angie acme proxy_pass DNS-01 验证
angie自动签发ssl配置
acme_client 99999_net https://acme-v02.api.letsencrypt.org/directory challenge=dns;
server {
listen unix:/run/acme-99999_net.sock;
server_name 99999.net *.99999.net;
acme 99999_net;
location @acme_hook_location {
acme_hook 99999_net uri=/angie.php;
proxy_pass http://API.SERVER;
proxy_read_timeout 560s;
proxy_send_timeout 560s;
proxy_set_header X-Acme-Hook $acme_hook_name;
proxy_set_header X-Acme-Challenge $acme_hook_challenge;
proxy_set_header X-Acme-Domain $acme_hook_domain;
proxy_set_header X-Acme-Keyauth $acme_hook_keyauth;
}
}angie官方只写了fastcgi和php-fpm的配置，这里补全一下proxy_pass调用api的方式
示例参数说明：
99999.net是域名
99999_net是acme name (acme签发只签发ssl可以直接用域名，但是网站里面ssl_certificate维护的时候变量无法识别.必须用下划线_才能识别)
API.SERVER是接口服务器地址
uri=/angie.php是api接收具体uri地址
proxy_pass暂时只能走http， 走https会请求不到可能要用ngx_http_tunnel_module模块走tunnel_pass localhost:9000;
这里的server和 listen unix:/run/acme-99999_net.sock; 是http下的字段，用于专门管理acme，这里用server字段管理可以单独签证书， 也可以在 网站的server字段下加location字段 @acme_hook_location， 可以查看官方文档https://cn.angie.software/angie/docs/configuration/acme/#acme-config-hooks-minimal-configuration
X-Acme系列header是传送参数，这里用header方式，也可以走uri个get方式，但会造成明文泄露的问题.
另外一种angie DNS托管方式验证方法：
acme_client 99999_net https://acme-v02.api.letsencrypt.org/directory challenge=dns;
server {
listen unix:/run/acme-99999_net.sock;
server_name 99999.net *.99999.net;
acme 99999_net;
}
网站配置和正常的一样：
upstream host_1 {
zone host_1 64k;
server 99.99.99.99:6680;
}
server {
listen 80;
server_name 99999.net *.99999.net;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
listen 443 quic;
http2 on;
http3 on;
server_name 99999.net *.99999.net;
status_zone host_1;
ssl_certificate $acme_cert_99999_net;
ssl_certificate_key $acme_cert_key_99999_net;
add_header Alt-Svc 'h3=":443"; ma=86400' always;
gzip on;
gzip_proxied any;
gzip_vary on;
gzip_types text/plain text/css text/xml application/json application/javascript application/xml application/rss+xml application/atom+xml image/svg+xml font/ttf font/otf application/vnd.ms-fontobject;
location / {
proxy_pass http://host_1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header REMOTE-HOST $remote_addr;
}
}
最后，angie直接官方包直接支持js和lua安装后就能用，比原来的nginx和openresty更好用，具体更多细节查看官方文档https://cn.angie.software/angie/docs/installation/oss_packages/#oss-packages
另外域名太多的情况下可以考虑DCV域名指派方案（Domain Control Validation）。