nginx/lets-encrypt：具有相同网络服务器配置的多个 SSL 域

Question

我使用通过lets-encrypt 生成的 SSL 证书管理十几个域，并使用nginx 来管理这些域的 Web 服务。

事实证明，所有这些域都需要具有相同的nginx 配置：即，相同的location 块，相同的root，相同的站点参数，等等

每个域唯一不同的是ssl_certificate、ssl_certificate_key和ssl_trusted_certificate的设置。

我处理这个问题的方法是在我的 nginx 配置中有十几个 server {} 块，每个块都包含几乎相同的数据，除了这三个 SSL 参数。

例如...

server {
    error_log /var/log/nginx/error.log debug;
    listen 80 default_server;
    listen [::]:80 default_server;
    listen 443 ssl http2;

    server_name example-domain0.com;

    ssl_certificate /etc/letsencrypt/live/example-domain0.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example-domain0.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example-domain0.com/chain.pem;

    ssl_session_cache shared:SSL:128m;
    add_header Strict-Transport-Security "max-age=31557600; includeSubDomains";
    ssl_stapling on;
    ssl_stapling_verify on;

    root /usr/share/nginx/html;
    index index.php index.html index.htm;

    if ($scheme != "https") {
        return 301 https://$host$request_uri;
    }    

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.json {
        add_header Content-Type text/plain;
    }

    location ~ ^/(t)($|/.*) {
        alias $1$2;
        include uwsgi_params;
        uwsgi_pass unix:/var/run/uwsgi/flask/$1.sock;
    }

    location ~ ^/(css|static|hm|cy|img|sq|rc|rl|oc|m|js)($|/.*) {
        root /usr/share/nginx;
    }

    location ~ ^/(junk)($|/.*) {
        root /usr/share/nginx/html;
        allow all;
        autoindex on;
    }

    location ~ \.php$ {
        include phpsite_params;
    }
}

server {
    error_log /var/log/nginx/error.log debug;
    listen 80;
    listen [::]:80;
    listen 443 ssl http2;

    server_name example-domain1.com;

    ssl_certificate /etc/letsencrypt/live/example-domain1.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example-domain1.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example-domain01.com/chain.pem;

    ssl_session_cache shared:SSL:128m;
    add_header Strict-Transport-Security "max-age=31557600; includeSubDomains";
    ssl_stapling on;
    ssl_stapling_verify on;

    root /usr/share/nginx/html;
    index index.php index.html index.htm;

    if ($scheme != "https") {
        return 301 https://$host$request_uri;
    }    

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.json {
        add_header Content-Type text/plain;
    }

    location ~ ^/(t)($|/.*) {
        alias $1$2;
        include uwsgi_params;
        uwsgi_pass unix:/var/run/uwsgi/flask/$1.sock;
    }

    location ~ ^/(css|static|hm|cy|img|sq|rc|rl|oc|m|js)($|/.*) {
        root /usr/share/nginx;
    }

    location ~ ^/(junk)($|/.*) {
        root /usr/share/nginx/html;
        allow all;
        autoindex on;
    }

    location ~ \.php$ {
        include phpsite_params;
    }
}

...然后是example-domain2.com、example-domain3.com、等的十几个块。 除了域名和这些 SSL 参数的值之外，它们是相同的。

如果我想要更改站点配置，这会导致很多问题，因为我必须在此配置文件中的十几个地方进行相同的更改，有时这会导致错误。

由于每个 SSL 域都需要自己的 ssl_certificate、ssl_certificate_key 和 ssl_trusted_certificate，因此我想仅使用该 SSL 配置信息创建较小的 server {} 块，然后再考虑其他常见配置信息，并且只保存在一个地方。

这可能吗？

非常感谢您。

Answer 1

哦，我没有意识到我可以在 location 块之外使用 include 指令。

我的问题的解决方法是这样的：

server {
    error_log /var/log/nginx/error.log debug;
    listen 80 default_server;
    listen [::]:80 default_server;
    listen 443 ssl http2;

    server_name example-domain0.com;

    ssl_certificate /etc/letsencrypt/live/example-domain0.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example-domain0.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example-domain0.com/chain.pem;

    include common/site-parms.conf;
}

server {
    error_log /var/log/nginx/error.log debug;
    listen 80;
    listen [::]:80;
    listen 443 ssl http2;

    server_name example-domain1.com;

    ssl_certificate /etc/letsencrypt/live/example-domain1.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example-domain1.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example-domain1.com/chain.pem;

    include common/site-parms.conf;
}

... 和另外十几个类似的 server {} 块，所有常见的东西都包含在 /etc/nginx/common/site-parms.conf 中。