nginx/default11.conf at main · kejilion/nginx · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
server {
    listen 80 reuseport default_server;
    listen [::]:80 reuseport default_server;
    listen 443 ssl reuseport default_server;
    listen [::]:443 ssl reuseport default_server;
    listen 443 quic reuseport default_server;
    listen [::]:443 quic reuseport default_server;

    server_name _;

    # SSL 证书配置
    ssl_certificate /etc/nginx/certs/default_server.crt;
    ssl_certificate_key /etc/nginx/certs/default_server.key;

    # 返回 444 状态码以丢弃无效请求
    return 444;
}


# 信任 Docker 网络的 IP 地址范围
set_real_ip_from 172.0.0.0/8;  # Docker 网络的 IP 范围
set_real_ip_from fd00::/8;     # Docker 的 IPv6 范围

# 信任 Cloudflare 的 IP 地址范围
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;

set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2c0f:f248::/32;

# 让 Nginx 使用 CF-Connecting-IP 来获取 Cloudflare 客户端的真实 IP
real_ip_header CF-Connecting-IP;

# 启用递归查找真实 IP
real_ip_recursive on;