Nginx-quic 编译与使用

前言

最近又想从 Caddy 换回 Nginx 了 但是目前 nginx 是默认不支持 HTTP/3 的
要想在 nginx 上使用 HTTP/3 目前有两种办法 这里使用的是官方的 nginx-quic 分支

准备工作

准备环境

Copy
sudo apt update && sudo apt upgrade -y
sudo apt install build-essential libtool libpcre3-dev zlib1g-dev libzstd-dev unzip cmake ninja-build wget git mercurial

为了防止软件源中 golang 的版本过旧 我这里使用手动安装

::: banner {info}
如果软件源中 golang 版本 >=1.18 则可以直接使用 apt 安装
如果已安装 golang 1.18+ 则无需此步骤
:::

Copy
wget https://go.dev/dl/go1.20.3.linux-amd64.tar.gz
rm -rf /usr/local/go && tar -C /usr/local -xzf go1.20.3.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin

准备源码

创建源码文件夹 & 获取源码

Copy
mkdir nginx-quic-src
cd nginx-quic-src
hg clone -b quic https://hg.nginx.org/nginx-quic
# 获取插件
git clone --recurse-submodules https://github.com/google/ngx_brotli.git
git clone --recurse-submodules https://github.com/tokers/zstd-nginx-module.git

获取 & 编译 boringssl

Copy
git clone https://github.com/google/boringssl.git
cd boringssl/
mkdir build
cd build
cmake -GNinja ..
ninja
cd ../../

编译 & 安装

编译

Copy
./auto/configure \
--with-http_gzip_static_module \
--with-http_ssl_module --with-http_v2_module \
--with-http_v3_module --with-stream_quic_module \
--with-cc-opt="-I../boringssl/include" --with-ld-opt="-L../boringssl/build/ssl -L../boringssl/build/crypto" \
--add-module="../ngx_brotli" \
--add-module="../zstd-nginx-module"

make

安装

Copy
sudo make install

配置守护服务

Copy
cat <<'TEXT' > /etc/systemd/system/nginx.service
[Unit]
Description=nginx - high performance web server
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
PIDFile=/usr/local/nginx/logs/nginx.pid
ExecStartPre=/usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.conf
ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/usr/local/nginx/sbin/nginx -s stop
PrivateTmp=true

[Install]
WantedBy=multi-user.target
TEXT
#设置开机自启动 (可选）
sudo systemctl enable nginx.service

配置

基本配置

创建并编辑 /usr/local/nginx/conf/conf.d/nginx.conf

Copy
zstd on;
brotli on;
gzip on;

zstd_static on;
brotli_static on;
gzip_static on;

zstd_types text/plain application/css text/css application/xml text/javascript application/javascript application/x-javascript application/json;
brotli_types text/plain application/css text/css application/xml text/javascript application/javascript application/x-javascript application/json;
gzip_types text/plain application/css text/css application/xml text/javascript application/javascript application/x-javascript application/json;

ssl_protocols TLSv1.2 TLSv1.3;
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
ssl_reject_handshake on;
}

编辑 /usr/local/nginx/conf/nginx.conf

Copy
#user nobody;
worker_processes auto;

#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;

#pid logs/nginx.pid;

events {
worker_connections 1024;
}

http {
include mime.types;
default_type application/octet-stream;

#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';

#access_log logs/access.log main;

sendfile on;
#tcp_nopush on;

#keepalive_timeout 0;
keepalive_timeout 65;

# Load configs
include /usr/local/nginx/conf/conf.d/*.conf;
include /usr/local/nginx/conf/sites-enabled/*;
}

这样，之后对 nginx 的全局配置可以通过编辑 /usr/local/nginx/conf/conf.d/nginx.conf 来完成
对单个站点的配置可以通过编辑 /usr/local/nginx/conf/sites-enabled/ 下对应的配置文件来完成
以下是一个站点配置 /usr/local/nginx/conf/sites-enabled/example.conf 的示例

Copy
server {
listen 443 quic;
listen 443 ssl http2;
listen [::]:443 quic;
listen [::]:443 ssl http2
server_name example.com;
add_header Alt-Svc 'h3=":443"; ma=86400; h3-29=":443"; h3-28=":443";';
ssl_certificate example.com.cer;
ssl_certificate_key example.com.key;

location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://localhost:1145;
}
}

其中 servername 为该配置文件对应的域名
ssl_certificate 和 ssl_certificate_key 替换为你的 SSL 证书路径

使用

当以上配置完成之后 执行

Copy
sudo systemctl start nginx.service

如有报错请自行检查配置文件
如果有其他问题也可以评论区交流

此文由 Mix Space 同步更新至 xLog
原始链接为 https://blog.rikko.moe/posts/default/nginx-quic