Nginx-quic 编译与使用

前言#

最近又想从 Caddy 换回 Nginx 了但是目前 nginx 是默认不支持 HTTP/3 的
要想在 nginx 上使用 HTTP/3 目前有两种办法这里使用的是官方的 nginx-quic 分支

准备工作#

准备环境#

sudo apt update && sudo apt upgrade -y
sudo apt install build-essential libtool libpcre3-dev zlib1g-dev libzstd-dev unzip cmake ninja-build wget git mercurial

为了防止软件源中 golang 的版本过旧我这里使用手动安装

::: banner {info}
如果软件源中 golang 版本 >=1.18 则可以直接使用 apt 安装
如果已安装 golang 1.18+ 则无需此步骤
:::

wget https://go.dev/dl/go1.20.3.linux-amd64.tar.gz
rm -rf /usr/local/go && tar -C /usr/local -xzf go1.20.3.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin

准备源码#

创建源码文件夹 & 获取源码#

mkdir nginx-quic-src
cd nginx-quic-src
hg clone -b quic https://hg.nginx.org/nginx-quic
# 获取插件 
git clone --recurse-submodules https://github.com/google/ngx_brotli.git
git clone --recurse-submodules https://github.com/tokers/zstd-nginx-module.git

获取 & 编译 boringssl#

git clone https://github.com/google/boringssl.git
cd boringssl/
mkdir build
cd build
cmake -GNinja ..
ninja
cd ../../

编译 & 安装#

编译#

./auto/configure \
 --with-http_gzip_static_module \
 --with-http_ssl_module --with-http_v2_module \
 --with-http_v3_module --with-stream_quic_module \
 --with-cc-opt="-I../boringssl/include" --with-ld-opt="-L../boringssl/build/ssl -L../boringssl/build/crypto" \
 --add-module="../ngx_brotli" \
 --add-module="../zstd-nginx-module"

make

安装#

sudo make install

配置守护服务#

cat <<'TEXT' > /etc/systemd/system/nginx.service
[Unit]
Description=nginx - high performance web server
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
PIDFile=/usr/local/nginx/logs/nginx.pid
ExecStartPre=/usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.conf
ExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/usr/local/nginx/sbin/nginx -s stop
PrivateTmp=true

[Install]
WantedBy=multi-user.target
TEXT
#设置开机自启动 (可选）  
sudo systemctl enable nginx.service

配置#

基本配置#

创建并编辑 /usr/local/nginx/conf/conf.d/nginx.conf

zstd on;
brotli on;
gzip on;

zstd_static on;
brotli_static on;
gzip_static  on;

zstd_types text/plain application/css text/css application/xml text/javascript application/javascript application/x-javascript application/json;
brotli_types text/plain application/css text/css application/xml text/javascript application/javascript application/x-javascript application/json;
gzip_types text/plain application/css text/css application/xml text/javascript application/javascript application/x-javascript application/json;

ssl_protocols TLSv1.2 TLSv1.3;
server { 
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
ssl_reject_handshake on;
}

编辑 /usr/local/nginx/conf/nginx.conf

#user  nobody;
worker_processes  auto;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    # Load configs
    include /usr/local/nginx/conf/conf.d/*.conf;
    include /usr/local/nginx/conf/sites-enabled/*;
}

这样，之后对 nginx 的全局配置可以通过编辑 /usr/local/nginx/conf/conf.d/nginx.conf 来完成
对单个站点的配置可以通过编辑 /usr/local/nginx/conf/sites-enabled/ 下对应的配置文件来完成
以下是一个站点配置 /usr/local/nginx/conf/sites-enabled/example.conf 的示例

server {
    listen 443 quic;
    listen 443 ssl http2;
    listen [::]:443 quic;
    listen [::]:443 ssl http2
    server_name example.com;
    add_header Alt-Svc 'h3=":443"; ma=86400; h3-29=":443"; h3-28=":443";';
    ssl_certificate example.com.cer;
    ssl_certificate_key example.com.key;

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://localhost:1145;
    }
}

其中 servername 为该配置文件对应的域名
ssl_certificate 和 ssl_certificate_key 替换为你的 SSL 证书路径

使用#

当以上配置完成之后执行

sudo systemctl start nginx.service

如有报错请自行检查配置文件
如果有其他问题也可以评论区交流

此文由 Mix Space 同步更新至 xLog
原始链接为 https://blog.rikko.moe/posts/default/nginx-quic