windows_nginx 配置火绒升级代理

软件下载（个人下载的是这个版本：nginx-1.28.2）

http://nginx.org/download/nginx-1.28.2.zip

软件解压缩至c盘根目录下

进入conf文件夹，修改nginx.conf文件，检查语法后启动（nginx.conf放最后）

start nginx # 启动程序
nginx -s reload # 重新加载配置文件
nginx -s stop # 快速停止
nginx -t # 检查配置文件语法

nginx.conf配置文件，代理端口8080，

user nginx;
worker_processes auto;

events {
    worker_connections 1024;
}

http {
    # 基础设置
    sendfile on;
    tcp_nopush on;
    keepalive_timeout 65;
    
    # 日志格式
    log_format proxy '$remote_addr - $host [$time_local] "$request" $status $body_bytes_sent';
    log_format blocked '$remote_addr - [$time_local] "DENIED: $host" "$request"';
    
    access_log /var/log/nginx/access.log proxy;
    error_log /var/log/nginx/error.log;
    
    # 代理缓存路径
    proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=huorong_cache:10m inactive=60m;
    
    # 主代理服务器
    server {
        listen 8080;
        
        # 精确域名匹配
        server_name 
            huorong.cn
            www.huorong.cn
            api.huorong.cn
            static.huorong.cn
            ~^[a-zA-Z0-9_-]+\.huorong\.cn$;  # 匹配其他子域名
        
        # 安全头
        add_header X-Proxy-Server "Nginx-Huorong-Proxy";
        
        location / {
            # 代理到目标服务器的443端口
            proxy_pass https://target-server-ip:443;  # 替换为实际IP或域名
            
            # 保持原始主机头
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Port 8080;
            
            # SSL相关配置
            proxy_ssl_name $host;  # 使用请求的原始域名进行SSL握手
            proxy_ssl_verify off;   # 如果目标使用自签名证书则设为off
            # proxy_ssl_trusted_certificate /path/to/ca.crt;  # 如果需要验证证书
            
            # 性能优化
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_buffering on;
            proxy_buffer_size 4k;
            proxy_buffers 8 4k;
            
            # 超时设置
            proxy_connect_timeout 30s;
            proxy_send_timeout 60s;
            proxy_read_timeout 120s;  # 长连接可能需要更长时间
            
            # 启用缓存
            proxy_cache huorong_cache;
            proxy_cache_key "$host$request_uri";
            proxy_cache_valid 200 302 10m;
            proxy_cache_valid 404 1m;
            proxy_cache_use_stale error timeout;
            add_header X-Cache-Status $upstream_cache_status;
            
            # 重试机制
            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
            proxy_next_upstream_tries 3;
        }
        


        # 健康检查端点
        location = /nginx-health {
            access_log off;
            return 200 "OK";
        }
    }
    
    # 拒绝其他所有访问
    server {
        listen 8080 default_server;
        server_name _;
        
        access_log /var/log/nginx/blocked.log blocked;
        
        location / {
            # 简单拒绝
            return 403 "Access Denied. Only huorong.cn domains are allowed.\n"
                       "Your domain: $host\n"
                       "Allowed domains: *.huorong.cn";
        }
    }
}