nginx xxs漏铜修复、nginx 域名配置、nginx https证书配置、Http不安全处理方法

因为工作原因，很久没有发布博客了，今天正好总结一下。

nginx xxs漏铜修复： server_name oris.pkuph.cn;

#配置 CSP（内容安全策略）

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self';";

#Http缺失或不安全的处理方法

add_header X-Content-Type-Options "nosniff";

nginx 域名配置：

server_name oris.pkuph.cn;

nginx https证书配置：

ssl_certificate /wanmagroup/projects/acme-challenge/_.pkuph.cn.crt;

ssl_certificate_key /wanmagroup/projects/acme-challenge/_.pkuph.cn.key;

ssl_session_cache shared:SSL:1m;

ssl_session_timeout 5m;

ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;

ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;

ssl_prefer_server_ciphers on;

#user  nginx;
worker_processes  1;

error_log  /usr/share/nginx/logs/error.log notice;
#pid        /run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /usr/share/nginx/logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    #WebSocket支持配置
	map $http_upgrade $connection_upgrade {
		default upgrade;
		'' close;
	}
		
    upstream mtis-server{
        server localhost:15686;
    }
    
    server {
        listen       443 ssl;
	#listen       8088;
	#域名配置
    server_name  oris.pkuph.cn;
       
    #配置 CSP（内容安全策略）
	add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self';";
    #Http缺失或不安全的处理方法
    add_header X-Content-Type-Options "nosniff";
    #证书配置
	ssl_certificate      /wanmagroup/projects/acme-challenge/_.pkuph.cn.crt;   
	ssl_certificate_key  /wanmagroup/projects/acme-challenge/_.pkuph.cn.key; 
	
	ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

	ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
	ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;

	ssl_prefer_server_ciphers on;

		#关闭Nginx版本显示
		server_tokens off;
		
		proxy_set_header Host $http_host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;

        charset utf-8;

		client_header_buffer_size 512k;
		large_client_header_buffers 4 512k;

        access_log  logs/host.access.log  main;
	  
		
		location ^~ /wm-iot/ {
			proxy_pass http://mtis-server;
			proxy_set_header Host $http_host;
			#proxy_read_timeout 3600s;   #默认60s没有传输数据就会关闭，延长时间
			proxy_set_header Upgrade $http_upgrade;
			proxy_set_header Connection $connection_upgrade;
        }

	location ^~ /wm-haikang/ {
			proxy_pass http://mtis-server;
			proxy_set_header Host $http_host;
        }
		
        location ^~ /wm-mtis/ {
			proxy_pass http://mtis-server;
			proxy_set_header Host $http_host;
			proxy_set_header X-Real-IP $remote_addr;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_set_header X-Forwarded-Proto $scheme;
			proxy_connect_timeout 5s;
			proxy_read_timeout 60s;
        }
		
	
		location ~* .*\.(gif|ico|png|jpg|eot|svg|ttf|woff|txt|pdf|json) {
			root  /wanmagroup/projects/static;
			expires 30d;
		}
		
		location ~* .*\.(js|css|json)$ {
			root  /wanmagroup/projects/static;
			expires 1h;
		}
		
		#织物平台配置 默认访问织物系统
		location / {
            root  /wanmagroup/projects/static/page;
            index index.html index.htm;
        }
		
		location /page/ {
           rewrite "^/page/(.*)$" $scheme://$http_host/$1 permanent;
        }
		
		error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }	

    include /etc/nginx/conf.d/*.conf;
}