX_CONF_DIR}/nginx.conf" <<EOF
|
|
user www-data;
|
|
worker_processes auto;
|
|
|
|
error_log logs/error.log;
|
|
error_log logs/error.log notice;
|
|
error_log logs/error.log info;
|
|
|
|
pid logs/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
include stream.conf;
|
|
|
|
http {
|
|
include mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
#log_format main '\$remote_addr - \$remote_user [\$time_local] "\$request" '
|
|
# '\$status \$body_bytes_sent "\$http_referer" '
|
|
# '"\$http_user_agent" "\$http_x_forwarded_for"';
|
|
|
|
#access_log logs/access.log main;
|
|
|
|
sendfile on;
|
|
#tcp_nopush on;
|
|
|
|
#keepalive_timeout 0;
|
|
keepalive_timeout 65;
|
|
|
|
gzip on;
|
|
client_max_body_size 20m;
|
|
server_tokens off;
|
|
|
|
include ${CONFD_DIR}/*.conf;
|
|
}
|
|
EOF
|
|
|
|
# 5.2 写入 stream.conf (SNI 分流逻辑)
|
|
cat > "${NGINX_CONF_DIR}/stream.conf" <<EOF
|
|
stream {
|
|
map \$ssl_preread_server_name \$backend_name {
|
|
proxy.pabo.me xray_direct;
|
|
warp.pabo.me xray_warp;
|
|
default nginx_web;
|
|
}
|
|
|
|
upstream xray_direct {
|
|
server 127.0.0.1:19001;
|
|
}
|
|
|
|
upstream xray_warp {
|
|
server 127.0.0.1:19002;
|
|
}
|
|
|
|
upstream nginx_web {
|
|
server 127.0.0.1:4443;
|
|
}
|
|
|
|
server {
|
|
listen 443 reuseport;
|
|
listen [::]:443 reuseport;
|
|
|
|
ssl_preread on;
|
|
proxy_pass \$backend_name;
|
|
proxy_protocol on;
|
|
}
|
|
}
|
|
EOF
|
|
|
|
# 5.3 写入 default.conf (Web 站点配置)
|
|
# 注意：由于 stream 模块开启了 proxy_protocol，这里的内部监听必须加上 proxy_protocol 关键字，否则连接会断开
|
|
cat > "${CONFD_DIR}/default.conf" <<EOF
|
|
server {
|
|
#listen 80 default_server;
|
|
#listen [::]:80 default_server;
|
|
listen 443 quic reuseport default_server;
|
|
listen [::]:443 quic reuseport default_server;
|
|
listen 127.0.0.1:4443 ssl default_server proxy_protocol;
|
|
|
|
http2 on;
|
|
ssl_protocols TLSv1.3 TLSv1.2;
|
|
ssl_certificate ${CONFD_DIR}/server.crt;
|
|
ssl_certificate_key ${CONFD_DIR}/server.key;
|
|
|
|
set_real_ip_from 127.0.0.1;
|
|
real_ip_header proxy_protocol;
|
|
|
|
server_name _;
|
|
return 410;
|
|
}
|
|
EOF
|
|
|
|
# 5.4 写入 fallback.conf (回落站点配置)
|
|
# 注意：由于 stream 模块开启了 proxy_protocol，这里的内部监听必须加上 proxy_protocol 关键字，否则连接会断开
|
|
cat > "${CONFD_DIR}/fallback.conf" <<EOF
|
|
server {
|
|
listen 127.0.0.1:19000 proxy_protocol;
|
|
|
|
http2 on;
|
|
ssl_protocols TLSv1.3 TLSv1.2;
|
|
ssl_certificate /usr/local/etc/xray/cert.crt;
|
|
ssl_certificate_key /usr/local/etc/xray/cert.key;
|
|
|
|
set_real_ip_from 127.0.0.1;
|
|
real_ip_header proxy_protocol;
|
|
|
|
server_name *.pabo.me;
|
|
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|
|
EOF
|
|
|
|
systemctl restart openresty
|
|
|