425 lines
13 KiB
Bash
425 lines
13 KiB
Bash
#!/bin/bash
|
||
|
||
source <(curl -f -s --connect-timeout 10 --retry 3 https://dl.acepanel.net/public.sh)
|
||
if [ $? -ne 0 ]; then
|
||
echo "Download public.sh failed, please check the network or try again later."
|
||
exit 1
|
||
fi
|
||
|
||
channel=${1}
|
||
version=${2}
|
||
nginx_path="${setup_path}/server/nginx"
|
||
j=$(calculate_j)
|
||
|
||
# 安装依赖
|
||
if [ ${OS} == "rhel" ]; then
|
||
dnf makecache -y
|
||
dnf groupinstall "Development Tools" -y
|
||
dnf install cmake tar unzip gd gd-devel git-core flex perl oniguruma oniguruma-devel libsodium-devel libxml2-devel libxslt-devel bison curl curl-devel ncurses-devel libevent-devel readline-devel libuuid-devel brotli-devel icu libicu libicu-devel openssl openssl-devel libzstd-devel -y
|
||
elif [ ${OS} == "debian" ] || [ ${OS} == "ubuntu" ]; then
|
||
apt-get update
|
||
apt-get install build-essential cmake tar unzip libgd3 libgd-dev git flex perl libonig-dev libsodium-dev libxml2-dev libxslt1-dev bison curl libcurl4-openssl-dev libncurses5-dev libevent-dev libreadline-dev uuid-dev libbrotli-dev icu-devtools libicu-dev openssl libssl-dev libzstd-dev -y
|
||
else
|
||
error "Unsupported operating system"
|
||
fi
|
||
if [ "$?" != "0" ]; then
|
||
error "Failed to install dependencies"
|
||
fi
|
||
|
||
# 准备目录
|
||
rm -rf ${nginx_path}
|
||
mkdir -p ${nginx_path}
|
||
cd ${nginx_path}
|
||
|
||
# 下载源码
|
||
dl "${nginx_path}" "/openresty/openresty-${version}.tar.gz"
|
||
|
||
tar -zxvf openresty-${version}.tar.gz
|
||
rm -f openresty-${version}.tar.gz
|
||
mv openresty-${version} src
|
||
cd src
|
||
|
||
# tls library
|
||
dl "${nginx_path}/src" "/tls/openssl-3.5.4.7z"
|
||
|
||
7z x openssl-3.5.4.7z
|
||
rm -f openssl-3.5.4.7z
|
||
mv openssl-3.5.4 openssl
|
||
chmod -R 700 openssl
|
||
|
||
# 加载 tls 模块，ktls 需要
|
||
modprobe tls
|
||
|
||
# OpenSSL 补丁
|
||
cd openssl
|
||
patch -p1 <${nginx_path}/src/patches/openssl-3.5.4-sess_set_get_cb_yield.patch
|
||
if [ "$?" != "0" ]; then
|
||
rm -rf ${nginx_path}
|
||
error "OpenSSL patch application failed"
|
||
fi
|
||
cd ${nginx_path}/src
|
||
|
||
# pcre2
|
||
dl "${nginx_path}/src" "/nginx/pcre/pcre2-10.46.7z"
|
||
|
||
7z x pcre2-10.46.7z
|
||
rm -f pcre2-10.46.7z
|
||
mv pcre2-10.46 pcre2
|
||
chmod -R 700 pcre2
|
||
|
||
# ngx_cache_purge
|
||
dl "${nginx_path}/src" "/nginx/modules/ngx_cache_purge-2.3.tar.gz"
|
||
|
||
tar -zxvf ngx_cache_purge-2.3.tar.gz
|
||
rm -f ngx_cache_purge-2.3.tar.gz
|
||
mv ngx_cache_purge-2.3 ngx_cache_purge
|
||
|
||
# nginx-sticky-module
|
||
dl "${nginx_path}/src" "/nginx/modules/nginx-sticky-module.zip"
|
||
|
||
unzip -o nginx-sticky-module.zip
|
||
rm -f nginx-sticky-module.zip
|
||
|
||
# nginx-dav-ext-module
|
||
dl "${nginx_path}/src" "/nginx/modules/nginx-dav-ext-module-3.0.0.tar.gz"
|
||
|
||
tar -xvf nginx-dav-ext-module-3.0.0.tar.gz
|
||
rm -f nginx-dav-ext-module-3.0.0.tar.gz
|
||
mv nginx-dav-ext-module-3.0.0 nginx-dav-ext-module
|
||
|
||
# ngx_http_security_headers_module
|
||
dl "${nginx_path}/src" "/nginx/modules/ngx_http_security_headers_module.zip"
|
||
unzip -o ngx_http_security_headers_module.zip
|
||
rm -f ngx_http_security_headers_module.zip
|
||
|
||
# ngx_http_trim_filter_module
|
||
dl "${nginx_path}/src" "/nginx/modules/ngx_http_trim_filter_module.zip"
|
||
unzip -o ngx_http_trim_filter_module.zip
|
||
rm -f ngx_http_trim_filter_module.zip
|
||
|
||
# ngx_http_zstd_module
|
||
dl "${nginx_path}/src" "/nginx/modules/ngx_http_zstd_module.zip"
|
||
unzip -o ngx_http_zstd_module.zip
|
||
rm -f ngx_http_zstd_module.zip
|
||
|
||
# ngx_brotli
|
||
dl "${nginx_path}/src" "/nginx/modules/ngx_brotli-a71f931.zip"
|
||
|
||
unzip -o ngx_brotli-a71f931.zip
|
||
mv ngx_brotli-a71f931 ngx_brotli
|
||
rm -f ngx_brotli-a71f931.zip
|
||
cd ngx_brotli/deps/brotli
|
||
mkdir out && cd out
|
||
cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF -DCMAKE_C_FLAGS="-Ofast -march=native -mtune=native -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="-Ofast -march=native -mtune=native -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" -DCMAKE_INSTALL_PREFIX=./installed ..
|
||
cmake --build . --config Release --target brotlienc
|
||
if [ "$?" != "0" ]; then
|
||
rm -rf ${nginx_path}
|
||
error "ngx_brotli compilation failed"
|
||
fi
|
||
|
||
cd ${nginx_path}/src
|
||
chmod +x configure
|
||
|
||
./configure --user=www --group=www \
|
||
--prefix=${nginx_path} --with-luajit \
|
||
--add-module=${nginx_path}/src/ngx_cache_purge \
|
||
--add-module=${nginx_path}/src/nginx-sticky-module \
|
||
--with-openssl=${nginx_path}/src/openssl \
|
||
--with-openssl-opt="no-tests enable-ktls" \
|
||
--with-pcre=${nginx_path}/src/pcre2 --with-pcre-jit \
|
||
--with-ld-opt="-Wl,-s -Wl,-Bsymbolic -Wl,--gc-sections" \
|
||
--with-cc-opt="-DNGX_LUA_ABORT_AT_PANIC -march=native -mtune=native -Ofast -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" \
|
||
--with-luajit-xcflags="-DLUAJIT_NUMMODE=2 -DLUAJIT_ENABLE_LUA52COMPAT" \
|
||
--with-file-aio \
|
||
--with-threads \
|
||
--with-compat \
|
||
--with-http_v2_module --with-http_v3_module \
|
||
--with-http_slice_module \
|
||
--with-stream --with-stream_ssl_module --with-stream_realip_module --with-stream_ssl_preread_module \
|
||
--with-http_stub_status_module \
|
||
--with-http_ssl_module \
|
||
--with-http_image_filter_module \
|
||
--with-http_gzip_static_module --with-http_gunzip_module \
|
||
--with-http_sub_module \
|
||
--with-http_flv_module \
|
||
--with-http_addition_module \
|
||
--with-http_realip_module \
|
||
--with-http_mp4_module \
|
||
--with-http_auth_request_module \
|
||
--with-http_secure_link_module \
|
||
--with-http_random_index_module \
|
||
--with-http_dav_module \
|
||
--add-module=${nginx_path}/src/nginx-dav-ext-module \
|
||
--add-module=${nginx_path}/src/ngx_http_security_headers_module \
|
||
--add-module=${nginx_path}/src/ngx_http_trim_filter_module \
|
||
--add-module=${nginx_path}/src/ngx_brotli \
|
||
--add-module=${nginx_path}/src/ngx_http_zstd_module
|
||
make "-j${j}"
|
||
if [ "$?" != "0" ]; then
|
||
rm -rf ${nginx_path}
|
||
error "Compilation failed"
|
||
fi
|
||
make install
|
||
if [ ! -f "${nginx_path}/nginx/sbin/nginx" ]; then
|
||
rm -rf ${nginx_path}
|
||
error "Installation failed"
|
||
fi
|
||
|
||
cd ${nginx_path}
|
||
|
||
# 设置软链接
|
||
ln -sf ${nginx_path}/nginx/html ${nginx_path}/html
|
||
ln -sf ${nginx_path}/nginx/conf ${nginx_path}/conf
|
||
ln -sf ${nginx_path}/nginx/logs ${nginx_path}/logs
|
||
ln -sf ${nginx_path}/nginx/sbin ${nginx_path}/sbin
|
||
ln -sf ${nginx_path}/nginx/sbin/nginx /usr/local/bin/nginx
|
||
|
||
# 创建站点目录
|
||
mkdir -p ${setup_path}/sites
|
||
chmod -R 755 ${setup_path}/sites
|
||
|
||
# 写入主配置文件
|
||
mkdir -p ${nginx_path}/conf/stream
|
||
cat >${nginx_path}/conf/nginx.conf <<EOF
|
||
user www www;
|
||
worker_processes auto;
|
||
worker_cpu_affinity auto;
|
||
worker_rlimit_nofile 65535;
|
||
pcre_jit on;
|
||
quic_bpf on;
|
||
error_log ${setup_path}/server/nginx/nginx-error.log crit;
|
||
pid ${setup_path}/server/nginx/nginx.pid;
|
||
|
||
stream {
|
||
include stream/*.conf;
|
||
log_format tcp_format '\$time_local|\$remote_addr|\$protocol|\$status|\$bytes_sent|\$bytes_received|\$session_time|\$upstream_addr|\$upstream_bytes_sent|\$upstream_bytes_received|\$upstream_connect_time';
|
||
|
||
access_log ${setup_path}/server/nginx/tcp-access.log tcp_format;
|
||
error_log ${setup_path}/server/nginx/tcp-error.log;
|
||
}
|
||
|
||
events {
|
||
use epoll;
|
||
worker_connections 65535;
|
||
multi_accept on;
|
||
}
|
||
|
||
http {
|
||
include mime.types;
|
||
include proxy.conf;
|
||
include default.conf;
|
||
include acme.conf;
|
||
|
||
default_type application/octet-stream;
|
||
keepalive_timeout 60;
|
||
|
||
server_names_hash_bucket_size 512;
|
||
client_header_buffer_size 32k;
|
||
large_client_header_buffers 4 32k;
|
||
client_max_body_size 200m;
|
||
client_body_buffer_size 10M;
|
||
client_body_in_file_only off;
|
||
|
||
variables_hash_max_size 2048;
|
||
variables_hash_bucket_size 128;
|
||
|
||
http2 on;
|
||
http3 on;
|
||
quic_gso on;
|
||
aio threads;
|
||
aio_write on;
|
||
directio 512k;
|
||
sendfile on;
|
||
tcp_nopush on;
|
||
tcp_nodelay on;
|
||
|
||
fastcgi_connect_timeout 300;
|
||
fastcgi_send_timeout 300;
|
||
fastcgi_read_timeout 300;
|
||
fastcgi_buffer_size 64k;
|
||
fastcgi_buffers 8 64k;
|
||
fastcgi_busy_buffers_size 256k;
|
||
fastcgi_temp_file_write_size 256k;
|
||
fastcgi_intercept_errors on;
|
||
|
||
zstd on;
|
||
zstd_min_length 1k;
|
||
zstd_comp_level 10;
|
||
zstd_types *;
|
||
zstd_static on;
|
||
|
||
brotli on;
|
||
brotli_min_length 1k;
|
||
brotli_comp_level 6;
|
||
brotli_window 1m;
|
||
brotli_types *;
|
||
brotli_static on;
|
||
|
||
gzip on;
|
||
gzip_min_length 1k;
|
||
gzip_http_version 1.1;
|
||
gzip_comp_level 6;
|
||
gzip_types *;
|
||
gzip_vary on;
|
||
gzip_proxied any;
|
||
|
||
limit_conn_zone \$binary_remote_addr zone=perip:10m;
|
||
limit_conn_zone \$server_name zone=perserver:10m;
|
||
|
||
server_tokens off;
|
||
access_log off;
|
||
|
||
# websocket support
|
||
map \$http_upgrade \$connection_upgrade {
|
||
default upgrade;
|
||
'' close;
|
||
}
|
||
|
||
# status page
|
||
server {
|
||
listen 80;
|
||
server_name 127.0.0.1;
|
||
allow 127.0.0.1;
|
||
|
||
location /nginx_status {
|
||
stub_status on;
|
||
access_log off;
|
||
}
|
||
location ~ ^/phpfpm_status/(?<version>\d+)$ {
|
||
fastcgi_pass unix:/tmp/php-cgi-\$version.sock;
|
||
include fastcgi_params;
|
||
fastcgi_param SCRIPT_FILENAME \$fastcgi_script_name;
|
||
}
|
||
}
|
||
|
||
include ${setup_path}/sites/*/config/*.conf;
|
||
}
|
||
EOF
|
||
# 写入pathinfo配置文件
|
||
cat >${nginx_path}/conf/pathinfo.conf <<EOF
|
||
set \$real_script_name \$fastcgi_script_name;
|
||
if (\$fastcgi_script_name ~ "^(.+?\.php)(/.+)$") {
|
||
set \$real_script_name \$1;
|
||
set \$path_info \$2;
|
||
}
|
||
fastcgi_param SCRIPT_FILENAME \$document_root\$real_script_name;
|
||
fastcgi_param SCRIPT_NAME \$real_script_name;
|
||
fastcgi_param PATH_INFO \$path_info;
|
||
EOF
|
||
# 写入默认站点页
|
||
cat >${nginx_path}/html/index.html <<EOF
|
||
<!DOCTYPE html>
|
||
<html lang="en">
|
||
<head>
|
||
<meta charset="UTF-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<title>AcePanel</title>
|
||
<style>body{background:#f2f3f5;margin:0;padding:20px;font-family:system-ui,sans-serif}.container{max-width:600px;margin:3em auto;background:#fff;padding:40px;border-radius:12px;box-shadow:0 4px 12px rgba(0,0,0,.05)}h1{font-size:3em;font-weight:600;margin:0 0 30px;color:#1a1a1a}p{color:#5a5a5a;line-height:1.6}a{text-decoration:none;color:#333;font-weight:600}</style>
|
||
</head>
|
||
<body>
|
||
<div class="container">
|
||
<h1>AcePanel</h1>
|
||
<p>This is the default page of AcePanel!</p>
|
||
<p>You see this page because the requested website was not found on this server.</p>
|
||
<p><em>Powered by <a target="_blank" href="https://acepanel.net">AcePanel</a></em></p>
|
||
</div>
|
||
</body>
|
||
</html>
|
||
EOF
|
||
|
||
# 写入站点停止页
|
||
cat >${nginx_path}/html/stop.html <<EOF
|
||
<!DOCTYPE html>
|
||
<html lang="zh-Hans">
|
||
<head>
|
||
<meta charset="UTF-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<title>AcePanel</title>
|
||
<style>body{background:#f2f3f5;margin:0;padding:20px;font-family:system-ui,sans-serif}.container{max-width:600px;margin:3em auto;background:#fff;padding:40px;border-radius:12px;box-shadow:0 4px 12px rgba(0,0,0,.05)}h1{font-size:3em;font-weight:600;margin:0 0 30px;color:#1a1a1a}p{color:#5a5a5a;line-height:1.6}a{text-decoration:none;color:#333;font-weight:600}</style>
|
||
</head>
|
||
<body>
|
||
<div class="container">
|
||
<h1>Website Suspended</h1>
|
||
<p>You see this page because the website has been stopped by the server administrator.</p>
|
||
<p><em>Powered by <a target="_blank" href="https://acepanel.net">AcePanel</a></em></p>
|
||
</div>
|
||
</body>
|
||
</html>
|
||
EOF
|
||
|
||
# 写入默认配置文件
|
||
touch ${nginx_path}/conf/acme.conf
|
||
|
||
# 写入代理默认配置文件
|
||
cat >${nginx_path}/conf/proxy.conf <<EOF
|
||
proxy_temp_path ${nginx_path}/proxy_temp_dir;
|
||
proxy_cache_path ${nginx_path}/proxy_cache_dir levels=1:2 keys_zone=cache_one:20m inactive=1d max_size=5g;
|
||
proxy_connect_timeout 10;
|
||
proxy_read_timeout 60;
|
||
proxy_send_timeout 60;
|
||
proxy_buffer_size 32k;
|
||
proxy_buffers 4 64k;
|
||
proxy_busy_buffers_size 128k;
|
||
proxy_temp_file_write_size 128k;
|
||
proxy_next_upstream error timeout invalid_header http_500 http_503 http_404;
|
||
proxy_cache cache_one;
|
||
EOF
|
||
|
||
# 写入默认站点配置文件
|
||
cat >${nginx_path}/conf/default.conf <<EOF
|
||
server
|
||
{
|
||
listen 80 default_server reuseport;
|
||
listen [::]:80 default_server reuseport;
|
||
listen 443 ssl default_server reuseport;
|
||
listen [::]:443 ssl default_server reuseport;
|
||
listen 443 quic default_server reuseport;
|
||
listen [::]:443 quic default_server reuseport;
|
||
server_name _;
|
||
index index.html;
|
||
root ${nginx_path}/html;
|
||
ssl_reject_handshake on;
|
||
}
|
||
EOF
|
||
|
||
# 处理文件权限
|
||
chmod -R 755 ${nginx_path}
|
||
chmod -R 600 ${nginx_path}/conf
|
||
|
||
# 写入服务文件
|
||
cat >/etc/systemd/system/nginx.service <<EOF
|
||
[Unit]
|
||
Description=The OpenResty Application Platform
|
||
After=syslog.target network-online.target remote-fs.target nss-lookup.target
|
||
Wants=network-online.target
|
||
|
||
[Service]
|
||
Type=forking
|
||
PIDFile=${nginx_path}/nginx.pid
|
||
ExecStartPre=${nginx_path}/sbin/nginx -t -c ${nginx_path}/conf/nginx.conf
|
||
ExecStart=${nginx_path}/sbin/nginx -c ${nginx_path}/conf/nginx.conf
|
||
ExecReload=${nginx_path}/sbin/nginx -s reload
|
||
ExecStop=${nginx_path}/sbin/nginx -s quit
|
||
LimitNOFILE=500000
|
||
Restart=on-failure
|
||
RestartSec=5s
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
|
||
chmod 644 /etc/systemd/system/nginx.service
|
||
|
||
systemctl daemon-reload
|
||
systemctl enable --now nginx
|
||
if [ "$?" != "0" ]; then
|
||
error "Failed to start"
|
||
fi
|
||
|
||
acepanel app write openresty ${channel} ${version}
|
||
acepanel setting write webserver nginx
|
||
|
||
echo -e $HR
|
||
echo "Installation successful"
|
||
echo -e $HR
|