一些增加 Nginx 安全性的配置

防止 SSL 证书泄露域名

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
# /etc/nginx/conf.d/default.conf
server {
    listen 80 default_server;
    server_name _;
	deny all;
}

server {
    listen 443 ssl default_server;
    server_name _;
    ssl_reject_handshake on;
}

禁止 Nginx 列出文件, 隐藏版本号

1
2
3
# 在 /etc/nginx/nginx.conf 中的 http 中加入
autoindex off;
server_tokens off;

Docker compose

配置文件

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
version: "3"

services:
  nginx:
    image: nginx:alpine
    container_name: nginx
    restart: always
    networks:
      - nginx_net
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
      - ./conf.d:/etc/nginx/conf.d
      - ./certs:/etc/nginx/certs
      - ./logs:/var/log/nginx

networks:
  nginx_net:
    name: nginx_net
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16
          gateway: 172.20.0.1

执行命令

1
docker exec -it nginx /usr/sbin/nginx -s reload