Nginx: build JudgeNode (virtual host)

[morris821028]

在 /etc/nginx/sites-available 下建立 judgegirl 的資訊，目前將 Nodejs 開在 port 4000。host domain name 為 apponline.tw，預期使用 judgegirl.apponline.tw 連入。

root@tts:/etc/nginx/sites-available# cat judgegirl
upstream nodejs {
        server 127.0.0.1:4000 max_fails=0;
}

server {
        listen 80;
        server_name judgegirl.apponline.tw;


      location / {
        proxy_pass  http://127.0.0.1:4000;
      }
   }

複製一份連結到 /etc/nginx/sites-available 目錄下

$ cd /etc/nginx/sites-enabled
$ ln -s /etc/nginx/sites-available/judgegirl .

測試 nginx 設定檔案是否可行

$ sudo nginx -t

如果測試成功，直接重開 nginx 服務

$ service nginx restart

之後再測試 https port 443 的情況。

[morris821028]

/etc/nginx/sites-available/judgegirl

#upstream nodejs {
#       server 127.0.0.1:4000 max_fails=0;
#}

server {
        listen 80;
        server_name judgegirl.apponline.tw;
        return 301 https://$server_name$request_uri;
}

server {
    listen       443;
    server_name  judgegirl.apponline.tw;
    ssl                  on;
    ssl_session_timeout  5m;
    ssl_certificate      /etc/nginx/ssl/judgegirl.crt;
    ssl_certificate_key  /etc/nginx/ssl/judgegirl.key.unsecure;
    ssl_protocols  SSLv2 SSLv3 TLSv1;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers   on;

    location / {
# THESE ARE IMPORTANT
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# This is what tells Connect that your session can be considered secure,
# even though the protocol node.js sees is only HTTP:
proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;
        proxy_read_timeout 5m;
        proxy_connect_timeout 5m;
        proxy_pass http://127.0.0.1:4000;
        proxy_redirect off;
    }
}

sudo openssl genrsa -des3 -out server.key 2048
sudo openssl req -new -key server.key -out server.csr
sudo openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
sudo openssl rsa -in server.key -out server.key.unsecure

root:/etc/nginx/ssl# ls
judgegirl.crt  judgegirl.csr  judgegirl.key  judgegirl.key.unsecure