mirror of
https://github.com/remnawave/panel.git
synced 2026-08-27 04:07:32 +00:00
docs: update Nginx guides
This commit is contained in:
Timur
GitHub
parent
6fc8ca0720
commit
e4ba348153
2 changed files with 50 additions and 56 deletions
|
|
@ -230,7 +230,7 @@ remnawave:
|
|||
// highlight-next-line-green
|
||||
volumes:
|
||||
// highlight-next-line-green
|
||||
- '/opt/remnawave/nginx:/var/lib/remnawave/configs/xray/ssl'
|
||||
- /opt/remnawave/nginx/ssl/:/var/lib/remnawave/configs/xray/ssl/:ro
|
||||
depends_on:
|
||||
remnawave-db:
|
||||
condition: service_healthy
|
||||
|
|
|
|||
|
|
@ -46,7 +46,7 @@ curl https://get.acme.sh | sh -s email=EMAIL && source ~/.bashrc
|
|||
### Create a folder for the certificates
|
||||
|
||||
```bash
|
||||
mkdir -p /opt/remnawave/nginx && cd /opt/remnawave/nginx
|
||||
mkdir -p /opt/remnawave/nginx/ssl && cd /opt/remnawave/nginx/ssl
|
||||
```
|
||||
|
||||
### Issue a certificate
|
||||
|
|
@ -58,7 +58,7 @@ Do not use domain zones: .ru, .su, .рф. Currently ZeroSSL does not support the
|
|||
:::
|
||||
|
||||
```bash
|
||||
acme.sh --issue --standalone -d 'DOMAIN' --key-file /opt/remnawave/nginx/privkey.key --fullchain-file /opt/remnawave/nginx/fullchain.pem --alpn --tlsport 8443 --reloadcmd "docker exec remnawave-nginx nginx -s reload"
|
||||
acme.sh --issue --standalone -d 'DOMAIN' --key-file /opt/remnawave/nginx/ssl/privkey.key --fullchain-file /opt/remnawave/nginx/ssl/fullchain.pem --alpn --tlsport 8443 --reloadcmd "docker exec remnawave-nginx nginx -s reload"
|
||||
```
|
||||
|
||||
:::info
|
||||
|
|
@ -68,7 +68,7 @@ Make sure that port **8443** is open on your server. It is required for certific
|
|||
|
||||
|
||||
```bash
|
||||
acme.sh --install-cert -d 'DOMAIN' --key-file /opt/remnawave/nginx/privkey.key --fullchain-file /opt/remnawave/nginx/fullchain.pem --reloadcmd "docker exec remnawave-nginx nginx -s reload"
|
||||
acme.sh --install-cert -d 'DOMAIN' --key-file /opt/remnawave/nginx/ssl/privkey.key --fullchain-file /opt/remnawave/nginx/ssl/fullchain.pem --reloadcmd "docker exec remnawave-nginx nginx -s reload"
|
||||
```
|
||||
|
||||
This shows that the certificate is issued. `Acme.sh` will take care of automatically renewing the certificate every 60 days, just make sure that you have a **8443** port open (and not busy) on your server.
|
||||
|
|
@ -77,10 +77,10 @@ This shows that the certificate is issued. `Acme.sh` will take care of automatic
|
|||
|
||||
### Simple configuration
|
||||
|
||||
Create a file called `nginx.conf` in the `/opt/remnawave/nginx` directory.
|
||||
Create a file called `remnawave.conf` in the `/opt/remnawave/nginx/conf.d` directory.
|
||||
|
||||
```bash
|
||||
cd /opt/remnawave/nginx && nano nginx.conf
|
||||
mkdir -p /opt/remnawave/nginx/conf.d && cd /opt/remnawave/nginx/conf.d && nano remnawave.conf
|
||||
```
|
||||
|
||||
Paste the following configuration.
|
||||
|
|
@ -93,7 +93,7 @@ Review the configuration below, look for red highlighted lines.
|
|||
|
||||
:::
|
||||
|
||||
```nginx title="nginx.conf"
|
||||
```nginx title="remnawave.conf"
|
||||
upstream remnawave {
|
||||
server remnawave:3000;
|
||||
}
|
||||
|
|
@ -102,9 +102,9 @@ server {
|
|||
// highlight-next-line-red
|
||||
server_name REPLACE_WITH_YOUR_DOMAIN;
|
||||
|
||||
listen 443 ssl reuseport;
|
||||
listen [::]:443 ssl reuseport;
|
||||
listen 443 ssl;
|
||||
http2 on;
|
||||
gzip on;
|
||||
|
||||
location / {
|
||||
proxy_http_version 1.1;
|
||||
|
|
@ -115,60 +115,55 @@ server {
|
|||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
# SSL Configuration (Mozilla Intermediate Guidelines)
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
|
||||
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:MozSSL:10m;
|
||||
ssl_session_tickets off;
|
||||
ssl_certificate "/etc/nginx/ssl/fullchain.pem";
|
||||
ssl_certificate_key "/etc/nginx/ssl/privkey.key";
|
||||
ssl_trusted_certificate "/etc/nginx/ssl/fullchain.pem";
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
|
||||
resolver_timeout 2s;
|
||||
|
||||
# Gzip Compression
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_buffers 16 8k;
|
||||
gzip_http_version 1.1;
|
||||
gzip_min_length 256;
|
||||
gzip_types
|
||||
application/atom+xml
|
||||
application/geo+json
|
||||
application/javascript
|
||||
application/x-javascript
|
||||
application/json
|
||||
application/ld+json
|
||||
application/manifest+json
|
||||
application/rdf+xml
|
||||
application/rss+xml
|
||||
application/xhtml+xml
|
||||
application/xml
|
||||
font/eot
|
||||
font/otf
|
||||
font/ttf
|
||||
image/svg+xml
|
||||
text/css
|
||||
text/javascript
|
||||
text/plain
|
||||
text/xml;
|
||||
}
|
||||
|
||||
# Reject unknown SNI
|
||||
server {
|
||||
listen 443 ssl default_server;
|
||||
listen [::]:443 ssl default_server;
|
||||
listen 443 ssl default_server reuseport;
|
||||
server_name _;
|
||||
|
||||
ssl_reject_handshake on;
|
||||
}
|
||||
|
||||
# Gzip Compression
|
||||
gzip_vary on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_min_length 1024;
|
||||
gzip_types
|
||||
application/javascript
|
||||
application/json
|
||||
application/manifest+json
|
||||
application/xml
|
||||
font/opentype
|
||||
font/eot
|
||||
font/otf
|
||||
font/ttf
|
||||
image/svg+xml
|
||||
text/css
|
||||
text/javascript
|
||||
text/plain
|
||||
text/xml;
|
||||
|
||||
# SSL Configuration (https://configurator.tlsref.org/#server=nginx&version=1.30&config=intermediate&openssl=3.5&ocsp)
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
# Turn off session cache and tickets
|
||||
ssl_session_cache off;
|
||||
ssl_session_tickets off;
|
||||
|
||||
# OCSP stapling
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
|
||||
resolver_timeout 2s;
|
||||
|
||||
```
|
||||
|
||||
### Create docker-compose.yml
|
||||
|
|
@ -184,13 +179,12 @@ Paste the following configuration.
|
|||
```yaml title="docker-compose.yml"
|
||||
services:
|
||||
remnawave-nginx:
|
||||
image: nginx:1.30
|
||||
image: nginx:stable
|
||||
container_name: remnawave-nginx
|
||||
hostname: remnawave-nginx
|
||||
volumes:
|
||||
- ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
|
||||
- ./fullchain.pem:/etc/nginx/ssl/fullchain.pem:ro
|
||||
- ./privkey.key:/etc/nginx/ssl/privkey.key:ro
|
||||
- ./conf.d/:/etc/nginx/conf.d/:ro
|
||||
- ./ssl/:/etc/nginx/ssl/:ro
|
||||
restart: always
|
||||
ports:
|
||||
- '0.0.0.0:443:443'
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue