admin/common-server-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 添加 Let's Encrypt SSL 证书管理

Browse Source 
- 新增独立 certbot 服务项目
- nginx 配置添加 HTTPS 8443 端口监听
- frpc.toml HTTPS 代理指向 nginx:8443
- 支持自动续签并重载 nginx
- 共享 Docker volume 传递证书
This commit is contained in:
awei
2026-09-08 11:43:34 +00:00
parent b028e6dd73
commit 58d65188a1
13 changed files with 341 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
nginx/conf.d/fastgpt.conf
View File

@@ -1,24 +1,47 @@
# HTTP -> HTTPS 重定向（ACME 验证由独立 certbot 服务处理）
server {
listen 80;
server_name fastgpt.stonelan.cn gitea.stonelan.cn image.stonelan.cn registry.stonelan.cn www.stonelan.cn;
location /.well-known/acme-challenge/ {
proxy_pass http://certbot:80;
}
location / {
return 301 https://$host$request_uri;
}
}
# HTTPS 配置
server {
listen 8443 ssl;
server_name fastgpt.stonelan.cn;
ssl_certificate /etc/letsencrypt/live/fastgpt.stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/fastgpt.stonelan.cn/privkey.pem;
# SSL 优化配置
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
location / {
proxy_pass http://10.0.3.173:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# 添加代理超时配置
proxy_connect_timeout 60s;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
# 支持大文件上传和API请求
client_max_body_size 100M;
proxy_buffering off;
# 启用gzip压缩
gzip on;
gzip_vary on;
gzip_min_length 1024;
@@ -35,4 +58,4 @@ server {
application/atom+xml
image/svg+xml;
}
}
}

16
nginx/conf.d/gitea.conf
View File

@@ -1,7 +1,19 @@
# HTTPS 配置
server {
listen 80;
listen 8443 ssl;
server_name gitea.stonelan.cn;
client_max_body_size 200m;
ssl_certificate /etc/letsencrypt/live/gitea.stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/gitea.stonelan.cn/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
location / {
proxy_pass http://gitea:3000;
proxy_connect_timeout 60s;
@@ -13,4 +25,4 @@ server {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}

20
nginx/conf.d/image.conf
View File

@@ -1,17 +1,27 @@
# HTTPS 配置
server {
listen 80;
listen 8443 ssl;
server_name image.stonelan.cn;
ssl_certificate /etc/letsencrypt/live/image.stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/image.stonelan.cn/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
location / {
proxy_pass http://10.0.3.173:3004;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# 添加代理超时配置
proxy_connect_timeout 60s;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
}
}
}

15
nginx/conf.d/registry.conf
View File

@@ -1,8 +1,19 @@
# HTTPS 配置
server {
listen 80;
listen 8443 ssl;
server_name registry.stonelan.cn;
client_max_body_size 500m;
ssl_certificate /etc/letsencrypt/live/registry.stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/registry.stonelan.cn/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
location / {
proxy_pass http://127.0.0.1:3005;
proxy_set_header Host $host;
@@ -14,4 +25,4 @@ server {
proxy_read_timeout 600s;
proxy_send_timeout 600s;
}
}
}

14
nginx/conf.d/www.conf
View File

@@ -1,7 +1,18 @@
# HTTPS 配置
server {
listen 80;
listen 8443 ssl;
server_name www.stonelan.cn;
ssl_certificate /etc/letsencrypt/live/www.stonelan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.stonelan.cn/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
location / {
proxy_pass http://10.0.3.173:8080;
proxy_set_header Host $host;
@@ -9,7 +20,6 @@ server {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# 添加代理超时配置
proxy_connect_timeout 60s;
proxy_read_timeout 600s;
proxy_send_timeout 600s;