Pomelo Lee workspace

 
server
      {
        listen       443;
        server_name proxypay.xx.com;
 
        ssl on;
        ssl_certificate     /etc/nginx/1_proxypay.xx.com_bundle.crt;
        ssl_certificate_key /etc/nginx/2_proxypay.xx.com.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;
 
 
        location / {
            proxy_pass https://pay.xx.com/;
            proxy_ssl_certificate     /etc/nginx/1_pay.xx.com_bundle.crt;
            proxy_ssl_certificate_key /etc/nginx/2_pay.xx.com.key;
        }
   }

server {
  listen 80;
  server_name 127.0.0.1 192。168.1.8 xxx.com;
  if ($http_Host !~* ^192.168.1.8|127.0.0.1|xx.com$)
  {
    return 403;
  }
}

if ($request_method !~* GET|POST|PUT|DELETE) {
  return 403;
}

Sets the root directory for requests. For example, with the following configuration
location /i/ {
    root /data/w3;
}
The /data/w3/i/top.gif file will be sent in response to the “/i/top.gif” request

Defines a replacement for the specified location. For example, with the following configuration
location /i/ {
    alias /data/w3/images/;
}
on request of “/i/top.gif”, the file /data/w3/images/top.gif will be sent.

location /api/v1/upload {  
     alias /home/v1/upload/;  
}

1.核查版本
#sbin/nginx -V #查看版本
2.下载
#wget http://nginx.org/download/nginx-1.12.0.tar.gz #下载
#tar xzvf nginx-1.12.0.tar.gz #解压缩
#cd nginx-1.12.0
 
3.编译
./configure --user=www --group=www --prefix=/usr/local/webserver/nginx --with-http_stub_status_module --with-openssl=/usr/local/webserver/openssl --with-http_ssl_module --with-pcre=/ia/data/tgz/pcre-8.32 --with-http_realip_module --with-http_image_filter_module --with-http_v2_module
 
#make
#mv /usr/local/webserver/nginx/sbin/nginx /usr/local/webserver/nginx/sbin/nginx.old #移动旧版本
#cp objs/nginx /usr/local/webserver/nginx/sbin/ #复制新版本nginx过去
 
4.启动新的，关掉旧的
让nginx把nginx.pid改成nginx.pid.oldbin 跟着启动新的nginx
# kill -USR2 `cat /usr/local/webserver/nginx/nginx.pid`
退出旧的nignx
# kill -QUIT `cat /usr/local/webserver/nginx/nginx.pid.oldbin
5.升级完成。
# sbin/nginx -V

if ($http_user_agent !~* "MSIE [5-8].[0-9]") {
        rewrite (.*) https://www.iatodo.com$1 permanent;
        break;
    }
if ($http_user_agent ~* "MSIE [5-8].[0-9]") {
        rewrite (.*) http://www.iatodo.com$1 permanent;
        break;
    }

location ^~ /.well-known/acme-challenge/ {
   default_type "text/plain";
   root     /usr/share/nginx/html;
}
 
location = /.well-known/acme-challenge/ {
   return 404;
}

./certbot-auto certonly --email username@domain --agree-tos --webroot -w /websiteroot -d domain

./certbot-auto certonly --email username@domain --agree-tos --webroot -w /websiteroot -d domain1 -d domain2

./certbot-auto certonly --email admin@vpser.net --agree-tos --webroot -w /websiteroot1 -d domain1 -d domain2 -w /websiteroot2 -d domain3 -d domain4

http {
    # ...省略一些配置
    server_tokens off;
  }

;;;;;;;;;;;;;;;;;
; Miscellaneous ;
;;;;;;;;;;;;;;;;;
 
; Decides whether PHP may expose the fact that it is installed on the server
; (e.g. by adding its signature to the Web server header).  It is no security
; threat in any way, but it makes it possible to determine whether you use PHP
; on your server or not.
; http://php.net/expose-php
expose_php = On

 server
  {
    listen     192.168.1.1:443 ssl;
    listen     192.168.1.1:80;
    server_name www.iatodo.com iatodo.com;
 
    add_header               Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
    ssl_certificate          /etc/letsencrypt/live/iatodo.com/fullchain.pem;
    ssl_certificate_key      /etc/letsencrypt/live/iatodo.com/privkey.pem;
 
    ssl_ciphers                EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
    ssl_prefer_server_ciphers  on;
 
    ssl_protocols              TLSv1 TLSv1.1 TLSv1.2;
    ssl_session_cache          shared:SSL:50m;
    ssl_session_timeout        1d;
    ssl_session_tickets        on;
 
  ......

yum -y install git

/usr/bin/python -V #查看版本

yum install zlib-devel bzip2-devel openssl-devel xz-libs wget xz