RoyirinRosmontis/Private-Proxy
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 21 Wiki Activity

添加 server_config：jp 服务器端配置（nginx/sing-box/流量监控/脚本/存档），已脱敏

Browse Source
This commit is contained in:
RRRosmontis
2026-08-23 01:50:35 +08:00
parent 00a0af03e9
commit 0df9037407
15 changed files with 2412 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server_config/nginx/conf.d/api.aeolianchi.me.conf
+19
View File
@@ -0,0 +1,19 @@
server {
listen 443 ssl;
http2 on;
server_name api.aeolianchi.me;
ssl_certificate /etc/nginx/ssl/api.aeolianchi.me/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/api.aeolianchi.me/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
location /vpn/status/traffic {
proxy_pass http://127.0.0.1:18080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
server_config/nginx/conf.d/autodiscover.aeolianchi.me.conf
+44
View File
@@ -0,0 +1,44 @@
# autodiscover.aeolianchi.me -> jp 反代 -> bj autodiscover.rrrosmontis.icu
server {
listen 80;
listen [::]:80;
server_name autodiscover.aeolianchi.me;
location /.well-known/acme-challenge/ {
root /var/www/acme;
}
location / {
return 301 https://$host$request_uri;
}
}
# autodiscover.aeolianchi.me 443 -> 反代 -> bj autodiscover.rrrosmontis.icu
server {
listen 443 ssl;
http2 on;
server_name autodiscover.aeolianchi.me;
ssl_certificate /etc/nginx/ssl/aeolianchi.me/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/aeolianchi.me/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000";
error_page 497 https://$host$request_uri;
location / {
proxy_pass https://autodiscover.rrrosmontis.icu;
proxy_set_header Host autodiscover.rrrosmontis.icu;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_ssl_server_name on;
proxy_ssl_name autodiscover.rrrosmontis.icu;
}
access_log /var/log/nginx/autodiscover.aeolianchi.me.log;
error_log /var/log/nginx/autodiscover.aeolianchi.me.error.log;
}
server_config/nginx/local_ip_rules.conf.example
+4
View File
@@ -0,0 +1,4 @@
# nginx 本机公网 IP 直连规则（自动生成，勿手改；由 sync-nginx-local-ips.sh 维护）
# 公网 IP 变更后本文件会被重写并 reload nginx
if ($host = "<PUBLIC_IP>") { rewrite ^(.*)$ /__local$1 last; }
if ($host = "<PUBLIC_IP>") { rewrite ^(.*)$ /__local$1 last; }
server_config/nginx/nginx.conf
+179
View File
@@ -0,0 +1,179 @@
load_module /usr/lib/nginx/modules/ngx_http_proxy_connect_module.so;
worker_processes auto;
worker_rlimit_nofile 65535;
events {
worker_connections 8192;
multi_accept on;
}
http {
server_tokens off;
resolver 8.8.8.8 ipv6=off valid=300s;
resolver_timeout 10s;
# 默认站点分流：本机/私网直连返回伪装页；其余 Host（正向代理目标）走 /__proxy 转发
# 公网 IP 无需手改：cron（sync-nginx-local-ips.sh）自动写入 local_ip_rules.conf；
# 另有 /__proxy 自代理环保护兜底，即使公网 IP 变更也不会死循环。
map $host $is_local {
default 0;
"~^(10\.|127\.|169\.254\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)" 1;
}
include mime.types;
default_type application/octet-stream;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
keepalive_requests 100;
# 80 端口：iam.aeolianchi.me 强制跳转到 HTTPS（保留 ACME 验证路径）
server {
listen 80;
server_name iam.aeolianchi.me;
location /.well-known/acme-challenge/ {
root /var/www/acme;
}
location / {
return 301 https://$host$request_uri;
}
}
# 80 端口：默认站点只做静态伪装，不提供代理、不弹认证
server {
listen 80 default_server;
server_name _;
root /var/www/html;
index index.html;
location /.well-known/acme-challenge/ {
root /var/www/acme;
}
location / {
try_files $uri $uri/ =404;
}
}
# 443 端口：iam.aeolianchi.me HTTPS 站点 + 认证 CONNECT 代理
server {
listen 443 ssl;
http2 on;
server_name iam.aeolianchi.me;
root /var/www/html;
ssl_certificate /etc/nginx/ssl/iam.aeolianchi.me/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/iam.aeolianchi.me/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
# 仅 CONNECT/正向代理需要认证，普通页面不需要
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_connect;
proxy_connect_allow 443 563;
proxy_connect_connect_timeout 60s;
proxy_connect_read_timeout 120s;
proxy_connect_send_timeout 120s;
location / {
auth_basic off;
if ($host != "iam.aeolianchi.me") {
rewrite ^ /__proxy last;
}
index index.html;
try_files $uri $uri/ =404;
}
location /__proxy {
internal;
proxy_intercept_errors on;
error_page 502 503 504 =444 @drop;
resolver 8.8.8.8 ipv6=off valid=300s;
proxy_pass $scheme://$host$request_uri;
proxy_set_header Host $host;
proxy_ssl_name $host;
proxy_ssl_server_name on;
}
location @drop {
return 444;
}
}
# 443 端口 fallback：其他 SNI 也可用 CONNECT 代理；普通 GET 只返回伪装页
server {
listen 443 ssl default_server;
http2 on;
server_name _;
ssl_certificate /etc/nginx/ssl/iam.aeolianchi.me/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/iam.aeolianchi.me/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
# 仅 CONNECT/正向代理需要认证，普通页面不需要
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_connect;
proxy_connect_allow 443 563;
proxy_connect_connect_timeout 60s;
proxy_connect_read_timeout 120s;
proxy_connect_send_timeout 120s;
location / {
auth_basic off;
# 自动判定本机：连接本地地址 / 无 Host / 私网回环 / cron 维护的公网 IP 规则
# 命中则 rewrite 到 /__local<原路径>（保留 $uri），其余走 /__proxy 转发
if ($host = $server_addr) { rewrite ^(.*)$ /__local$1 last; }
if ($host = "_") { rewrite ^(.*)$ /__local$1 last; }
if ($is_local) { rewrite ^(.*)$ /__local$1 last; }
include /etc/nginx/local_ip_rules.conf;
rewrite ^ /__proxy last;
}
# 本机 IP/域名直连：剥掉前缀后按原路径服务伪装页（保持原有行为）
location /__local {
internal;
auth_basic off;
rewrite ^/__local(.*)$ $1 break;
root /var/www/html;
index index.html;
try_files $uri $uri/ =404;
}
# 明文 HTTP 正向代理：绝对形式请求（Host=目标域名）在此转发
location /__proxy {
internal;
# 自代理环保护：转发请求带标记头，二次进入说明代理目标指向本机（未知/新公网 IP），
# 返回 508 Loop Detected 而非死循环
if ($http_x_proxy_loop_guard = "1") {
return 508;
}
proxy_set_header X-Proxy-Loop-Guard "1";
resolver 8.8.8.8 ipv6=off valid=300s;
proxy_pass http://$http_host$request_uri;
proxy_set_header Host $http_host;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_connect_timeout 10s;
proxy_read_timeout 120s;
proxy_intercept_errors on;
# 目标不可达/无法解析：直接断开连接（444），不返回任何页面
error_page 502 503 504 =444 @drop;
}
location @drop {
return 444;
}
}
include /etc/nginx/conf.d/*.conf;
}