海运的博客

nginx配置webdav及使用curl测试

发布时间:February 2, 2021 // 分类:Nginx // No Comments

需安装http-dav-ext扩展,有时使用非标准webdav客户端删除目录时最后不带/,nginx删除目录失败返回409,alias不支持rewrite使用root。

  location /webdav/ {
    satisfy any;
    allow 127.0.0.1;
    deny all;
    #root /;
    #if (-d $request_filename) { rewrite ^(.*[^/])$ $1/ break; }
    alias /webdav/;
    dav_methods PUT DELETE MKCOL COPY MOVE;
    dav_ext_methods PROPFIND OPTIONS;
    dav_access user:rw group:r all:r;
    create_full_put_path  on;
    port_in_redirect off;
    autoindex on;
    autoindex_localtime on;
    charset utf-8;
    auth_basic "Login";
    auth_basic_user_file htpasswd;
  }

配置nginx webdav不同用户使用不同的家目录:

map $remote_user $home {
  default      $remote_user;
  ''           guest;
}
server {
  listen 80 default_server;
  listen [::]:80 default_server;
  server_name _;

  root /var/www/html;
  index index.html index.htm index.nginx-debian.html;

  try_files $uri /;

  location / {
    #if (-d $request_filename) { rewrite ^(.*[^/])$ $1/ break; }
    alias /data/webdav/$home/;
    #dav_methods PUT DELETE MKCOL COPY MOVE;
    dav_ext_methods PROPFIND OPTIONS;
    dav_access user:r group:r all:r;
    create_full_put_path on;
    port_in_redirect off;
    autoindex on;
    autoindex_localtime on;
    charset utf-8;
    auth_basic "Login";
    auth_basic_user_file htpasswd;
  }

  #access_log off;
  access_log /var/log/nginx/webdav.log;
  error_log  /var/log/nginx/webdav_error.log;
}

使用curl测试webdav:
新建目录,注意最后一定要带/,不然返回409,MKCOL can create a collection only

curl -X MKCOL https://www.haiyun.me/webdav/test/

上传文件:

curl -T filename https://www.haiyun.me/webdav/

重命名文件:

curl -X MOVE --header 'Destination:https://www.haiyun.me/webdav/newname' https://www.haiyun.me/webdav/filename

删除文件:

curl -X DELETE https://www.haiyun.me/webdav/filename

typecho配置nginx使用fastcgi cache缓存加速

发布时间:December 16, 2020 // 分类:Nginx // No Comments

安装nginx依赖扩展,当typecho更新时调用http-cache-purge删除缓存,当命中缓存时调用lua清除set-cookie head,防止缓存的设置cookie header发送给所有人。

apt install libnginx-mod-http-cache-purge libnginx-mod-http-lua

http内添加:

    fastcgi_cache_path /dev/shm/fastcgi_cache_dir levels=1:2 keys_zone=phpcache:100m inactive=30d max_size=200M;
    fastcgi_temp_path /dev/shm/fastcgi_cache_dir/temp;
    fastcgi_cache_use_stale error timeout invalid_header http_500;
    fastcgi_ignore_headers Cache-Control Expires Set-Cookie;

修改server段:

  set $skip_cache 0;
  #跳过缓存,post请求
  if ($request_method = POST) {
    set $skip_cache 1;
  }
  #url包含参数
  if ($query_string != "") {
    set $skip_cache 1;
  }
  #指定url
  if ($request_uri ~* ^(/admin/|/action/|/search/|/feed/)) {
    set $skip_cache 1;
  }
  #登录用户
  if ($http_cookie ~* "typecho_authCode") {
    set $skip_cache 1;
  }
  #$uri经过重写后会改变,通过lua提前复制到$permalink
  set_by_lua_block $permalink {
    return ngx.var.uri
  }
  location ~ .*\.php$
  {
    try_files $uri =404;
    astcgi_pass  127.0.0.1:9000;
    fastcgi_index index.php;
    include fastcgi.conf;

    fastcgi_cache_key $scheme$request_method$host$permalink;
    add_header Cache-State $upstream_cache_status;
    fastcgi_cache_bypass $skip_cache;
    fastcgi_no_cache $skip_cache;
    fastcgi_cache phpcache;
    fastcgi_cache_valid 200 301 302 30d;

    log_by_lua_file "/etc/nginx/ngx_lua_reqstatus/hook.lua";
    header_filter_by_lua_block {
      --if ngx.status == ngx.HTTP_OK then
        --ngx.header['Cache-State'] = ngx.var.upstream_cache_status
      --end
      if ngx.var.upstream_cache_status == "HIT" then
        ngx.header['Set-Cookie'] = nil
      end
    }
  }

  location ~ /xxx/_clean_cache(/.*) {
      fastcgi_cache_purge phpcache "$scheme$request_method$host$1";
  }

typecho清除缓存插件:
https://github.com/typecho-fans/plugins/tree/master/Ncache
typecho默认在用户评论后会在cookie内设置用户名和邮箱信息,并在服务端读取cookie在html内写入相关信息,这样用户信息被缓存所有人都可以看到,可参考下面方法修改模板用js读取cookie内用户信息。
https://cuojue.org/read/typecho_comments_author_javascript.html

ubuntu 20.04下nginx不支持tls1.0/tls1.1解决

发布时间:December 16, 2020 // 分类:Nginx // No Comments

在ubuntu 20.04下配置nginx ssl时怎么不支持tls1.0/1.1,确认配置文件无误怀疑是openssl的问题,原来是ubuntu 20.04/openssl 1.1.1默认禁用了不安全的tls协议,可以修改openssl配置文件开启。
patch:

--- openssl.cnf 2020-12-26 10:54:59.000000000 +0800
+++ /etc/ssl/openssl.cnf        2020-12-26 11:28:20.406439168 +0800
@@ -11,6 +11,8 @@
 # defined.
 HOME                   = .
 
+openssl_conf = default_conf
+
 # Extra OBJECT IDENTIFIER info:
 #oid_file              = $ENV::HOME/.oid
 oid_section            = new_oids
@@ -348,3 +350,13 @@
                                # (optional, default: no)
 ess_cert_id_alg                = sha1  # algorithm to compute certificate
                                # identifier (optional, default: sha1)
+
+[default_conf]
+ssl_conf = ssl_sect
+
+[ssl_sect]
+system_default = system_default_sect
+
+[system_default_sect]
+MinProtocol = TLSv1
+CipherString = DEFAULT:@SECLEVEL=1

或直接修改配置文件,openssl.cnf首部添加:

sed -i '1i openssl_conf = default_conf' /etc/ssl/openssl.cnf

尾部添加:

cat >> /etc/ssl/openssl.cnf << EOF
[default_conf]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1
CipherString = DEFAULT:@SECLEVEL=1
EOF

使用openssl测试是否支持tls1.0和1.1:

openssl s_client -connect www.haiyun.me:443 -tls1_1
openssl s_client -connect www.haiyun.me:443 -tls1

参考:
https://askubuntu.com/questions/1233186/ubuntu-20-04-how-to-set-lower-ssl-security-level

Nginx [emerg] listen() to 0.0.0.0:80, backlog 511 failed (98: Address already in use)

发布时间:December 26, 2014 // 分类:Nginx // No Comments

Nginx更新后经常遇到这样的问题,解决方法:

fuser -k 80/tcp && /etc/init.d/nginx start
或
killall -9 nginx && /etc/init.d/nginx start

The plain HTTP request was sent to HTTPS port

发布时间:December 6, 2014 // 分类:Nginx // No Comments

Nginx配置80和443端口在同一server段时不要这样设置:

listen       80;
listen       443;
ssl on;

应该在443端口后添加ssl:

listen       80;
listen       443 ssl;

有时后端PHP要判断HTTPS:

fastcgi_param HTTPS $https if_not_empty;
分类
最新文章
最近回复
  • Jimmy: 方法一 nghtp3步骤需要改成如下才能编译成功: git clone https://git...
  • 海运: 地址格式和udpxy一样,udpxy和msd_lite能用这个就能用。
  • 1: 怎么用 编译后的程序在家里路由器内任意一台设备上运行就可以吗?比如笔记本电脑 m参数是笔记本的...
  • 孤狼: ups_status_set: seems that UPS [BK650M2-CH] is ...
  • 孤狼: 擦。。。。apcupsd会失联 nut在冲到到100的时候会ONBATT进入关机状态,我想想办...
  • 海运: 网络,找到相应的url编辑重发请求,firefox有此功能,其它未知。
  • knetxp: 用浏览器F12网络拦截或监听后编辑重发请求,修改url中的set为set_super,将POS...
  • Albert: 啊啊啊啊啊啊啊啊啊 我太激动了,终于好了英文区搜索了半天,翻遍了 pve 论坛没找到好方法,博...
  • jiangker: good, very helpful to me
  • fengfeng: N1 armbian 能有编译下内核吗。。我要开启can 不懂怎么操作