docker --version
openssl version

project/
├── Dockerfile
├── nginx/
│   ├── nginx.conf                # Nginx主配置文件
│   ├── conf.d/
│   │   └── default.conf         # 默認(rèn)站點(diǎn)配置
│   └── ssl/                     # 將要?jiǎng)?chuàng)建的SSL證書(shū)目錄
│       ├── nginx.crt            # 證書(shū)文件
│       └── nginx.key            # 私鑰文件
├── source/
    └── dist/                    # 編譯后的靜態(tài)文件

# 在項(xiàng)目根目錄下執(zhí)行
mkdir -p nginx/ssl
cd nginx/ssl

openssl genrsa -out nginx.key 2048

openssl req -new -key nginx.key -out nginx.csr \
    -subj "/C=CN/ST=YourState/L=YourCity/O=YourCompany/OU=IT Department/CN=your-domain.com"

openssl x509 -req -days 3650 \
    -in nginx.csr \
    -signkey nginx.key \
    -out nginx.crt

chmod 600 nginx.key
chmod 644 nginx.crt

# HTTP服務(wù)器（重定向到HTTPS）
server {
    listen 80;
    listen [::]:80;
    server_name localhost;  # 在實(shí)際環(huán)境中替換為你的域名
    # 將所有HTTP請(qǐng)求重定向到HTTPS
    return 301 https://$server_name$request_uri;
}
# HTTPS服務(wù)器
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name localhost;  # 在實(shí)際環(huán)境中替換為你的域名
    # SSL證書(shū)配置
    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;
    # SSL會(huì)話配置
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    # SSL協(xié)議配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    # HSTS配置（如果需要）
    # add_header Strict-Transport-Security "max-age=63072000" always;
    # 靜態(tài)文件配置
    location / {
        root   /opt/dist;
        index  index.html index.htm;
        try_files $uri $uri/ /index.html;
    }
    # 錯(cuò)誤頁(yè)面配置
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
}

FROM nginx:stable
# 復(fù)制Nginx配置文件
COPY ./nginx/nginx.conf /etc/nginx/nginx.conf
COPY ./nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf
# 復(fù)制SSL證書(shū)
COPY ./nginx/ssl/nginx.crt /etc/nginx/ssl/
COPY ./nginx/ssl/nginx.key /etc/nginx/ssl/
# 復(fù)制應(yīng)用文件
COPY ./source/dist /opt/dist/
# 設(shè)置時(shí)區(qū)
ENV TZ=Asia/Shanghai
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
# 設(shè)置證書(shū)權(quán)限
RUN chmod 600 /etc/nginx/ssl/nginx.key \
    && chmod 644 /etc/nginx/ssl/nginx.crt
ENTRYPOINT ["/docker-entrypoint.sh"]
CMD ["nginx", "-g", "daemon off;"]

# 在項(xiàng)目根目錄下執(zhí)行
docker build -t my-nginx-ssl:v1 .

docker run -d \
    --name my-nginx-ssl \
    -p 80:80 \
    -p 443:443 \
    my-nginx-ssl:v1

docker ps

docker logs my-nginx-ssl

curl -k https://localhost

docker port my-nginx-ssl

# Linux系統(tǒng)
sudo ufw status
# 如果需要開(kāi)放端口
sudo ufw allow 443

# 進(jìn)入容器檢查
docker exec -it my-nginx-ssl bash
ls -l /etc/nginx/ssl/

# 進(jìn)入容器
docker exec -it my-nginx-ssl bash
# 測(cè)試Nginx配置
nginx -t

# 生成新證書(shū)
openssl x509 -req -days 365 \
    -in nginx.csr \
    -signkey nginx.key \
    -out nginx.crt.new
# 備份舊證書(shū)
mv /etc/nginx/ssl/nginx.crt /etc/nginx/ssl/nginx.crt.old
mv nginx.crt.new /etc/nginx/ssl/nginx.crt
# 重啟Nginx
nginx -s reload

# 查看訪問(wèn)日志
tail -f /var/log/nginx/access.log
# 查看錯(cuò)誤日志
tail -f /var/log/nginx/error.log