From 4ddd5f14a287d484f3a12cea0c39092172a9641c Mon Sep 17 00:00:00 2001 From: Dennis Mo Date: Tue, 19 May 2020 22:44:58 +0800 Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0acme,frps=E5=92=8Cnginx?= =?UTF-8?q?=E9=A1=B9=E7=9B=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Deployments.sln | 9 ++++ acme/README.md | 62 +++++++++++++++++++++++++ acme/acme.projitems | 18 +++++++ acme/acme.shproj | 13 ++++++ frps/README.md | 15 ++++++ frps/conf.d/frps.conf | 35 ++++++++++++++ frps/frps.projitems | 17 +++++++ frps/frps.shproj | 13 ++++++ frps/frps/conf/frps.ini | 67 +++++++++++++++++++++++++++ frps/frps/docker-compose.yml | 25 ++++++++++ nginx/data/conf/conf.d/sample.conf.bk | 34 ++++++++++++++ nginx/data/conf/nginx.conf | 40 ++++++++++++++++ nginx/docker-compose.yml | 31 +++++++++++++ nginx/nginx.projitems | 19 ++++++++ nginx/nginx.shproj | 13 ++++++ 15 files changed, 411 insertions(+) create mode 100644 acme/README.md create mode 100644 acme/acme.projitems create mode 100644 acme/acme.shproj create mode 100644 frps/README.md create mode 100644 frps/conf.d/frps.conf create mode 100644 frps/frps.projitems create mode 100644 frps/frps.shproj create mode 100644 frps/frps/conf/frps.ini create mode 100644 frps/frps/docker-compose.yml create mode 100644 nginx/data/conf/conf.d/sample.conf.bk create mode 100644 nginx/data/conf/nginx.conf create mode 100644 nginx/docker-compose.yml create mode 100644 nginx/nginx.projitems create mode 100644 nginx/nginx.shproj diff --git a/Deployments.sln b/Deployments.sln index bf13f81..374ce51 100644 --- a/Deployments.sln +++ b/Deployments.sln @@ -7,10 +7,19 @@ Project("{D954291E-2A0B-460D-934E-DC6B0785DB48}") = "Gitea", "Gitea\Gitea.shproj EndProject Project("{D954291E-2A0B-460D-934E-DC6B0785DB48}") = "NginxAndLetsencrypt", "NginxAndLetsencrypt\NginxAndLetsencrypt.shproj", "{57D7CB76-1A45-4A68-A84F-7E5034096F19}" EndProject +Project("{D954291E-2A0B-460D-934E-DC6B0785DB48}") = "frps", "frps\frps.shproj", "{267AF5A6-ED6B-46C9-BC52-46988686265A}" +EndProject +Project("{D954291E-2A0B-460D-934E-DC6B0785DB48}") = "nginx", "nginx\nginx.shproj", "{36F1D233-DF91-469D-B27B-157982E326F0}" +EndProject +Project("{D954291E-2A0B-460D-934E-DC6B0785DB48}") = "acme", "acme\acme.shproj", "{E02725FD-AEB7-4D76-9390-E083E78237C5}" +EndProject Global GlobalSection(SharedMSBuildProjectFiles) = preSolution + frps\frps.projitems*{267af5a6-ed6b-46c9-bc52-46988686265a}*SharedItemsImports = 13 + nginx\nginx.projitems*{36f1d233-df91-469d-b27b-157982e326f0}*SharedItemsImports = 13 NginxAndLetsencrypt\NginxAndLetsencrypt.projitems*{57d7cb76-1a45-4a68-a84f-7e5034096f19}*SharedItemsImports = 13 Gitea\Gitea.projitems*{816bea29-9cdb-439d-bc36-d2dd6c52bc69}*SharedItemsImports = 13 + acme\acme.projitems*{e02725fd-aeb7-4d76-9390-e083e78237c5}*SharedItemsImports = 13 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/acme/README.md b/acme/README.md new file mode 100644 index 0000000..44e629d --- /dev/null +++ b/acme/README.md @@ -0,0 +1,62 @@ +## 前期准备 + +主要是接下来安装acme时的gfw问题。如果是境内服务器，则有可能需要如下步骤。 + +1. 小飞机的局域网内的代理地址。因为get.acme.sh中包含的脚本请求地址可能会被墙 + + `export http_proxy="172.18.184.139:10082"` + + `export https_proxy="172.18.184.139:10082"` + +2. 是因为据说在此加入上面的export命令可以实现开机自动开启代理。但没有尝试 + + `vim /etc/bashrc` + +3. 同上 + + `vim /etc/profile` + +## 安装acme + +1. 安装acme + + `curl https://get.acme.sh | sh` + +2. 将dns api的key和secret存入环境变量。此处为阿里云，事前已经给对应SAM子账户分配了FullDnsApiAccess的权限。参见： https://blog.csdn.net/chen249191508/article/details/98088553 + + `export Ali_Key="key"` + + `export Ali_Secret="secret"` + + 参见保密区域获取真实内容。注意，阿里云的控制台中，这两个值只在添加SAM子账户的时候出现，需要马上自行保存 + +## 获取证书 + +1. 申请安装证书。加--debug参数可以显示更多细节 + + `acme.sh --debug --issue --dns dns_ali -d dev.woyue.org -d *.dev.woyue.org` + +2. 安装完毕后，检验是否配置自动任务 + + `crontab -e` + +3. 确认当前证书 + + `acme.sh --list` + +## 安装证书 + +1. 复制证书： + + mkdir -p /srv/certbot/conf/live/dev.woyue.org + + acme.sh --installcert -d dev.woyue.org -d *.dev.woyue.org \ + --key-file /srv/certbot/conf/live/dev.woyue.org/privkey.pem \ + --fullchain-file /srv/certbot/conf/live/dev.woyue.org/fullchain.pem \ + --reloadcmd "docker restart nginxdocker_nginx_1" + + 注意，最后的nginxdocker_nginx_1为nginx容器的名称。请根据实际情况修改。**或不加此参数，手动重启nginx**。 + +2. 生成：dhparams文件 + + openssl dhparam -out /srv/certbot/conf/ssl-dhparams.pem 2048 \ No newline at end of file diff --git a/acme/acme.projitems b/acme/acme.projitems new file mode 100644 index 0000000..120f180 --- /dev/null +++ b/acme/acme.projitems @@ -0,0 +1,18 @@ + + + + $(MSBuildAllProjects);$(MSBuildThisFileFullPath) + true + e02725fd-aeb7-4d76-9390-e083e78237c5 + + + acme + + + + + + + + + \ No newline at end of file diff --git a/acme/acme.shproj b/acme/acme.shproj new file mode 100644 index 0000000..ddd439e --- /dev/null +++ b/acme/acme.shproj @@ -0,0 +1,13 @@ + + + + e02725fd-aeb7-4d76-9390-e083e78237c5 + 14.0 + + + + + + + + diff --git a/frps/README.md b/frps/README.md new file mode 100644 index 0000000..3a4e164 --- /dev/null +++ b/frps/README.md @@ -0,0 +1,15 @@ +## 前期准备 + +1. 用acme搞定泛域名ca证书。参看acme项目。 +2. 部署nginx docker。参看nginx项目。 +3. 根据nginx docker的网络设置，对应确定自己的docker-compose.yml文件中的对应内容设置正确。其中包括： + - ​ nginx所在的网络名称。配置到自己的docker-compose.yml文件中的网络定义中的external->name中去。 + - 根据网络定义，设定自己的固定ip。 + - 复制conf.d下的文件到nginx配置目录下的conf.d下。 + - 确保刚复制的文件配置正确。如其中证书所在路径应符合之前acme复制证书时的目标目录。 + +## 安装 + +执行docker-compose up -d + +并验证是否成功。 \ No newline at end of file diff --git a/frps/conf.d/frps.conf b/frps/conf.d/frps.conf new file mode 100644 index 0000000..1487199 --- /dev/null +++ b/frps/conf.d/frps.conf @@ -0,0 +1,35 @@ +server { + listen 80; + server_name *.dev.woyue.org; + server_tokens off; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } +} + +server { + listen 443 ssl; + server_name *.dev.woyue.org; + server_tokens off; + + ssl_certificate /etc/letsencrypt/live/dev.woyue.org/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/dev.woyue.org/privkey.pem; + #include /etc/letsencrypt/options-ssl-nginx.conf; + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; + + location / { + #ip address below should changed accordingly. + proxy_pass http://172.20.0.3:8090; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $http_connection; + } +} diff --git a/frps/frps.projitems b/frps/frps.projitems new file mode 100644 index 0000000..da465a6 --- /dev/null +++ b/frps/frps.projitems @@ -0,0 +1,17 @@ + + + + $(MSBuildAllProjects);$(MSBuildThisFileFullPath) + true + 267af5a6-ed6b-46c9-bc52-46988686265a + + + frps + + + + + + + + \ No newline at end of file diff --git a/frps/frps.shproj b/frps/frps.shproj new file mode 100644 index 0000000..21bcf9a --- /dev/null +++ b/frps/frps.shproj @@ -0,0 +1,13 @@ + + + + 267af5a6-ed6b-46c9-bc52-46988686265a + 14.0 + + + + + + + + diff --git a/frps/frps/conf/frps.ini b/frps/frps/conf/frps.ini new file mode 100644 index 0000000..271b867 --- /dev/null +++ b/frps/frps/conf/frps.ini @@ -0,0 +1,67 @@ +# [common] is integral section +[common] +# A literal address or host name for IPv6 must be enclosed +# in square brackets, as in "[::1]:80", "[ipv6-host]:http" or "[ipv6-host%zone]:80" +bind_addr = 0.0.0.0 +bind_port = 7000 + +# udp port to help make udp hole to penetrate nat +bind_udp_port = 7001 + +# udp port used for kcp protocol, it can be same with 'bind_port' +# if not set, kcp is disabled in frps +kcp_bind_port = 7000 + +# specify which address proxy will listen for, default value is same with bind_addr +# proxy_bind_addr = 127.0.0.1 + +# if you want to support virtual host, you must set the http port for listening (optional) +# Note: http port and https port can be same with bind_port +vhost_http_port = 8090 +vhost_https_port = 8443 + +# response header timeout(seconds) for vhost http server, default is 60s +# vhost_http_timeout = 60 + +# set dashboard_addr and dashboard_port to view dashboard of frps +# dashboard_addr's default value is same with bind_addr +# dashboard is available only if dashboard_port is set +dashboard_addr = 0.0.0.0 +dashboard_port = 7500 + +# dashboard user and passwd for basic auth protect, if not set, both default value is admin +dashboard_user = hmo +dashboard_pwd = Dm19000o + +# dashboard assets directory(only for debug mode) +# assets_dir = ./static +# console or real logFile path like ./frps.log +log_file = ./frps.log + +# trace, debug, info, warn, error +log_level = info + +log_max_days = 3 + +# auth token +token = 83550348 + +# heartbeat configure, it's not recommended to modify the default value +# the default value of heartbeat_timeout is 90 +# heartbeat_timeout = 90 + +# only allow frpc to bind ports you list, if you set nothing, there won't be any limit +allow_ports = 43000-43010 + +# pool_count in each proxy will change to max_pool_count if they exceed the maximum value +max_pool_count = 5 + +# max ports can be used for each client, default value is 0 means no limit +max_ports_per_client = 0 + +# if subdomain_host is not empty, you can set subdomain when type is http or https in frpc's configure file +# when subdomain is test, the host used by routing is test.frps.com +subdomain_host = dev.woyue.org + +# if tcp stream multiplexing is used, default is true +tcp_mux = true diff --git a/frps/frps/docker-compose.yml b/frps/frps/docker-compose.yml new file mode 100644 index 0000000..05dfa96 --- /dev/null +++ b/frps/frps/docker-compose.yml @@ -0,0 +1,25 @@ + +version: "3.5" + +networks: + default: + external: + name: nginx_firstnet + +services: + server: + image: "ruiny/frps:latest" + restart: always + networks: + default: + ipv4_address: 172.20.0.3 + volumes: + - ./conf:/var/frp/conf + ports: + - "7000:7000" + - "7500:7500" + - "7001:7001" + - "8089:80" + - "8443:43" + - "43000-43010:43000-43010/udp" + - "43000-43010:43000-43010/tcp" diff --git a/nginx/data/conf/conf.d/sample.conf.bk b/nginx/data/conf/conf.d/sample.conf.bk new file mode 100644 index 0000000..9f3c8e9 --- /dev/null +++ b/nginx/data/conf/conf.d/sample.conf.bk @@ -0,0 +1,34 @@ +server { + listen 80; + server_name git.woyue.org; + server_tokens off; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } +} + +server { + listen 443 ssl; + server_name git.woyue.org; + server_tokens off; + + ssl_certificate /etc/letsencrypt/live/git.woyue.org/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/git.woyue.org/privkey.pem; + include /etc/letsencrypt/options-ssl-nginx.conf; + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; + + location / { + proxy_pass http://172.20.0.3:3000; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $http_connection; + } +} diff --git a/nginx/data/conf/nginx.conf b/nginx/data/conf/nginx.conf new file mode 100644 index 0000000..c990bfb --- /dev/null +++ b/nginx/data/conf/nginx.conf @@ -0,0 +1,40 @@ +user root; +worker_processes 1; +error_log /var/log/nginx/error.log warn; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + autoindex on; + gzip on; + gzip_min_length 1k; + gzip_buffers 4 16k; + #gzip_http_version 1.0; + gzip_comp_level 2; + gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png; + gzip_vary off; + gzip_disable "MSIE [1-6]\."; + + client_max_body_size 100M; + client_header_buffer_size 128k; + large_client_header_buffers 4 128k; + + + include /etc/nginx/conf.d/*.conf; + +} \ No newline at end of file diff --git a/nginx/docker-compose.yml b/nginx/docker-compose.yml new file mode 100644 index 0000000..300722a --- /dev/null +++ b/nginx/docker-compose.yml @@ -0,0 +1,31 @@ + +version: "3.5" + +#设定network. 其他应用应设置network的external为本网络，以和nginx服务器互通。 +networks: + firstnet: + name:nginx_firstnet + ipam: + config: + - subnet: 172.20.0.0/16 + +services: + nginx: + image: nginx:latest + restart: unless-stopped + volumes: + - ./data/conf/conf.d:/etc/nginx/conf.d + - ./data/conf/nginx.conf:/etc/nginx/nginx.conf + - ./data/html:/usr/share/nginx/html + - ./data/logs:/var/log/nginx + # 此处的配置取决于conf.d下的配置文件中如何配置证书路径。例如：“ssl_certificate /etc/letsencrypt/live/git.woyue.org/fullchain.pem;”等 + - ../certbot/conf:/etc/letsencrypt + # 此处的配置取决于conf.d下的配置文件中的配置“location /.well-known/acme-challenge/”，可参看sample.conf： + - ../certbot/www:/var/www/certbot + networks: + firstnet: + ipv4_address: 172.20.0.2 + ports: + - "80:80" + - "443:443" + command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'" \ No newline at end of file diff --git a/nginx/nginx.projitems b/nginx/nginx.projitems new file mode 100644 index 0000000..5de06d5 --- /dev/null +++ b/nginx/nginx.projitems @@ -0,0 +1,19 @@ + + + + $(MSBuildAllProjects);$(MSBuildThisFileFullPath) + true + 36f1d233-df91-469d-b27b-157982e326f0 + + + nginx + + + + + + + + + + \ No newline at end of file diff --git a/nginx/nginx.shproj b/nginx/nginx.shproj new file mode 100644 index 0000000..cb6948f --- /dev/null +++ b/nginx/nginx.shproj @@ -0,0 +1,13 @@ + + + + 36f1d233-df91-469d-b27b-157982e326f0 + 14.0 + + + + + + + +