服务器配置#

1. 配置 Fail2ban 和 TuneTCP#


402 collapsed lines
1
#!/bin/bash
2
# ========================================
3
# Fail2Ban SSH 防护一键管理脚本
4
# 作者: hua hua
5
# 功能:
6
#   1. 安装并配置 Fail2Ban（封禁一年累加）
7
#   2. 查看当前 SSH 防护状态
8
#   3. 查看 Fail2Ban 日志尾部
9
#   4. 重启 Fail2Ban 服务
10
#   5. 今日攻击统计
11
#   6. 历史累计攻击统计
12
#   7. 查看详细封禁列表
13
#   8. 退出脚本
14
# ========================================
15

16
set -e
17

18
# --- 配置 ---
19
JAIL_NAME="sshd"
20
JAIL_LOCAL="/etc/fail2ban/jail.local"
21
# 主日志文件
22
LOG_FILE="/var/log/fail2ban.log"
23
# 历史日志文件（支持压缩归档）
24
LOG_FILES="/var/log/fail2ban.log*"
25

26

27
# --- 检查环境 ---
28
if [[ $EUID -ne 0 ]]; then
29
   echo "错误: 此脚本必须以 root 权限运行。"
30
   exit 1
31
fi
32

33
# --- 核心工具函数 ---
34

35
# 检测系统类型并设置 SSH 日志路径
36
detect_system() {
37
    if [ -f /etc/debian_version ]; then
38
        OS_FAMILY="debian"
39
        LOG_PATH="/var/log/auth.log"
40
    elif [ -f /etc/redhat-release ] || [ -f /etc/centos-release ] || \
41
         [ -f /etc/almalinux-release ] || [ -f /etc/rocky-release ] || \
42
         [ -f /etc/fedora-release ] || [ -f /etc/amazon-linux-release ]; then
43
        OS_FAMILY="rhel"
44
        LOG_PATH="/var/log/secure"
45
    else
46
        OS_FAMILY="unknown"
47
        LOG_PATH="/var/log/auth.log"
48
        echo "[WARN] 未识别系统类型，默认使用 ${LOG_PATH}"
49
    fi
50
}
51

52
# 将秒数转换为易读的格式 (天/小时/分钟)
53
seconds_to_readable() {
54
    local seconds=$1
55
    if [ "$seconds" -le 0 ]; then
56
        echo "即将解封"
57
        return
58
    fi
59
    local days=$((seconds / 86400))
60
    local hours=$(((seconds % 86400) / 3600))
61
    local mins=$(((seconds % 3600) / 60))
62
    echo "${days}天${hours}小时${mins}分钟"
63
}
64

65
# [已升级] 获取 IP 封禁剩余时间，精确处理累进封禁
66
get_ip_remaining() {
67
    local ip=$1
68
    local now_ts=$(date +%s)
69

70
    local log_entry=$(grep " Ban $ip" "$LOG_FILE" 2>/dev/null | grep -v "Restore" | tail -1)
71
    if [ -z "$log_entry" ]; then
72
        echo "未知 (无法从日志找到封禁记录)"
73
        return
74
    fi
75

76
    local ban_datetime=$(echo "$log_entry" | awk '{print $1" "$2}' | cut -d',' -f1)
77
    local ban_ts=$(date -d "$ban_datetime" +%s 2>/dev/null)
78
    if ! [[ "$ban_ts" =~ ^[0-9]+$ ]]; then
79
        echo "未知 (日期解析失败)"
80
        return
81
    fi
82

83
    local base_bantime=31536000
84
    local increment="false"
85
    local factor=2
86

87
    if [ -f "$JAIL_LOCAL" ]; then
88
        local config_bantime=$(grep -E "^\s*bantime\s*=" "$JAIL_LOCAL" | awk '{print $3}' | tail -n 1)
89
        if [[ "$config_bantime" =~ ^-?[0-9]+$ ]]; then
90
            base_bantime=$config_bantime
91
        fi
92
        local config_increment=$(grep -E "^\s*bantime.increment\s*=" "$JAIL_LOCAL" | awk '{print $3}' | tail -n 1)
93
        if [[ "$config_increment" == "true" ]]; then
94
            increment="true"
95
        fi
96
        local config_factor=$(grep -E "^\s*bantime.factor\s*=" "$JAIL_LOCAL" | awk '{print $3}' | tail -n 1)
97
        if [[ "$config_factor" =~ ^[0-9]+$ ]]; then
98
            factor=$config_factor
99
        fi
100
    fi
101

102
    if [ "$base_bantime" = "-1" ]; then
103
        echo "永久封禁"
104
        return
105
    fi
106

107
    local final_bantime=$base_bantime
108
    if [ "$increment" == "true" ]; then
109
        local ban_count=$(grep " Ban $ip" "$LOG_FILE" 2>/dev/null | grep -v "Restore" | wc -l)
110
        if [ "$ban_count" -gt 1 ]; then
111
            for ((i=1; i<ban_count; i++)); do
112
                final_bantime=$((final_bantime * factor))
113
            done
114
        fi
115
    fi
116

117
    local unban_ts=$((ban_ts + final_bantime))
118
    local remaining_seconds=$((unban_ts - now_ts))
119
    local readable_remaining=$(seconds_to_readable $remaining_seconds)
120
    local unban_date=$(date -d @"$unban_ts" "+%Y-%m-%d %H:%M:%S")
121

122
    echo "$ip → 剩余: $readable_remaining (解封: $unban_date)"
123
}
124

125
# --- 菜单功能函数 ---
126

127
# 1. 安装并配置 Fail2Ban
128
install_fail2ban() {
129
    detect_system
130
    echo "=============================="
131
    echo "[INFO] 开始安装 Fail2Ban..."
132
    echo "=============================="
133

134
    if [ "$OS_FAMILY" = "debian" ]; then
135
        apt-get update -y && apt-get install -y fail2ban
136
    elif [ "$OS_FAMILY" = "rhel" ]; then
137
        yum install -y epel-release && yum install -y fail2ban
138
    else
139
        echo "[ERROR] 未知系统类型，请手动安装 Fail2Ban"
140
        exit 1
141
    fi
142

143
    if [ -f "$JAIL_LOCAL" ]; then
144
        cp "$JAIL_LOCAL" "${JAIL_LOCAL}.bak_$(date +%F_%T)"
145
        echo "[INFO] 旧配置已备份至 ${JAIL_LOCAL}.bak_..."
146
    fi
147

148
    echo "[INFO] 写入新配置文件..."
149
    cat > "$JAIL_LOCAL" <<EOF
150
[sshd]
151
enabled = true
152
ignoreip = 127.0.0.1/8
153
filter = sshd
154
port = ssh
155
maxretry = 6
156
findtime = 300
157
bantime = 31536000
158
bantime.increment = true
159
bantime.factor = 2
160
bantime.rndtime = 300
161
bantime.overalljails = true
162
action = %(action_)s
163
banaction = iptables-multiport
164
logpath = ${LOG_PATH}
165
EOF
166

167
    echo "[INFO] 启动并设置 Fail2Ban 开机自启..."
168
    systemctl enable fail2ban
169
    systemctl restart fail2ban
170
    sleep 2
171
    echo "=============================="
172
    echo "安装完成！当前状态："
173
    fail2ban-client status "$JAIL_NAME" || echo "[WARN] Fail2Ban 未能成功启动，请检查配置。"
174
    echo "=============================="
175
}
176

177
# 2. 查看当前 SSH 防护状态
178
view_status() {
179
    echo "=============================="
180
    echo "[INFO] 当前 SSH 防护状态："
181
    echo "=============================="
182
    fail2ban-client status "$JAIL_NAME" 2>/dev/null || echo "[WARN] Fail2Ban 服务未运行或 '$JAIL_NAME' 监狱不存在。"
183
}
184

185
# 3. 查看 Fail2Ban 日志尾部
186
view_logs() {
187
    echo "=============================="
188
    echo "[INFO] 最近 50 行 Fail2Ban 日志："
189
    echo "=============================="
190
    if [ -f "$LOG_FILE" ]; then
191
        tail -n 50 "$LOG_FILE"
192
    else
193
        echo "[WARN] 日志文件不存在: $LOG_FILE"
194
    fi
195
}
196

197
# 4. 重启 Fail2Ban 服务
198
restart_service() {
199
    echo "[INFO] 正在重启 Fail2Ban 服务..."
200
    systemctl restart fail2ban
201
    sleep 2
202
    systemctl status fail2ban --no-pager -l | grep "Active:"
203
}
204

205
# 5. 今日攻击统计
206
attack_stats_today() {
207
    echo "=============================="
208
    echo "[INFO] 今日攻击统计 (基于 Fail2Ban 日志)"
209
    echo "=============================="
210

211
    if [ ! -f "$LOG_FILE" ]; then
212
        echo "[WARN] 日志文件不存在：$LOG_FILE"
213
        return
214
    fi
215

216
    # 获取今日日期，格式：YYYY-MM-DD
217
    local TODAY=$(date +"%Y-%m-%d")
218

219
    # 统计今日 Found 次数
220
    local FAIL_COUNT=$(grep "$TODAY" "$LOG_FILE" | grep "Found" | wc -l)
221
    echo "今日尝试失败次数: ${FAIL_COUNT}"
222
    echo ""
223
    echo "今日失败 IP 排行 (Top 10):"
224
    grep "$TODAY" "$LOG_FILE" | grep "Found" \
225
        | awk '{for(i=1;i<=NF;i++){if($i ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/){print $i}}}' \
226
        | sort | uniq -c | sort -nr | head -n 10 \
227
        | awk '{printf "    %-15s %s 次\n", $2, $1}'
228
}
229

230
# 6. 历史累计攻击统计
231
attack_stats_total() {
232
    echo "=============================="
233
    echo "[INFO] 历史累计攻击统计 (基于 Fail2Ban 日志)"
234
    echo "=============================="
235

236
    # 使用 LOG_FILES 支持压缩归档日志
237
    local TOTAL_COUNT=$(zgrep "Found" $LOG_FILES 2>/dev/null | wc -l)
238
    echo "历史尝试失败总次数: ${TOTAL_COUNT}"
239
    echo ""
240
    echo "历史失败 IP 排行 (Top 10):"
241
    zgrep "Found" $LOG_FILES 2>/dev/null \
242
        | awk '{for(i=1;i<=NF;i++){if($i ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/){print $i}}}' \
243
        | sort | uniq -c | sort -nr | head -n 10 \
244
        | awk '{printf "    %-15s %s 次\n", $2, $1}'
245
}
246

247
# 辅助函数：读取所有日志文件（包括压缩文件）
248
_read_all_logs() {
249
    for logfile in $LOG_FILES; do
250
        if [ -f "$logfile" ]; then
251
            if [[ "$logfile" =~ \.(gz|bz2|xz)$ ]]; then
252
                zcat "$logfile" 2>/dev/null
253
            else
254
                cat "$logfile" 2>/dev/null
255
            fi
256
        fi
257
    done
258
}
259

260
# 7. 查看详细封禁列表
261
view_detailed_ban_list() {
262
    echo "=============================="
263
    echo "[INFO] 详细封禁列表"
264
    echo "=============================="
265
    echo "正在分析日志，请稍候..."
266

267
    mapfile -t banned_ips < <(
268
        fail2ban-client status "$JAIL_NAME" 2>/dev/null \
269
        | grep "Banned IP list:" \
270
        | sed 's/.*Banned IP list:[[:space:]]*//' \
271
        | tr ' ' '\n' \
272
        | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' \
273
        | sort -u
274
    )
275

276
    if [ ${#banned_ips[@]} -eq 0 ]; then
277
        echo "当前没有被封禁的IP。"
278
        return
279
    fi
280

281
    declare -a ip_info_list
282
    for ip in "${banned_ips[@]}"; do
283
        # 获取用于排序的信息: unban_ts|ban_ts|formatted_output
284
        local info_line=$(_get_ip_sortable_info "$ip")
285
        if [ -n "$info_line" ]; then
286
            ip_info_list+=("$info_line")
287
        fi
288
    done
289

290
    echo ""
291
    echo "--- 即将解封的IP (Top 10) ---"
292
    IFS=$'\n'
293
    local sorted_by_unban=($(sort -t'|' -k1,1n <<<"${ip_info_list[*]}"))
294
    unset IFS
295
    if [ ${#sorted_by_unban[@]} -eq 0 ]; then
296
        echo "无"
297
    else
298
        for ((i=0; i<${#sorted_by_unban[@]} && i<10; i++)); do
299
            echo "${sorted_by_unban[i]}" | cut -d'|' -f3
300
        done
301
    fi
302

303
    echo ""
304
    echo "--- 最近被封禁的IP (Last 10) ---"
305
    IFS=$'\n'
306
    local sorted_by_ban=($(sort -t'|' -k2,2nr <<<"${ip_info_list[*]}"))
307
    unset IFS
308
    if [ ${#sorted_by_ban[@]} -eq 0 ]; then
309
        echo "无"
310
    else
311
        for ((i=0; i<${#sorted_by_ban[@]} && i<10; i++)); do
312
            echo "${sorted_by_ban[i]}" | cut -d'|' -f3
313
        done
314
    fi
315
}
316

317
# 详细列表功能的辅助函数，返回带时间戳的信息用于排序
318
_get_ip_sortable_info() {
319
    local ip=$1
320
    local now_ts=$(date +%s)
321

322
    # 从所有日志文件中搜索最后一条Ban记录
323
    local log_entry=$(_read_all_logs | grep " Ban $ip" | grep -v "Restore" | tail -1)
324
    [ -z "$log_entry" ] && return
325

326
    local ban_datetime=$(echo "$log_entry" | awk '{print $1" "$2}' | cut -d',' -f1)
327
    local ban_ts=$(date -d "$ban_datetime" +%s 2>/dev/null)
328
    ! [[ "$ban_ts" =~ ^[0-9]+$ ]] && return
329

330
    local base_bantime=31536000
331
    local increment="false"
332
    local factor=2
333

334
    if [ -f "$JAIL_LOCAL" ]; then
335
        local config_bantime=$(grep -E "^\s*bantime\s*=" "$JAIL_LOCAL" | awk '{print $3}' | tail -n 1)
336
        [[ "$config_bantime" =~ ^-?[0-9]+$ ]] && base_bantime=$config_bantime
337
        local config_increment=$(grep -E "^\s*bantime.increment\s*=" "$JAIL_LOCAL" | awk '{print $3}' | tail -n 1)
338
        [[ "$config_increment" == "true" ]] && increment="true"
339
        local config_factor=$(grep -E "^\s*bantime.factor\s*=" "$JAIL_LOCAL" | awk '{print $3}' | tail -n 1)
340
        [[ "$config_factor" =~ ^[0-9]+$ ]] && factor=$config_factor
341
    fi
342

343
    if [ "$base_bantime" = "-1" ]; then
344
        echo "9999999999|$ban_ts|$ip → 剩余: 永久封禁"
345
        return
346
    fi
347

348
    local final_bantime=$base_bantime
349
    if [ "$increment" == "true" ]; then
350
        # 从所有日志文件中统计Ban次数
351
        local ban_count=$(_read_all_logs | grep " Ban $ip" | grep -v "Restore" | wc -l)
352
        if [ "$ban_count" -gt 1 ]; then
353
            for ((i=1; i<ban_count; i++)); do
354
                final_bantime=$((final_bantime * factor))
355
            done
356
        fi
357
    fi
358

359
    local unban_ts=$((ban_ts + final_bantime))
360
    local remaining_seconds=$((unban_ts - now_ts))
361
    local readable_remaining=$(seconds_to_readable $remaining_seconds)
362
    local unban_date=$(date -d @"$unban_ts" "+%Y-%m-%d %H:%M:%S")
363
    local formatted_output="$ip → 剩余: $readable_remaining (解封: $unban_date)"
364
    echo "$unban_ts|$ban_ts|$formatted_output"
365
}
366

367
# --- 主菜单 ---
368
show_menu() {
369
    clear
370
    echo "============================================="
371
    echo "      Fail2Ban SSH 防护一键管理脚本 (v2.0)"
372
    echo "============================================="
373
    echo " 1. 安装并配置 Fail2Ban"
374
    echo " 2. 查看 SSH 防护状态"
375
    echo " 3. 查看 Fail2Ban 日志尾部"
376
    echo " 4. 重启 Fail2Ban 服务"
377
    echo " 5. 今日攻击统计"
378
    echo " 6. 历史累计攻击统计"
379
    echo " 7. 查看详细封禁列表"
380
    echo " 8. 退出脚本"
381
    echo "---------------------------------------------"
382
    read -p "请输入选项 [1-8]: " choice
383

384
    case "$choice" in
385
        1) install_fail2ban ;;
386
        2) view_status ;;
387
        3) view_logs ;;
388
        4) restart_service ;;
389
        5) attack_stats_today ;;
390
        6) attack_stats_total ;;
391
        7) view_detailed_ban_list ;;
392
        8) echo "退出脚本。"; exit 0 ;;
393
        *) echo "无效选项，请输入 1-8 之间的数字。"; sleep 1 ;;
394
    esac
395

396
    echo ""
397
    read -p "按 Enter 键返回主菜单..."
398
    show_menu
399
}
400

401
# --- 脚本入口 ---
402
show_menu


616 collapsed lines
1
#!/bin/bash
2
set -euo pipefail
3

4
# =========================================================
5
# TuneTCP - TCP参数优化工具
6
# 作者: Yuju
7
# 功能: 自动检测并优化TCP参数，启用BBR拥塞控制
8
# =========================================================
9

10
# 颜色定义
11
readonly RED='\033[1;31m'
12
readonly GREEN='\033[1;32m'
13
readonly YELLOW='\033[1;33m'
14
readonly BLUE='\033[1;34m'
15
readonly PURPLE='\033[1;35m'
16
readonly CYAN='\033[1;36m'
17
readonly WHITE='\033[1;37m'
18
readonly RESET='\033[0m'
19

20
# 日志目录
21
readonly LOG_FILE="/var/log/tunetcp.log"
22

23
# 输出函数
24
log() { echo "$(date '+%Y-%m-%d %H:%M:%S') - $*" >> "$LOG_FILE"; }
25
info() { echo -e "${BLUE}[INFO]${RESET} $*" >&2; log "INFO: $*"; }
26
success() { echo -e "${GREEN}[SUCCESS]${RESET} $*" >&2; log "SUCCESS: $*"; }
27
warning() { echo -e "${YELLOW}[WARNING]${RESET} $*" >&2; log "WARNING: $*"; }
28
error() { echo -e "${RED}[ERROR]${RESET} $*" >&2; log "ERROR: $*"; exit 1; }
29

30
# 检查root权限
31
check_root() {
32
    [[ $EUID -eq 0 ]] || error "请以root权限运行此脚本"
33
}
34

35
# 检测操作系统类型
36
check_os() {
37
    if [[ -f /etc/os-release ]]; then
38
        . /etc/os-release
39
        echo "${ID:-unknown}"
40
    elif command -v lsb_release >/dev/null 2>&1; then
41
        lsb_release -si | tr '[:upper:]' '[:lower:]'
42
    else
43
        echo "unknown"
44
    fi
45
}
46

47
# 检查内核版本
48
check_kernel_version() {
49
    local kernel_version
50
    kernel_version=$(uname -r | cut -d. -f1-2)
51
    local major minor
52
    major=$(echo "$kernel_version" | cut -d. -f1)
53
    minor=$(echo "$kernel_version" | cut -d. -f2)
54

55
    if [[ $major -lt 4 ]] || [[ $major -eq 4 && $minor -lt 9 ]]; then
56
        warning "内核版本 ${kernel_version} 可能不完全支持BBR，建议升级到4.9+"
57
        return 1
58
    fi
59
    success "内核版本 ${kernel_version} 支持BBR"
60
    return 0
61
}
62

63
# 创建备份目录
64
create_backup_dir() {
65
    local timestamp=$(date +%Y%m%d-%H%M%S)
66
    local backup_base="/etc/tunetcp-backup"
67
    local backup_dir="$backup_base/$timestamp"
68

69
    # 创建基础目录
70
    mkdir -p "$backup_base"
71

72
    # 返回备份路径，但暂不创建具体目录
73
    echo "$backup_dir"
74
}
75
# 添加实际创建备份目录的函数
76
ensure_backup_dir() {
77
    local backup_dir="$1"
78
    if [[ ! -d "$backup_dir" ]]; then
79
        mkdir -p "$backup_dir"
80
        info "创建备份目录: $backup_dir"
81
    fi
82
}
83
# 内存检测
84
check_mem() {
85
    local mem_bytes
86
    if [[ -r /proc/meminfo ]]; then
87
        mem_bytes=$(awk '/^MemTotal:/ {print $2 * 1024}' /proc/meminfo)
88
    elif command -v free >/dev/null 2>&1; then
89
        mem_bytes=$(free -b | awk 'NR==2 {print $2}')
90
    elif [[ -r /proc/meminfo ]]; then
91
        mem_bytes=$(grep '^MemTotal:' /proc/meminfo | awk '{print $2 * 1024}')
92
    else
93
        error "无法获取内存信息：系统不支持"
94
        return 1
95
    fi
96
    if [[ ! "$mem_bytes" =~ ^[0-9]+$ ]] || (( mem_bytes < 134217728 )); then  # 最小128MB
97
        error "获取的内存信息无效: ${mem_bytes:-"空值"} bytes"
98
        return 1
99
    fi
100
    printf "%.2f" $((mem_bytes * 100 / 1073741824))e-2
101
}
102

103
rtt_test() {
104
    local ping_target=""
105
    local ping_desc=""
106
    local -a dns_servers=("1.1.1.1" "8.8.8.8" "223.5.5.5" "114.114.114.114")
107
    local timeout_duration=5
108
    local ping_count=3
109
    local default_rtt=50
110
    validate_ip() {
111
        local ip="$1"
112
        if [[ $ip =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
113
            local IFS='.'
114
            local -a ip_parts=($ip)
115
            for part in "${ip_parts[@]}"; do
116
                [[ $part -le 255 ]] || return 1
117
            done
118
            return 0
119
        fi
120
        return 1
121
    }
122
    ping_target_host() {
123
        local target="$1"
124
        local desc="$2"
125

126
        info "正在测试到 ${desc} 的延迟..."
127
        local ping_output
128
        if ping_output=$(timeout "$timeout_duration" ping -c "$ping_count" -W 2 -i 0.5 "$target" 2>/dev/null); then
129
            local rtt
130
            if command -v bc >/dev/null 2>&1; then
131
                rtt=$(echo "$ping_output" | awk -F'[=/]' '/rtt|round-trip/ {print $5}' | head -1)
132
            else
133
                rtt=$(echo "$ping_output" | awk -F'[=/]' '/rtt|round-trip/ {printf "%.0f", $5}' | head -1)
134
            fi
135

136
            if [[ "$rtt" =~ ^[0-9]+(\.[0-9]+)?$ ]] && (( $(echo "$rtt > 0" | bc -l 2>/dev/null || echo "1") )); then
137
                success "检测到平均RTT: ${rtt} ms"
138
                printf "%.0f" "$rtt"
139
                return 0
140
            fi
141
        fi
142

143
        warning "Ping ${target} 失败或结果无效"
144
        return 1
145
    }
146
    test_multiple_targets() {
147
        local -a targets=("$@")
148
        local rtt_sum=0
149
        local valid_tests=0
150
        local -a results=()
151
        info "使用多个DNS服务器测试网络延迟..."
152

153
        for target in "${targets[@]}"; do
154
            local rtt
155
            if rtt=$(timeout "$timeout_duration" ping -c "$ping_count" -W 2 -i 0.5 "$target" 2>/dev/null | \
156
                     awk -F'[=/]' '/rtt|round-trip/ {printf "%.1f", $5; exit}'); then
157

158
                if [[ "$rtt" =~ ^[0-9]+(\.[0-9]+)?$ ]] && (( $(echo "$rtt > 0" | bc -l 2>/dev/null || echo "1") )); then
159
                    if command -v bc >/dev/null 2>&1; then
160
                        rtt_sum=$(echo "$rtt_sum + $rtt" | bc -l)
161
                    else
162
                        rtt_sum=$(awk -v sum="$rtt_sum" -v rtt="$rtt" 'BEGIN {print sum + rtt}')
163
                    fi
164
                    ((valid_tests++))
165
                    results+=("DNS ${target}: ${rtt} ms")
166
                    info "DNS ${target}: ${rtt} ms"
167
                else
168
                    warning "DNS ${target} 测试结果解析失败"
169
                fi
170
            else
171
                warning "DNS ${target} 连接超时或失败"
172
            fi
173
        done
174

175
        if [[ $valid_tests -gt 0 ]]; then
176
            local avg_rtt
177
            if command -v bc >/dev/null 2>&1; then
178
                avg_rtt=$(echo "scale=0; $rtt_sum / $valid_tests" | bc -l)
179
            else
180
                avg_rtt=$(awk -v sum="$rtt_sum" -v count="$valid_tests" 'BEGIN {printf "%.0f", sum / count}')
181
            fi
182

183
            success "平均RTT (${valid_tests}个有效测试): ${avg_rtt} ms"
184
            echo "$avg_rtt"
185
            return 0
186
        fi
187

188
        return 1
189
    }
190
    if [[ -n "${SSH_CONNECTION:-}" ]]; then
191
        ping_target=$(echo "$SSH_CONNECTION" | awk '{print $1}')
192
        if validate_ip "$ping_target"; then
193
            ping_desc="SSH 客户端 ${ping_target}"
194
            info "检测到SSH连接，客户端IP: ${ping_target}"
195
        else
196
            warning "SSH连接IP格式无效: $ping_target"
197
            ping_target=""
198
        fi
199
    fi
200
    if [[ -z "$ping_target" ]]; then
201
        info "未检测到有效SSH连接，请提供测试目标"
202
        local client_ip
203
        read -r -p "请输入客户机IP (回车使用多个公共DNS测试): " client_ip
204

205
        if [[ -n "$client_ip" ]]; then
206
            if validate_ip "$client_ip"; then
207
                ping_target="$client_ip"
208
                ping_desc="客户机IP ${ping_target}"
209
            else
210
                warning "输入的IP地址格式无效: $client_ip"
211
                ping_target=""
212
            fi
213
        fi
214
    fi
215
    if [[ -n "$ping_target" ]]; then
216
        if ping_target_host "$ping_target" "$ping_desc"; then
217
            return 0
218
        fi
219
        warning "目标 ${ping_target} 测试失败，转为使用DNS服务器测试"
220
    fi
221
    if test_multiple_targets "${dns_servers[@]}"; then
222
        return 0
223
    fi
224
    warning "所有网络测试失败，使用默认值 ${default_rtt}ms"
225
    echo "$default_rtt"
226
    return 1
227
}
228

229

230
# 智能带宽检测
231
detect_bandwidth() {
232
    local bandwidth=1000  # 默认带宽值 (Mbps)
233
    local default_iface
234
    default_iface=$(ip -o -4 route show to default 2>/dev/null | awk '{print $5}' | head -1)
235

236
    if [[ -n "$default_iface" && -r "/sys/class/net/$default_iface/speed" ]]; then
237
        local speed
238
        speed=$(cat "/sys/class/net/$default_iface/speed" 2>/dev/null)
239

240
        if [[ "$speed" =~ ^[0-9]+$ && $speed -gt 0 && $speed -ne 4294967295 ]]; then
241
            bandwidth=$speed
242
            info "检测到网卡 ${default_iface} 速度: ${speed} Mbps"
243
        else
244
            info "网卡 ${default_iface} 速度检测失败 (值: ${speed:-未知})，使用默认值 ${bandwidth} Mbps"
245
        fi
246
    else
247
        info "无法读取网卡速度信息，使用默认值 ${bandwidth} Mbps"
248
    fi
249

250
    echo "$bandwidth"
251
}
252

253
# 验证参数有效性
254
validate_params() {
255
    local mem_g="$1"
256
    local bw_mbps="$2"
257
    local rtt_ms="$3"
258

259
    # 内存检查 (0.5GB - 1024GB)
260
    if ! awk -v m="$mem_g" 'BEGIN {exit (m >= 0.5 && m <= 1024) ? 0 : 1}'; then
261
        error "内存参数无效: ${mem_g} GiB (应在 0.5-1024 范围内)"
262
    fi
263

264
    # 带宽检查 (1Mbps - 100Gbps)
265
    if ! awk -v b="$bw_mbps" 'BEGIN {exit (b >= 1 && b <= 100000) ? 0 : 1}'; then
266
        error "带宽参数无效: ${bw_mbps} Mbps (应在 1-100000 范围内)"
267
    fi
268

269
    # RTT检查 (1ms - 1000ms)
270
    if ! awk -v r="$rtt_ms" 'BEGIN {exit (r >= 1 && r <= 1000) ? 0 : 1}'; then
271
        error "RTT参数无效: ${rtt_ms} ms (应在 1-1000 范围内)"
272
    fi
273
}
274

275
# 高级缓冲区计算
276
calculate_buffers() {
277
    local mem_g="$1"
278
    local bw_mbps="$2"
279
    local rtt_ms="$3"
280

281
    # BDP计算: 带宽 * RTT
282
    local bdp_bytes
283
    bdp_bytes=$(awk -v bw="$bw_mbps" -v rtt="$rtt_ms" 'BEGIN{ printf "%.0f", bw * 125 * rtt }')
284

285
    # 内存限制: 总内存的3%
286
    local mem_bytes ram_limit
287
    mem_bytes=$(awk -v g="$mem_g" 'BEGIN{ printf "%.0f", g * 1024^3 }')
288
    ram_limit=$(awk -v m="$mem_bytes" 'BEGIN{ printf "%.0f", m * 0.03 }')
289

290
    # 系统限制: 64MB (避免过度消耗内存)
291
    local sys_limit=$((64 * 1024 * 1024))
292

293
    # 最终缓冲区大小: min(2*BDP, 3%RAM, 64MB)
294
    local max_buffer
295
    max_buffer=$(awk -v bdp="$bdp_bytes" -v ram="$ram_limit" -v sys="$sys_limit" '
296
        BEGIN {
297
            max_buf = bdp * 2
298
            if (ram < max_buf) max_buf = ram
299
            if (sys < max_buf) max_buf = sys
300
            printf "%.0f", max_buf
301
        }')
302

303
    # 缓冲区分档 (便于管理)
304
    local max_mb buffer_mb
305
    max_mb=$((max_buffer / 1024 / 1024))
306

307
    if [[ $max_mb -ge 64 ]]; then buffer_mb=64
308
    elif [[ $max_mb -ge 32 ]]; then buffer_mb=32
309
    elif [[ $max_mb -ge 16 ]]; then buffer_mb=16
310
    elif [[ $max_mb -ge 8 ]]; then buffer_mb=8
311
    elif [[ $max_mb -ge 4 ]]; then buffer_mb=4
312
    else buffer_mb=4
313
    fi
314

315
    local final_bytes=$((buffer_mb * 1024 * 1024))
316

317
    # 返回计算结果
318
    echo "$bdp_bytes $final_bytes $buffer_mb"
319
}
320

321
# 优化的冲突处理
322
handle_conflicts() {
323
    local backup_dir="$1"
324
    local key_regex='^[[:space:]]*net\.(core\.(default_qdisc|rmem_max|wmem_max|rmem_default|wmem_default)|ipv4\.tcp_(rmem|wmem|congestion_control))[[:space:]]*='
325
    local backup_created=false
326

327
    info "处理配置冲突..."
328

329
    # 备份并处理 /etc/sysctl.conf
330
    if [[ -f "/etc/sysctl.conf" ]]; then
331
        if grep -Eq "$key_regex" "/etc/sysctl.conf"; then
332
            ensure_backup_dir "$backup_dir"
333
            backup_created=true
334
            cp "/etc/sysctl.conf" "$backup_dir/sysctl.conf.orig"
335
            info "已备份 /etc/sysctl.conf"
336
            # ... 其余处理逻辑保持不变
337
        fi
338
    fi
339

340
    # 处理 /etc/sysctl.d/ 中的其他文件
341
    if [[ -d "/etc/sysctl.d" ]]; then
342
        local target_file="/etc/sysctl.d/yuju-net-bbr-fq.conf"
343
        for conf_file in /etc/sysctl.d/*.conf; do
344
            [[ -f "$conf_file" ]] || continue
345
            [[ "$(readlink -f "$conf_file" 2>/dev/null)" == "$(readlink -f "$target_file" 2>/dev/null)" ]] && continue
346

347
            if grep -Eq "$key_regex" "$conf_file"; then
348
                if [[ "$backup_created" == false ]]; then
349
                    ensure_backup_dir "$backup_dir"
350
                    backup_created=true
351
                fi
352
                local basename_file=$(basename "$conf_file")
353
                cp "$conf_file" "$backup_dir/$basename_file"
354
                if mv "$conf_file" "$conf_file.disabled-by-tunetcp"; then
355
                    info "已禁用冲突文件: $conf_file"
356
                else
357
                    warning "无法禁用文件: $conf_file"
358
                fi
359
            fi
360
        done
361
    fi
362

363
    # 如果没有实际备份，返回空字符串
364
    if [[ "$backup_created" == false ]]; then
365
        echo ""
366
    else
367
        echo "$backup_dir"
368
    fi
369
}
370

371
# 应用网络优化配置
372
apply_optimization() {
373
    local buffer_bytes="$1"
374
    local buffer_mb="$2"
375
    local mem_g="$3"
376
    local bw_mbps="$4"
377
    local rtt_ms="$5"
378
    local bdp_bytes="$6"
379

380
    local config_file="/etc/sysctl.d/yuju-net-bbr-fq.conf"
381

382
    # 根据缓冲区大小设置默认值
383
    local def_rmem def_wmem
384
    if [[ $buffer_mb -ge 32 ]]; then
385
        def_rmem=262144; def_wmem=524288
386
    elif [[ $buffer_mb -ge 8 ]]; then
387
        def_rmem=131072; def_wmem=262144
388
    else
389
        def_rmem=131072; def_wmem=131072
390
    fi
391

392
    # TCP缓冲区参数
393
    local tcp_rmem_min=4096 tcp_rmem_def=87380 tcp_rmem_max=$buffer_bytes
394
    local tcp_wmem_min=4096 tcp_wmem_def=65536 tcp_wmem_max=$buffer_bytes
395

396
    info "生成优化配置..."
397

398
    # 生成配置文件
399
    cat > "$config_file" <<EOF
400
# TuneTCP Auto-generated Configuration
401
# Generated: $(date)
402
# Parameters: MEM=${mem_g}GiB, BW=${bw_mbps}Mbps, RTT=${rtt_ms}ms
403
# BDP: ${bdp_bytes} bytes (~$(awk -v b="$bdp_bytes" 'BEGIN{ printf "%.2f", b/1024/1024 }') MB)
404
# Buffer Size: ${buffer_mb} MB
405

406
# BBR拥塞控制
407
net.core.default_qdisc = fq
408
net.ipv4.tcp_congestion_control = bbr
409

410
# 核心网络缓冲区
411
net.core.rmem_default = ${def_rmem}
412
net.core.wmem_default = ${def_wmem}
413
net.core.rmem_max = ${buffer_bytes}
414
net.core.wmem_max = ${buffer_bytes}
415

416
# TCP缓冲区配置
417
net.ipv4.tcp_rmem = ${tcp_rmem_min} ${tcp_rmem_def} ${tcp_rmem_max}
418
net.ipv4.tcp_wmem = ${tcp_wmem_min} ${tcp_wmem_def} ${tcp_wmem_max}
419

420
# TCP优化选项
421
net.ipv4.tcp_mtu_probing = 1
422
net.ipv4.tcp_fastopen = 3
423
net.ipv4.tcp_slow_start_after_idle = 0
424
net.ipv4.tcp_notsent_lowat = 16384
425

426
# 连接跟踪优化 (适用于高并发)
427
net.netfilter.nf_conntrack_max = 1048576
428
net.netfilter.nf_conntrack_tcp_timeout_established = 1200
429

430
# 其他网络优化
431
net.core.netdev_max_backlog = 5000
432
net.ipv4.tcp_max_syn_backlog = 8192
433
net.core.somaxconn = 32768
434
EOF
435

436
    success "配置文件已生成: $config_file"
437

438
    # 应用配置
439
    info "应用sysctl配置..."
440
    if sysctl --system >/dev/null 2>&1; then
441
        success "sysctl配置应用成功"
442
    else
443
        error "sysctl配置应用失败"
444
    fi
445

446
    # 配置网络接口队列
447
    local default_iface
448
    default_iface=$(ip -o -4 route show to default 2>/dev/null | awk '{print $5}' | head -1)
449

450
    if command -v tc >/dev/null 2>&1 && [[ -n "$default_iface" ]]; then
451
        info "配置接口 ${default_iface} 的队列调度..."
452
        if tc qdisc replace dev "$default_iface" root fq 2>/dev/null; then
453
            success "接口队列配置成功"
454
        else
455
            warning "接口队列配置失败 (可能需要重启生效)"
456
        fi
457
    fi
458
}
459

460
# 显示优化结果
461
show_results() {
462
    local mem_g="$1"
463
    local bw_mbps="$2"
464
    local rtt_ms="$3"
465
    local bdp_bytes="$4"
466
    local buffer_mb="$5"
467

468
    local bdp_mb
469
    bdp_mb=$(awk -v b="$bdp_bytes" 'BEGIN{ printf "%.2f", b/1024/1024 }')
470

471
    echo
472
    echo "==== [ TuneTCP 优化结果 ] ===="
473
    echo
474

475
    # 参数摘要
476
    echo -e "${GREEN}[+] 优化参数摘要${RESET}"
477
    printf "    - %-15s : %s\n" "内存大小" "${mem_g} GiB"
478
    printf "    - %-15s : %s\n" "网络带宽" "${bw_mbps} Mbps"
479
    printf "    - %-15s : %s\n" "网络延迟" "${rtt_ms} ms"
480
    printf "    - %-15s : %s\n" "计算BDP" "${bdp_mb} MB"
481
    printf "    - %-15s : %s\n" "缓冲区大小" "${buffer_mb} MB"
482
    echo
483

484
    # 当前配置验证
485
    echo -e "${GREEN}[+] 当前配置验证${RESET}"
486
    printf "    - %-25s : %s\n" "TCP拥塞控制" "$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null || echo '未知')"
487
    printf "    - %-25s : %s\n" "默认队列调度" "$(sysctl -n net.core.default_qdisc 2>/dev/null || echo '未知')"
488
    printf "    - %-25s : %s\n" "最大接收缓冲区" "$(sysctl -n net.core.rmem_max 2>/dev/null || echo '未知')"
489
    printf "    - %-25s : %s\n" "最大发送缓冲区" "$(sysctl -n net.core.wmem_max 2>/dev/null || echo '未知')"
490
    echo
491

492
    # 网络接口状态
493
    local default_iface
494
    default_iface=$(ip -o -4 route show to default 2>/dev/null | awk '{print $5}' | head -1)
495
    if command -v tc >/dev/null 2>&1 && [[ -n "$default_iface" ]]; then
496
        echo -e "${GREEN}[+] 网络接口状态${RESET}"
497
        printf "    - %-15s : %s\n" "默认接口" "$default_iface"
498
        local queue_type
499
        queue_type=$(tc qdisc show dev "$default_iface" 2>/dev/null | head -1 | awk '{print $2}' || echo "未知")
500
        printf "    - %-15s : %s\n" "队列类型" "$queue_type"
501
        echo
502
    fi
503

504
    echo -e "${CYAN}备份文件位置: ${backup_dir}${RESET}"
505
    echo -e "${CYAN}配置文件位置: /etc/sysctl.d/yuju-net-bbr-fq.conf${RESET}"
506
    echo -e "${CYAN}日志文件位置: $LOG_FILE${RESET}"
507
    echo "=================================="
508
}
509

510
# 主函数
511
main() {
512
    echo -e "${CYAN}"
513
    echo "╔══════════════════════════════════════════════════╗"
514
    echo "║            智能TCP网络参数优化工具               ║"
515
    echo "╚══════════════════════════════════════════════════╝"
516
    echo -e "${RESET}"
517

518
    # 权限检查
519
    check_root
520

521
    # 系统检查
522
    local os_type
523
    os_type=$(check_os)
524
    info "检测到操作系统: $os_type"
525

526
    check_kernel_version || warning "建议升级内核以获得更好的BBR支持"
527

528
    # 创建备份目录
529
    local backup_dir
530
    backup_dir=$(create_backup_dir)
531
    info "备份目录: $backup_dir"
532

533
    # 自动检测参数
534
    info "正在自动检测系统参数..."
535
    local mem_g bw_mbps rtt_ms
536
    mem_g=$(check_mem)
537
    bw_mbps=$(detect_bandwidth)
538
    rtt_ms=$(rtt_test)
539

540
    success "自动检测完成"
541

542
    # 参数确认循环
543
    while true; do
544
        clear
545
        echo -e "${CYAN}╔══════════════════════════════════════════════════════════════════╗${RESET}"
546
        echo -e "${WHITE}                        网络参数配置确认                          ${RESET}"
547
        echo -e "${CYAN}╠══════════════════════════════════════════════════════════════════╣${RESET}"
548
        echo -e "${WHITE} 1.${RESET} 内存大小     : ${GREEN}${mem_g} GiB${RESET} ${WHITE}(系统自动检测)${RESET}"
549
        echo -e "${WHITE} 2.${RESET} 网络带宽     : ${GREEN}${bw_mbps} Mbps${RESET} ${WHITE}(智能检测)${RESET}"
550
        echo -e "${WHITE} 3.${RESET} 网络延迟     : ${GREEN}${rtt_ms} ms${RESET} ${WHITE}(网络测试)${RESET}"
551
        echo -e "${CYAN}╚══════════════════════════════════════════════════════════════════╝${RESET}"
552

553
        local preview_result
554
        preview_result=$(calculate_buffers "$mem_g" "$bw_mbps" "$rtt_ms")
555
        local bdp_bytes buffer_bytes buffer_mb
556
        read -r bdp_bytes buffer_bytes buffer_mb <<< "$preview_result"
557
        local bdp_mb
558
        bdp_mb=$(awk -v b="$bdp_bytes" 'BEGIN{ printf "%.2f", b/1024/1024 }')
559
        echo
560

561
        read -r -p "按 [Enter] 应用优化, 输入 [1-3] 修改参数, [q] 退出: " choice
562

563
        case "$choice" in
564
            "")
565
                validate_params "$mem_g" "$bw_mbps" "$rtt_ms"
566
                info "参数验证通过，开始优化..."
567
                break
568
                ;;
569
            1)
570
                read -r -p "请输入内存大小 (GiB) [${mem_g}]: " new_mem
571
                [[ -n "$new_mem" ]] && mem_g="$new_mem"
572
                ;;
573
            2)
574
                read -r -p "请输入网络带宽 (Mbps) [${bw_mbps}]: " new_bw
575
                [[ -n "$new_bw" ]] && bw_mbps="$new_bw"
576
                ;;
577
            3)
578
                read -r -p "请输入网络延迟 (ms) [${rtt_ms}]: " new_rtt
579
                [[ -n "$new_rtt" ]] && rtt_ms="$new_rtt"
580
                ;;
581
            q|Q)
582
                info "用户取消操作"
583
                exit 0
584
                ;;
585
            *)
586
                warning "无效输入，请重试"
587
                sleep 1
588
                ;;
589
        esac
590
    done
591

592
    # 执行优化
593
    local result
594
    result=$(calculate_buffers "$mem_g" "$bw_mbps" "$rtt_ms")
595
    read -r bdp_bytes buffer_bytes buffer_mb <<< "$result"
596

597
    # 处理配置冲突
598
    handle_conflicts "$backup_dir"
599

600
    # 加载BBR模块
601
    if command -v modprobe >/dev/null 2>&1; then
602
        modprobe tcp_bbr 2>/dev/null || warning "BBR模块加载失败，可能已内置"
603
    fi
604

605
    # 应用优化配置
606
    apply_optimization "$buffer_bytes" "$buffer_mb" "$mem_g" "$bw_mbps" "$rtt_ms" "$bdp_bytes"
607

608
    # 显示结果
609
    show_results "$mem_g" "$bw_mbps" "$rtt_ms" "$bdp_bytes" "$buffer_mb"
610

611
    success "TCP优化配置完成！"
612
    info "重启系统后所有优化将完全生效"
613
}
614

615
# 执行主函数
616
main "$@"

TuneTCP.sh的代码来自~~此仓库~~（目前已被删除，原因未知）。
把上面那两段代码分别保存到名为 fail2ban-manager.sh 和 TuneTCP.sh 的文件中

1
chmod +x ./fail2ban-manager.sh
2
chmod +x ./TuneTCP.sh
3
./fail2ban-manager.sh
4
./TuneTCP.sh

2. 配置 SSH 密钥登录（可选）#

1
ssh-keygen -t rsa -b 4096 -f ~/.ssh/<你的密钥名字>
2
cd ~/.ssh/
3
cat <你的密钥名字>.pub >> authorized_keys

将密钥 <你的密钥名字> 复制到本地机器的 C:\Users\<用户名>\.ssh 目录。

在该目录下的 config 文件末尾添加以下配置：

1
Host <任意命名>
2
  HostName <服务器ip>
3
  Port 22
4
  User root
5
  IdentityFile C:\Users\<用户名>\.ssh\<你的密钥名字>

3. 安装 Docker#

1
bash <(curl -sL 'https://get.docker.com')

4. 安装 acme.sh#

1
curl https://get.acme.sh | sh -s email=<你的邮箱>
2
ln -s ~/.acme.sh/acme.sh /usr/local/bin/acme.sh
3
acme.sh --version

5. 申请域名证书#

1
export CF_Token="xxx"
2
export CF_Account_ID="xxx"
3
acme.sh --issue --dns dns_cf -d example.com -d '*.example.com'

CF_TOKEN 和 CF_Account_ID 的获取可参考acme官方文档

6. 申请自签名证书（openssl）#

1
# 1. 创建存放证书的目录
2
mkdir -p /www/ssl
3
cd /www/ssl
4

5
# 2. 生成私钥（2048 位 RSA）
6
openssl genrsa -out selfsigned.key.pem 2048
7

8
# 3. 生成自签证书（有效期 100 年示例）
9
openssl req -x509 -new -nodes -key selfsigned.key.pem \
10
    -sha256 -days 36500 \
11
    -out selfsigned.cert.pem \
12
    -subj "/C=CN/ST=Shanghai/L=Shanghai/O=MyServer/CN=fake.local"

7. 在 Docker 中配置 Nginx#

1
mkdir -p /root/nginx/{log,conf.d,html} /www/ssl /root/cert
2
touch /root/nginx/nginx.conf


85 collapsed lines
1
user www-data;
2
worker_processes auto;
3
worker_cpu_affinity auto;
4
pid /run/nginx.pid;
5
error_log /var/log/nginx/error.log;
6
include /etc/nginx/modules-enabled/*.conf;
7

8
events {
9
  worker_connections 768;
10
  # multi_accept on;
11
}
12

13
http {
14

15
  ##
16
  # Basic Settings
17
  ##
18

19
  sendfile on;
20
  tcp_nopush on;
21
  types_hash_max_size 2048;
22
  server_tokens build; # Recommended practice is to turn this off
23

24
  # server_names_hash_bucket_size 64;
25
  # server_name_in_redirect off;
26

27
  include /etc/nginx/mime.types;
28
  default_type application/octet-stream;
29

30
  ##
31
  # SSL Settings
32
  ##
33

34
  ssl_protocols TLSv1.2 TLSv1.3; # Dropping SSLv3 (POODLE), TLS 1.0, 1.1
35
  ssl_prefer_server_ciphers off; # Don't force server cipher order.
36

37
  ##
38
  # Logging Settings
39
  ##
40

41
  access_log /var/log/nginx/access.log;
42

43
  ##
44
  # Gzip Settings
45
  ##
46

47
  gzip on;
48

49
  # gzip_vary on;
50
  # gzip_proxied any;
51
  # gzip_comp_level 6;
52
  # gzip_buffers 16 8k;
53
  # gzip_http_version 1.1;
54
  # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
55

56
  ##
57
  # Virtual Host Configs
58
  ##
59

60
  include /etc/nginx/conf.d/*.conf;
61
  # include /etc/nginx/sites-enabled/*;
62

63
}
64

65

66
#mail {
67
#  # See sample authentication script at:
68
#  # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
69
#
70
#  # auth_http localhost/auth.php;
71
#  # pop3_capabilities "TOP" "USER";
72
#  # imap_capabilities "IMAP4rev1" "UIDPLUS";
73
#
74
#  server {
75
#    listen     localhost:110;
76
#    protocol   pop3;
77
#    proxy      on;
78
#  }
79
#
80
#  server {
81
#    listen     localhost:143;
82
#    protocol   imap;
83
#    proxy      on;
84
#  }
85
#}


44 collapsed lines
1
server {
2
    listen       80;
3
    listen  [::]:80;
4
    server_name  localhost;
5

6
    #access_log  /var/log/nginx/host.access.log  main;
7

8
    location / {
9
        root   /usr/share/nginx/html;
10
        index  index.html index.htm;
11
    }
12

13
    #error_page  404              /404.html;
14

15
    # redirect server error pages to the static page /50x.html
16
    #
17
    error_page   500 502 503 504  /50x.html;
18
    location = /50x.html {
19
        root   /usr/share/nginx/html;
20
    }
21

22
    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
23
    #
24
    #location ~ \.php$ {
25
    #    proxy_pass   http://127.0.0.1;
26
    #}
27

28
    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
29
    #
30
    #location ~ \.php$ {
31
    #    root           html;
32
    #    fastcgi_pass   127.0.0.1:9000;
33
    #    fastcgi_index  index.php;
34
    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
35
    #    include        fastcgi_params;
36
    #}
37

38
    # deny access to .htaccess files, if Apache's document root
39
    # concurs with nginx's one
40
    #
41
    #location ~ /\.ht {
42
    #    deny  all;
43
    #}
44
}


29 collapsed lines
1
# =====================
2
# HTTP 重定向到 HTTPS
3
# =====================
4
server {
5
    listen 80 default_server;
6
    listen [::]:80 default_server;
7
    server_name _;
8

9
    location / {
10
        return 301 https://$host$request_uri;  # 强制重定向到 HTTPS
11
    }
12
}
13

14
# =====================
15
# 未知域名返回 404
16
# =====================
17
server {
18
    listen 443 ssl default_server;
19
    listen [::]:443 ssl default_server;
20
    http2 on;
21
    server_name _;
22

23
    ssl_certificate /etc/nginx/ssl/selfsigned.cert.pem;
24
    ssl_certificate_key /etc/nginx/ssl/selfsigned.key.pem;
25

26
    location / {
27
        return 404;
28
    }
29
}


23 collapsed lines
1
<!DOCTYPE html>
2
<html>
3
<head>
4
<title>Welcome to nginx!</title>
5
<style>
6
html { color-scheme: light dark; }
7
body { width: 35em; margin: 0 auto;
8
font-family: Tahoma, Verdana, Arial, sans-serif; }
9
</style>
10
</head>
11
<body>
12
<h1>Welcome to nginx!</h1>
13
<p>If you see this page, the nginx web server is successfully installed and
14
working. Further configuration is required.</p>
15

16
<p>For online documentation and support please refer to
17
<a href="http://nginx.org/">nginx.org</a>.<br/>
18
Commercial support is available at
19
<a href="http://nginx.com/">nginx.com</a>.</p>
20

21
<p><em>Thank you for using nginx.</em></p>
22
</body>
23
</html>

把上面那四段代码分别保存到名为 /root/nginx/nginx.conf、 /root/nginx/conf.d/default.conf、 /root/nginx/conf.d/redirect.conf 和 /root/nginx/html/index.html 的文件中。
运行以下命令启动 Nginx 容器：

1
docker run --name nginx \
2
  -p 80:80 \
3
  -p 443:443 \
4
  -v /root/nginx/log:/var/log/nginx \
5
  -v /root/nginx/nginx.conf:/etc/nginx/nginx.conf:ro \
6
  -v /root/nginx/conf.d:/etc/nginx/conf.d:ro \
7
  -v /www/ssl:/etc/nginx/ssl:ro \
8
  -v /root/nginx/html:/usr/share/nginx/html:ro \
9
  -v /root/cert:/etc/nginx/cert:ro \
10
  --add-host=host.docker.internal:host-gateway \
11
  --restart=unless-stopped \
12
  -d nginx

8. 配置证书#

在获取证书并配置 Nginx 后，使用以下命令配置证书：

1
acme.sh --install-cert -d example.com \
2
  --key-file /www/ssl/example.com.key.pem \
3
  --fullchain-file /www/ssl/example.com.cert.pem \
4
  --reloadcmd "docker exec nginx nginx -s reload"

9. 安装其他子域名证书#

创建新目录并安装子域名证书：

1
mkdir -p ~/cert
2
cd ~/cert
3
mkdir -p sub.example.com
4
acme.sh --issue --dns dns_cf -d sub.example.com
5
acme.sh --install-cert -d sub.example.com \
6
  --key-file /root/cert/sub.example.com/privkey.pem \
7
  --fullchain-file /root/cert/sub.example.com/fullchain.pem \
8
  --reloadcmd "docker exec nginx nginx -s reload"

为第二个子域名执行相同的操作：

1
acme.sh --issue --dns dns_cf -d sub2.example.com
2
mkdir -p sub2.example.com
3
acme.sh --install-cert -d sub2.example.com \
4
  --key-file /root/cert/sub2.example.com/privkey.pem \
5
  --fullchain-file /root/cert/sub2.example.com/fullchain.pem \
6
  --reloadcmd "docker exec nginx nginx -s reload"