NGINX 支援子域名和普通域名

Question

我不是 NGINX 專家，但我已經做出了我相信會起作用的更改。這是 PROD 伺服器，所以不要只是想推動它並希望得到最好的結果。

我想做的是將子網域和網域都重新導向到其各自的頁面。例如當有人進入https://example.com我需要它來做https://example.com當有人進入時https://learning.example.com我需要它去https://learning.example.com最後當有人進來時https://www.learning.example.com我需要伺服器重定向到https://learning.example.com。如果這一切都有道理的話。

我相信下面的程式碼（但可能是錯誤的）應該可以工作，但如果有人可以審查它並修復可能導致的潛在問題，我將不勝感激。

server {
        listen 80;
        listen [::]:80;
        server_name *.example.com;

        location ~ /.well-known/acme-challenge {
                allow all;
                root /var/www/html;
        }

        location / {
                return ^ https://$host$request_uri? permanent;
        }
}

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name www.example.com;

        server_tokens off;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        ssl_buffer_size 8k;

        ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

        ssl_protocols TLSv1.3 TLSv1.2;
        ssl_prefer_server_ciphers on;

        ssl_ciphers ECDH+AESGCM:ECDH+AES8:DH+3DES:!ADH:!AECDH:!MD5;

        ssl_ecdh_curve secp384r1;
        ssl_session_tickets off;

        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 8.8.8.8;

        return 301 https://$host$request_uri;
}

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name *.example.com;
        server_tokens off;

        gzip on;
        gzip_disable "MSIE [1-6]\.(?!.*SV1)";
        gzip_min_length  500;
        gzip_buffers  4 32k;
        gzip_types  text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml image/svg;
        gzip_vary on;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        ssl_buffer_size 8k;

        ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

        ssl_protocols TLSv1.3 TLSv1.2;
        ssl_prefer_server_ciphers on;

        ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

        ssl_ecdh_curve secp384r1;
        ssl_session_tickets off;

        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 8.8.8.8;

        location ~*  \.(jpg|jpeg|png|gif|ico)$ {
                expires 365d;
        }

        location / {
                try_files $uri @nodejs;
        }

        location @nodejs {
                proxy_pass http://nodejs:8080;
                add_header X-Frame-Options "SAMEORIGIN" always;
                add_header X-XSS-Protection "1; mode=block" always;
                add_header X-Content-Type-Options "nosniff" always;
                add_header Referrer-Policy "no-referrer-when-downgrade" always;
                add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
                # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
                # enable strict transport security only if you understand the implications
        }

        location /graphql {
                proxy_pass http://nodejs:8080;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header Host $host;
        }

        root /var/www/html;
        index index.html index.htm index.nginx-debian.html;
}

Answer 1

您的第二個區塊有錯誤server。

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.example.com;
    ...
    return 301 https://$host$request_uri;
}

$host在這種情況下將解析為server_name，這意味著這將導致重定向循環。

要從www.前綴重定向到沒有前綴的主機，您需要在以下位置使用正規表示式server_name：

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name ~^www\.(?<domain>.+)$;

    ...
    return 301 https://$domain$request_uri;
}

正規表示式用於捕獲裸域名，然後發出指向實際域名的重定向。