===================================================================
verynginx_db配置
server {
listen 9989;
server_name db.qq.com;
access_log /data/wwwlogs/data65.log;
index index.html index.htm index.php;
root /data/wwwroot/database.qq.com;
#if ($http_x_forwarded_host != '') { return 403; }
#防止XSS，下面3行
add_header Strict-Transport-Security max-age=0;
add_header Content-Security-Policy "upgrade-insecure-requests";
add_header Access-Control-Allow-Origin *;
#expires $expires;
#error_page 404 /404.html;
#error_page 502 /502.html;
location ~ [^/]\.php(/|$) {
#fastcgi_pass remote_php_ip:9000;
fastcgi_pass unix:/dev/shm/php5.6-cgi.sock;
fastcgi_index index.php;
include fastcgi.conf;
fastcgi_param X_REAL_IP $http_x_real_ip;
fastcgi_param XREQUESTID $xrequestid;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
#fastcgi_param PHP_VALUE "auto_prepend_file=/data/tmp/WAF/test.php";
fastcgi_hide_header X-Powered-By;
}
location / {
if ($uri !~ "^/(index.php/|)(api|api/.*|other/vipinternal.html|other/vipexternal)$"){
set $rule_0 1$rule_0;
}
# if ($rule_0 = "1"){
# rewrite ^/(.*)?$ https://$server_name/$1 redirect;
# }
if (!-e $request_filename) {
rewrite ^(.*)$ /index.php?s=$1 last;
break;
}
}
location ~ /\.ht {
deny all;
}
location ~ /\.git {
deny all;
}
}
===================================================================
verynginx_vip配置
server {
listen 9990;
# listen 443 ssl http2;
# ssl_certificate /opt/verynginx/openresty/nginx/conf/ssl/qq.com.pem;
# ssl_certificate_key /opt/verynginx/openresty/nginx/conf/ssl/qq.com.key;
# ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
# ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
# ssl_prefer_server_ciphers on;
# ssl_session_timeout 10m;
# ssl_session_cache builtin:1000 shared:SSL:10m;
# ssl_buffer_size 1400;
# ssl_stapling on;
# ssl_stapling_verify on;
#防止XSS，下面3行
# add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
add_header Strict-Transport-Security max-age=15768000;
server_name _;
root /data/wwwroot/vip.qq.com/dist;
access_log /data/wwwlogs/vip65.log main;
index index.html index.htm index.php;
# if ($ssl_protocol = "") { return 301 https://$host$request_uri; }
# if ($http_x_forwarded_host != '') { return 403; }
set $xrequestid $http_xrequestid;
# expires $expires;
location / {
if (!-e $request_filename) {
#rewrite ^/api/(.*)$ /api/index.php?s=$1 last;
rewrite ^(.*)$ /index.html last;
break;
}
}
location /api {
proxy_pass https://apidb.qq.com/;
}
location = /index.html {
#禁止缓存，每次都从服务器请求
add_header Cache-Control "no-cache, no-store";
}
location /lineat {
proxy_pass https://patapi.qq.com/;
}
location /mlw/ {
proxy_pass http://felog.qq.com/;
}
location ~ [^/]\.php(/|$) {
#fastcgi_pass remote_php_ip:9000;
fastcgi_pass unix:/dev/shm/php-cgi.sock;
fastcgi_index index.php;
include fastcgi.conf;
}
location ~ /\.ht {
deny all;
}
location ~ /\.git {
deny all;
}
}
===================================================================
verynginx_vipapi配置
server {
listen 80;
listen 443 ssl http2;
ssl_certificate /opt/verynginx/openresty/nginx/conf/ssl/qq.com.pem;
ssl_certificate_key /opt/verynginx/openresty/nginx/conf/ssl/qq.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_timeout 10m;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_buffer_size 1400;
add_header Strict-Transport-Security max-age=15768000;
ssl_stapling on;
ssl_stapling_verify on;
server_name apidb.qq.com;
access_log /data/wwwlogs/vipapi65.log main;
index index.html index.htm index.php;
root /data/wwwroot/vipapi.qq.com/public;
if ($ssl_protocol = "") { return 301 https://$host$request_uri; }
if ($http_x_forwarded_host != '') { return 403; }
set $xrequestid $http_xrequestid;
include /opt/verynginx/openresty/nginx/conf/rewrite/thinkphp.conf;
expires $expires;
#error_page 404 /404.html;
#error_page 502 /502.html;
location ~ [^/]\.php(/|$) {
#fastcgi_pass remote_php_ip:9000;
fastcgi_pass unix:/dev/shm/php-cgi.sock;
fastcgi_index index.php;
include fastcgi.conf;
fastcgi_param X_REAL_IP $http_x_real_ip;
fastcgi_param XREQUESTID $xrequestid;
#fastcgi_split_path_info ^(.+\.php)(/.+)$;
#fastcgi_param PATH_INFO $fastcgi_path_info;
#fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_hide_header X-Powered-By;
}
location ~ /\.ht {
deny all;
}
location ~ /\.git {
deny all;
}
}
===================================================================
nginx.conf配置
user www www;
worker_processes auto;
error_log /data/wwwlogs/error_nginx.log crit;
pid /var/run/nginx.pid;
worker_rlimit_nofile 655350;
events {
use epoll;
worker_connections 655350;
multi_accept on;
}
#include /opt/verynginx/verynginx/nginx_conf/in_external.conf;
stream {
include /opt/verynginx/openresty/nginx/conf/ports/*.conf;
}
http {
include mime.types;
default_type application/octet-stream;
server_names_hash_bucket_size 128;
client_header_buffer_size 64k;
large_client_header_buffers 4 64k;
client_max_body_size 10240m;
client_body_buffer_size 20m;
sendfile on;
tcp_nopush on;
keepalive_timeout 120;
server_tokens off;
tcp_nodelay on;
#隐藏nginx后端服务X-Powered-By头
proxy_hide_header X-Powered-By;
proxy_hide_header Server;
fastcgi_connect_timeout 600;
fastcgi_send_timeout 600;
fastcgi_read_timeout 600;
fastcgi_buffer_size 128k;
fastcgi_buffers 4 128k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
fastcgi_intercept_errors on;
#Gzip Compression
gzip on;
gzip_buffers 16 8k;
gzip_comp_level 6;
gzip_http_version 1.1;
gzip_min_length 256;
gzip_proxied any;
gzip_vary on;
gzip_types
text/xml application/xml application/atom+xml application/rss+xml application/xhtml+xml image/svg+xml
text/javascript application/javascript application/x-javascript
text/x-json application/json application/x-web-app-manifest+json
text/css text/plain text/x-component
font/opentype application/x-font-ttf application/vnd.ms-fontobject
image/x-icon;
gzip_disable "MSIE [1-6]\.(?!.*SV1)";
log_format main '^$remote_addr ^$http_x_real_ip ^$http_x_forwarded_for ^$remote_user ^$time_local ^$http_host '
'^$status ^$body_bytes_sent ^$http_referer '
'^$request ^$http_user_agent ^$request_time ^$upstream_status ^$upstream_addr ^$upstream_response_time ^$args ^$query_string ^$arg_NAME '
'^$cookie_userid ^$cookie_username ^$xrequestid';
access_log /data/wwwlogs/access_tengine.log main;
#If you have a lot of static files to serve through Nginx then caching of the files' metadata (not the actual files' contents) can save some latency.
open_file_cache max=1000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors on;
#add_header X-Frame-Options SAMEORIGIN;
include expire.conf;
# include /opt/verynginx/verynginx/nginx_conf/in_http_block.conf;
######################## default ############################
server {
listen 80;
server_name _;
#access_log /data/wwwlogs/access_nginx.log combined;
#root /data/wwwroot/default;
#root /data/text_data;
index index.html index.htm index.php;
#error_page 404 /404.html;
#error_page 502 /502.html;
location /nginx_status {
stub_status on;
access_log off;
allow 127.0.0.1;
deny all;
}
location ~ [^/]\.php(/|$) {
#fastcgi_pass remote_php_ip:9000;
fastcgi_pass unix:/dev/shm/php-cgi.sock;
fastcgi_index index.php;
include fastcgi.conf;
}
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|mp4|ico)$ {
expires 30d;
access_log off;
}
location ~ .*\.(js|css)?$ {
expires 7d;
access_log off;
}
location ~ /\.ht {
deny all;
}
}
########################## verynginx #############################
# server {
# listen 9999;
# include /opt/verynginx/verynginx/nginx_conf/in_server_block.conf;
# server_name 101.37.36.159;
# #access_log /data/wwwlogs/access_tengine.log main;
# #root /data/wwwroot/default;
# #root /data/text_data;
# index index.html index.htm index.php;
# #error_page 404 /404.html;
# #error_page 502 /502.html;
# location ~ [^/]\.php(/|$) {
# #fastcgi_pass remote_php_ip:9000;
# fastcgi_pass unix:/dev/shm/php-cgi.sock;
# fastcgi_index index.php;
# include fastcgi.conf;
# }
# location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|mp4|ico)$ {
# expires 30d;
# access_log off;
# }
# location ~ .*\.(js|css)?$ {
# expires 7d;
# access_log off;
# }
# location ~ /\.ht {
# deny all;
# }
# }
########################## vhost #############################
include vhost/*.conf;
}
===================================================================
lsb_drugv配置
upstream www.qq.com{
# ip_hash;
# server 10.81.44.201:443 weight=1;
# server 10.46.228.27:443 weight=2;
server 118.178.241.102:443 weight=2;
}
server {
listen 80;
listen 443 ssl http2;
charset utf-8;
# include /opt/verynginx/verynginx/nginx_conf/in_server_block.conf;
ssl_certificate /opt/verynginx/openresty/nginx/conf/ssl/qq.com.pem;
ssl_certificate_key /opt/verynginx/openresty/nginx/conf/ssl/qq.com.key;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_timeout 10m;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_buffer_size 1400;
ssl_stapling on;
ssl_stapling_verify on;
##防止XSS，下面3行
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
add_header Strict-Transport-Security max-age=15768000;
server_name qq.com www.qq.com;
index index.html index.htm index.php;
# root /data/wwwroot/meeting.yaozh.com/public;
# include blocksip.conf;
# if ($host != 'www.qq.com') { return 403; }
if ($ssl_protocol = "") { return 301 https://$host$request_uri; }
if ($http_x_forwarded_host != '') { return 403; }
# set $allow true;
# if ($http_x_real_ip !~ "119.86.*.0*|222.176.*.*|222.182.*.*|106.83.*.*|14.105.*.*|218.79.251.*|221.181.219.53"){
# set $allow false;
# }
# if ($allow = false){
# return 403;
# }
set $xrequestid $request_id;
# include /opt/verynginx/openresty/nginx/conf/rewrite/thinkphp.conf;
# expires $expires;
# #如果我是第一层nginx，所以只取$remote_addr,而且X-Forwarded-For造假.
# set $http_x_real_ip $remote_addr;
# location / {
# proxy_headers_hash_max_size 51200;
# proxy_headers_hash_bucket_size 6400;
# proxy_set_header Host $host;
# #proxy_set_header Host $proxy_host;
# #proxy_set_header Host $host:$proxy_port;
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-For $remote_addr;
# #proxy_set_header Upgrade $http_upgrade; #这是webSocket的配置,WebSockets应用程序会在客户端和服务器之间建立一个长连接
# #proxy_set_header Connection "upgrade"; #这是webSocket的配置,WebSockets应用程序会在客户端和服务器之间建立一个长连接
# proxy_pass https://dataservice-dev.yaozh.com;
# }
##如果我是阿里的WAF,ALB,SLB后面,因为阿里已经弄好了$http_x_forwarded_for的第一个ip为客户端ip
location / {
# access_by_lua_file "/opt/verynginx/openresty/nginx/conf/lua/whiteKeykz18.lua";
proxy_set_header xrequestid $xrequestid;
proxy_headers_hash_max_size 51200;
proxy_headers_hash_bucket_size 6400;
proxy_set_header Host $host;
#proxy_set_header Host $proxy_host;
#proxy_set_header Host $host:$proxy_port;
proxy_set_header X-Real-IP $http_x_real_ip;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#proxy_set_header Upgrade $http_upgrade; #这是webSocket的配置,WebSockets应用程序会在客户端和服务器之间建立一个长连接
#proxy_set_header Connection "upgrade"; #这是webSocket的配置,WebSockets应用程序会在客户端和服务器之间建立一个长连接
proxy_next_upstream error timeout http_502;
proxy_next_upstream_tries 1;
proxy_pass https://www.qq.com;
}
# location ~ [^/]\.php(/|$) {
# #fastcgi_pass remote_php_ip:9000;
# fastcgi_pass unix:/dev/shm/php-cgi.sock;
# fastcgi_index index.php;
# include fastcgi.conf;
#
# #fastcgi_split_path_info ^(.+\.php)(/.+)$;
# #fastcgi_param PATH_INFO $fastcgi_path_info;
# #fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
# }
location ~ /\.ht {
deny all;
}
location ~ /\.git {
deny all;
}
}
===================================================================
lsb_apollo配置
upstream apolloadmin {
ip_hash;
server 10.80.152.100:8090;
server 10.46.224.237:8090;
}
server {
listen 8090;
server_name apolloadmin.qq.com;
if ($host != 'apolloadmin.qq.com'){ return 403;}
location / {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://apolloadmin;
}
}
###############################################################
upstream apolloconfig {
ip_hash;
server 10.80.152.100:8080;
server 10.46.224.237:8080;
}
server {
listen 8080;
server_name apolloconfig.qq.com;
if ($host != 'apolloconfig.qq.com'){ return 403;}
location / {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://apolloconfig;
}
}
###############################################################
upstream apolloportal {
ip_hash;
server 10.80.152.100:8070;
server 10.46.224.237:8070;
}
server {
listen 8070;
server_name apolloportal.qq.com;
if ($host != 'apolloportal.qq.com'){ return 403;}
location / {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://apolloportal;
}
}
===================================================================
lsb_db配置
server {
listen 80;
server_name db.qq.com;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
ssl_certificate /opt/verynginx/openresty/nginx/conf/ssl/qq.com.pem;
ssl_certificate_key /opt/verynginx/openresty/nginx/conf/ssl/qq.com.key;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_timeout 10m;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_buffer_size 1400;
ssl_stapling on;
ssl_stapling_verify on;
#安全相关设置
#防止XSS
#add_header Content-Security-Policy "default-src 'self' *.qq.com data: 'unsafe-inline';";
add_header Content-Security-Policy "frame-ancestors *.qq.com";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
#add_header X-Frame-Options "SAMEORIGIN";
add_header X-Frame-Options "ALLOW-FROM *.qq.com";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1; mode=block";
#add_header Cache-Control max-age=86400;
#Cookie设置成HttpOnly
add_header Set-Cookie "Path=/; HttpOnly; Secure";
#nginx配置动态跨域
set $cors_origin "";
if ($http_origin ~* "^(.*?).qq.com$") { set $cors_origin $http_origin; }
if ($http_origin ~* "^(.*?).qq.net$") { set $cors_origin $http_origin; }
if ($http_origin ~* "^(.*?).qq.cn$") { set $cors_origin $http_origin; }
#add_header 'Access-Control-Allow-Origin' $cors_origin always;
more_set_headers "Access-Control-Allow-Origin: $cors_origin";
add_header 'Access-Control-Allow-Credentials' 'true' always;
#add_header 'Access-Control-Request-Method' 'GET,POST,PUT,DELETE,OPTIONS,PATCH' always;
add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization' always;
if ($request_method = "OPTIONS") {
return 204;
}
server_name db.qq.com;
error_log /data/wwwlogs/db_error_nginx.log error;
index index.html index.htm index.php;
root /data/wwwroot/database.qq.com;
# if ($ssl_protocol = "") { return 301 https://$host$request_uri; }
#if ($http_x_forwarded_host != '') { return 403; }
#防止XSS，下面3行
add_header Strict-Transport-Security max-age=0;
add_header Content-Security-Policy "upgrade-insecure-requests";
add_header Access-Control-Allow-Origin *;
# expires $expires;
#error_page 404 /404.html;
#error_page 502 /502.html;
# location ~ [^/]\.php(/|$) {
# #fastcgi_pass 127.0.0.1:9000;
# fastcgi_pass unix:/dev/shm/php5.6-cgi.sock;
# fastcgi_index index.php;
# include fastcgi.conf;
# fastcgi_split_path_info ^(.+\.php)(/.+)$;
# fastcgi_param PATH_INFO $fastcgi_path_info;
# fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
# #fastcgi_param PHP_VALUE "auto_prepend_file=/data/tmp/WAF/test.php";
# proxy_pass http://iii.qq.com;
# }
set $xrequestid $request_id;
location / {
# expires 10d;
include agent_deny.conf;
include blocksip.conf;
set $flag 0;
if ( $request_uri !~* "(gif|jpg|jpeg|bmp|png|ico|txt|js|css|json|font|errors)" ) {
set $flag "${flag}1";
}
# if ($http_user_agent !~* "qihoobot|spider|Baiduspider|Googlebot|Googlebot-Mobile|Googlebot-Image|Mediapartners-Google|Adsbot-Google|Feedfetcher-Google|Yahoo! Slurp|Yahoo! Slurp China|YoudaoBot|Sosospider|Sogou spider|Sogou web spider|MSNBot|ia_archiver|Tomato Bot") {
# set $flag "${flag}1";
# }
if ($flag = "01"){
#access_by_lua_file "/opt/verynginx/openresty/nginx/conf/lua/gate_gap.txt.feige";
access_by_lua_file "/opt/verynginx/openresty/nginx/conf/lua/db.yaozh.com.lua";
}
if ($flag != "01"){
expires 10d;
}
#if ( $request_uri !~* "(gif|jpg|jpeg|bmp|png|ico|txt|js|css|json|font|errors)" ) {
# access_by_lua_file "/opt/verynginx/openresty/nginx/conf/lua/gate_gap.txt.feige";
#}
#if ( $request_uri ~* "(gif|jpg|jpeg|bmp|png|ico|txt|js|css|json|font|errors)" ) {
# expires 10d;
#}
if ($uri ~ "^/(index.php/|)(other/vipinternal.html|other/vipexternal)$"){
set $rule_0 1$rule_0;
}
if ($rule_0 = "1"){
rewrite ^/(.*)?$ http://$server_name/$1 redirect;
}
# if (!-e $request_filename) {
# rewrite ^(.*)$ /index.php?s=$1 last;
# break;
# }
proxy_set_header xrequestid $xrequestid;
proxy_headers_hash_max_size 51200;
proxy_headers_hash_bucket_size 6400;
#proxy_set_header Host $host;
#proxy_set_header Host $proxy_host;
proxy_set_header Host $host:$proxy_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_pass http://iii.qq.com;
}
#
# location ~ /\.ht {
# deny all;
# }
# location ~ /\.git {
# deny all;
# }
}
upstream iii.qq.com{
# ip_hash;
server 10.81.44.201:9989 weight=2;
server 10.46.228.27:9989 weight=2;
server 10.81.44.54:9989 weight=2;
# server 10.29.189.185:9989 weight=2;
}
===================================================================
lsb_vip配置
upstream lsbvip.qq.com{
# ip_hash;
server 10.81.44.201:9990 weight=2;
server 10.46.228.27:9990 weight=2;
server 10.81.44.54:9990 weight=2;
}
server {
listen 80;
listen 443 ssl http2;
ssl_certificate /opt/verynginx/openresty/nginx/conf/ssl/qq.com.pem;
ssl_certificate_key /opt/verynginx/openresty/nginx/conf/ssl/qq.com.key;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_timeout 10m;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_buffer_size 1400;
ssl_stapling on;
ssl_stapling_verify on;
#安全相关设置
#防止XSS
#add_header Content-Security-Policy "default-src 'self' *.qq.com data: 'unsafe-inline';";
add_header Content-Security-Policy "frame-ancestors *.qq.com";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
#add_header X-Frame-Options "SAMEORIGIN";
add_header X-Frame-Options "ALLOW-FROM *.qq.com";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1; mode=block";
#add_header Cache-Control max-age=86400;
#Cookie设置成HttpOnly
add_header Set-Cookie "Path=/; HttpOnly; Secure";
#nginx配置动态跨域
set $cors_origin "";
if ($http_origin ~* "^(.*?).qq.com$") { set $cors_origin $http_origin; }
if ($http_origin ~* "^(.*?).qq.net$") { set $cors_origin $http_origin; }
if ($http_origin ~* "^(.*?).qq.cn$") { set $cors_origin $http_origin; }
#add_header 'Access-Control-Allow-Origin' $cors_origin always;
more_set_headers "Access-Control-Allow-Origin: $cors_origin";
add_header 'Access-Control-Allow-Credentials' 'true' always;
#add_header 'Access-Control-Request-Method' 'GET,POST,PUT,DELETE,OPTIONS,PATCH' always;
add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization' always;
if ($request_method = "OPTIONS") {
return 204;
}
server_name vip.qq.com viptkm.qq.com;
root /data/wwwroot/vip.qq.com/dist;
# access_log off;
index index.html index.htm index.php;
if ($ssl_protocol = "") { return 301 https://$host$request_uri; }
if ($http_x_forwarded_host != '') { return 403; }
set $xrequestid $request_id;
#expires $expires;
location / {
# if (!-e $request_filename) {
# #rewrite ^/api/(.*)$ /api/index.php?s=$1 last;
# rewrite ^(.*)$ /index.html last;
# break;
# }
set $flag 0;
if ( $request_uri !~* "(gif|jpg|jpeg|bmp|png|ico|txt|js|css|json|font|errors|login)" ) {
set $flag "${flag}1";
}
# if ($http_user_agent !~* "qihoobot|spider|Baiduspider|Googlebot|Googlebot-Mobile|Googlebot-Image|Mediapartners-Google|Adsbot-Google|Feedfetcher-Google|Yahoo! Slurp|Yahoo! Slurp China|YoudaoBot|Sosospider|Sogou spider|Sogou web spider|MSNBot|ia_archiver|Tomato Bot") {
# set $flag "${flag}1";
# }
if ($flag = "01"){
access_by_lua_file "/opt/verynginx/openresty/nginx/conf/lua/vip.qq.com.lua";
}
if ($flag != "01"){
expires 10d;
}
proxy_set_header xrequestid $xrequestid;
#proxy_headers_hash_max_size 51200;
#proxy_headers_hash_bucket_size 6400;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#proxy_set_header Upgrade $http_upgrade;
#proxy_set_header Connection "upgrade";
proxy_pass http://lsbvip.qq.com;
}
# location /clinbest {
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_pass https://vipbd.qq.com/;
# }
location /index.html {
#禁止缓存，每次都从服务器请求
add_header Cache-Control "no-cache, no-store";
}
# location /api {
# proxy_pass https://apidb.qq.com/;
# }
# location ~ [^/]\.php(/|$) {
# #fastcgi_pass remote_php_ip:9000;
# fastcgi_pass unix:/dev/shm/php-cgi.sock;
# fastcgi_index index.php;
# include fastcgi.conf;
# }
location ~ /\.ht {
deny all;
}
location ~ /\.git {
deny all;
}
}
===================================================================
nginx.conf配置
user www www;
worker_processes auto;
error_log /data/wwwlogs/error_nginx.log error;
pid /var/run/nginx.pid;
worker_rlimit_nofile 655350;
events {
use epoll;
worker_connections 655350;
accept_mutex off; #关闭为小鸡抢占，可以提供吞吐量
multi_accept on;
}
#include /opt/verynginx/verynginx/nginx_conf/in_external.conf;
stream {
include /opt/verynginx/openresty/nginx/conf/ports/*.conf;
}
http {
include mime.types;
default_type application/octet-stream;
server_names_hash_bucket_size 128;
client_header_buffer_size 64k;
large_client_header_buffers 4 64k;
client_max_body_size 1024m;
client_body_buffer_size 20m;
sendfile on;
tcp_nopush on;
keepalive_timeout 120;
server_tokens off;
tcp_nodelay on;
#隐藏nginx后端服务X-Powered-By头
proxy_hide_header X-Powered-By;
proxy_hide_header Server;
fastcgi_connect_timeout 600;
fastcgi_send_timeout 600;
fastcgi_read_timeout 600;
fastcgi_buffer_size 128k;
fastcgi_buffers 4 128k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
fastcgi_intercept_errors on;
#Gzip Compression
gzip on;
gzip_buffers 16 8k;
gzip_comp_level 6;
gzip_http_version 1.1;
gzip_min_length 256;
gzip_proxied any;
gzip_vary on;
gzip_types
text/xml application/xml application/atom+xml application/rss+xml application/xhtml+xml image/svg+xml
text/javascript application/javascript application/x-javascript
text/x-json application/json application/x-web-app-manifest+json
text/css text/plain text/x-component
font/opentype application/x-font-ttf application/vnd.ms-fontobject
image/x-icon;
gzip_disable "MSIE [1-6]\.(?!.*SV1)";
log_format main '^$remote_addr ^$http_x_real_ip ^$http_x_forwarded_for ^$remote_user ^$time_local ^$http_host '
'^$status ^$body_bytes_sent ^$http_referer '
'^$request ^$http_user_agent ^$request_time ^$upstream_status ^$upstream_addr ^$upstream_response_time ^$args ^$query_string ^$arg_NAME '
'^$cookie_userid ^$cookie_username ^$xrequestid';
access_log /data/wwwlogs/access_tengine.log main;
#If you have a lot of static files to serve through Nginx then caching of the files' metadata (not the actual files' contents) can save some latency.
open_file_cache max=1000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors on;
#add_header X-Frame-Options SAMEORIGIN;
include expire.conf;
# include /opt/verynginx/verynginx/nginx_conf/in_http_block.conf;
######################## default ############################
# server {
# listen 80;
# server_name _;
# index index.html index.htm index.php;
# #error_page 404 /404.html;
# #error_page 502 /502.html;
# location /nginx_status {
# stub_status on;
# access_log off;
# allow 127.0.0.1;
# deny all;
# }
# location ~ [^/]\.php(/|$) {
# #fastcgi_pass remote_php_ip:9000;
# fastcgi_pass unix:/dev/shm/php-cgi.sock;
# fastcgi_index index.php;
# include fastcgi.conf;
# }
# location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|mp4|ico)$ {
# expires 30d;
# access_log off;
# }
# location ~ .*\.(js|css)?$ {
# expires 7d;
# access_log off;
# }
# location ~ /\.ht {
# deny all;
# }
# }
########################## verynginx #############################
# server {
# listen 9999;
# include /opt/verynginx/verynginx/nginx_conf/in_server_block.conf;
# server_name 172.168.1.129; #唐昆明你要填本机ip哈哈哈;
# #access_log /data/wwwlogs/access_tengine.log main;
# #root /data/wwwroot/default;
# #root /data/text_data;
# index index.html index.htm index.php;
# location / {
# allow 106.83.0.0/16; #白名单
# allow 14.105.0.0/16; #白名单
# allow 222.182.0.0/16; #白名单
# allow 192.168.1.167/32;
# deny all;
# }
# }
########################## vhost #############################
include vhost/*.conf;
}