← 返回目录 · nginx-vi.starbugs.net.md

vi.starbugs.net Nginx HTTP/2 HTTP/3 部署记录

系统

OS: Ubuntu 24.04.4 LTS
Nginx: 1.31.1 mainline
域名: vi.starbugs.net
解析 IP: 49.235.116.153

已完成

添加 nginx 官方 mainline APT 源
安装 nginx 1.31.1
确认编译参数包含:
--with-http_v2_module
--with-http_v3_module
--with-http_ssl_module
安装 certbot
使用 Let's Encrypt 签发证书
开启 HTTPS、HTTP/2、HTTP/3
HTTP 自动跳转 HTTPS
添加 HTTP/3 Alt-Svc 响应头
配置证书续期后自动 reload nginx
禁用默认站点配置

关键文件

Nginx 主配置: /etc/nginx/nginx.conf
站点配置: /etc/nginx/conf.d/vi.starbugs.net.conf
站点目录: /var/www/vi.starbugs.net
证书目录: /etc/letsencrypt/live/vi.starbugs.net/
续期配置: /etc/letsencrypt/renewal/vi.starbugs.net.conf
续期 reload hook: /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
已禁用默认站点: /etc/nginx/conf.d/default.conf.disabled

当前站点配置

server {
    listen 80;
    server_name vi.starbugs.net;

    location /.well-known/acme-challenge/ {
        root /var/www/vi.starbugs.net;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    listen 443 quic reuseport;
    http2 on;
    http3 on;

    server_name vi.starbugs.net;
    root /var/www/vi.starbugs.net;
    index index.html;

    ssl_certificate /etc/letsencrypt/live/vi.starbugs.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vi.starbugs.net/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    add_header Alt-Svc 'h3=":443"; ma=86400' always;
    add_header QUIC-Status $http3 always;

    location / {
        try_files $uri $uri/ =404;
    }
}

证书自动续期流程

certbot 安装后已创建 systemd 定时器，系统会定期执行证书续期检查。

查看定时器状态:

systemctl status certbot.timer --no-pager
systemctl list-timers certbot.timer --no-pager

证书续期配置文件:

/etc/letsencrypt/renewal/vi.starbugs.net.conf

当前使用 webroot 方式续期，验证目录为:

/var/www/vi.starbugs.net/.well-known/acme-challenge/

Nginx 80 端口配置保留了 ACME 验证路径:

location /.well-known/acme-challenge/ {
    root /var/www/vi.starbugs.net;
}

续期成功后自动重载 nginx 的 hook:

/etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

hook 内容:

#!/bin/sh
systemctl reload nginx

权限:

chmod 755 /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

手动测试续期流程:

certbot renew --dry-run

手动强制执行续期检查:

certbot renew

手动续期指定域名证书:

certbot certonly --webroot -w /var/www/vi.starbugs.net -d vi.starbugs.net

续期成功后的证书路径保持不变:

/etc/letsencrypt/live/vi.starbugs.net/fullchain.pem
/etc/letsencrypt/live/vi.starbugs.net/privkey.pem

如果续期失败，检查:

域名 vi.starbugs.net 是否仍解析到当前服务器
TCP 80 是否放行
Nginx 是否正常运行
/.well-known/acme-challenge/ 是否未被重定向或拦截
/var/log/letsencrypt/letsencrypt.log
/var/log/nginx/error.log

验证命令

nginx -v
nginx -V
nginx -t
systemctl status nginx --no-pager
systemctl status certbot.timer --no-pager
systemctl list-timers certbot.timer --no-pager
ss -ltnup
curl --noproxy '*' -I --http2 --resolve vi.starbugs.net:443:127.0.0.1 https://vi.starbugs.net
certbot renew --dry-run

验证结果

nginx -t: success
nginx 服务: active
TCP 80: listening
TCP 443: listening
UDP 443: listening
本地 SNI HTTP/2 测试: HTTP/2 200
响应头包含: alt-svc: h3=":443"; ma=86400
certbot dry-run: success

注意事项

HTTP/3 使用 UDP 443，需要在云服务器安全组和系统防火墙放行:

TCP 80
TCP 443
UDP 443

官方 nginx mainline 源当前为 1.31.1，不是 1.30；该版本已包含 HTTP/2 和 HTTP/3 支持。