（九）Docker 安装 Nginx-Https

1. 官方 hub.docker.com/_/nginx/?ta…

2. 我们下载

docker pull nginx

3. 创建挂载目录

mkdir -p /home/test/nginx-https/conf.d/cert

4. 新建/home/test/nginx-https/nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

5. 新建/home/test/nginx-https/conf.d/www.abc.com.conf

server {
  server_name www.abc.com;
  listen 80;
  rewrite ^(.*) https://$host$1 permanent;
}

server {
  server_name www.abc.com;
  listen 443 ssl;
  access_log off;
  
  ssl on;
  ssl_certificate /etc/nginx/conf.d/cert/3046340_www.abc.com.pem;
  ssl_certificate_key /etc/nginx/conf.d/cert/3046340_www.abc.com.key;
  ssl_session_cache    shared:SSL:1m;
  ssl_session_timeout  5m;
  # 指定密码为openssl支持的格式
  ssl_protocols  SSLv2 SSLv3 TLSv1.2;
  ssl_ciphers  HIGH:!aNULL:!MD5;  # 密码加密方式
  ssl_prefer_server_ciphers  on;   # 依赖SSLv3和TLSv1协议的服务器密码将优先于客户端密码

  location / {
    client_max_body_size 100m;
    client_body_buffer_size 128k;
    proxy_send_timeout 300;
    proxy_read_timeout 300;
    proxy_buffer_size 4k;
    proxy_buffers 16 32k;
    proxy_busy_buffers_size 64k;
    proxy_temp_file_write_size 64k;
    proxy_connect_timeout 30s;
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }
}

6. 启动容器

docker run -d -p 80:80 -p 443:443 \
  --net=host \
  --name nginx-abc \
  --restart always \
  -e TZ='Asia/Shanghai' \
  -v /home/test/nginx-https/conf.d/:/etc/nginx/conf.d \
  -v /home/test/nginx-https/nginx.conf:/etc/nginx/nginx.conf:ro \
  nginx

7. 设置防火墙

firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --reload