ech-dev-utils/configs/nginxsplit.conf at main · defo-project/ech-dev-utils · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
worker_processes  1;
error_log  logs/error.log  info;

# this makes valgrind/gdb easier
# daemon off;
# master_process off;
# # if debugging is needed - we get a core in /tmp/cores
# and then: sudo gdb ~/code/nginx/objs/nginx /tmp/cores/core
# for a backtrace
# error_log  logs/error.log  debug;
# working_directory  /tmp/cores/;
# worker_rlimit_core 500M;

events {
    worker_connections  1024;
}

http {
    log_format withech '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent"
                    "ECH: $ssl_ech_status/$ssl_server_name/$ssl_ech_outer_server_name"';
    access_log          $RUNTOP/nginx/logs/access.log withech;
    ssl_ech_file       $RUNTOP/echkeydir/echconfig.pem.ech;
    # default server
    server {
        listen              9442 default_server ssl;
        http2 on;
        ssl_certificate     $RUNTOP/cadir/example.com.crt;
        ssl_certificate_key $RUNTOP/cadir/example.com.priv;
        ssl_protocols       TLSv1.3;
        server_name         example.com;
        location / {
            root   dir-example.com;
            index  index.html index.htm;
        }
    }
    # ECH-front
    server {
        server_name foo.example.com;
        listen     7443 ssl;
        http2 on;
        ssl_certificate     $RUNTOP/cadir/foo.example.com.crt;
        ssl_certificate_key $RUNTOP/cadir/foo.example.com.priv;
        ssl_protocols       TLSv1.3;
        location / {
            proxy_pass http://127.0.0.1:3480/;
        }
    }
    server {
        server_name example.com;
        listen     7443 ssl;
        http2 on;
        ssl_certificate     $RUNTOP/cadir/example.com.crt;
        ssl_certificate_key $RUNTOP/cadir/example.com.priv;
        ssl_protocols       TLSv1.3;
        location / {
            proxy_pass http://127.0.0.1:3485/;
        }
    }
    # Two-TLS
    server {
        server_name foo.example.com;
        listen     7444 ssl;
        http2 on;
        ssl_certificate     $RUNTOP/cadir/example.com.crt;
        ssl_certificate_key $RUNTOP/cadir/example.com.priv;
        ssl_protocols       TLSv1.3;
        location / {
            proxy_pass https://127.0.0.1:3481/;
        }
    }
    server {
        server_name example.com;
        listen     7444 ssl;
        http2 on;
        ssl_certificate     $RUNTOP/cadir/example.com.crt;
        ssl_certificate_key $RUNTOP/cadir/example.com.priv;
        ssl_protocols       TLSv1.3;
        location / {
            proxy_pass https://127.0.0.1:3485/;
        }
    }
}

stream {
    # map $ssl_preread_server_name $targetBackend {
    # foo.example.com  127.0.0.1:3484; # running in lighttpd usually
    # example.com  127.0.0.1:3485;
    # }
    log_format basic '$ssl_preread_server_name '
                 '$ssl_preread_alpn_protocols '
                 '$remote_addr [$time_local] '
                 '$protocol $status $bytes_sent $bytes_received '
                 '$session_time "$upstream_addr" '
                 '"$upstream_bytes_sent" "$upstream_bytes_received"'
                 '"STREAM ECH: $ssl_ech_status/$ssl_server_name/$ssl_ech_outer_server_name"';
    access_log logs/fe_access.log basic;
    # One-TLS
    server {
        listen              7445;
        # ssl_preread on;
        # proxy_pass          $targetBackend;
        proxy_pass 127.0.0.1:3485;
    }

    # Split-mode
    server {
        listen              7446;
        # ssl_preread on;
        proxy_ssl_ech_split_file  $RUNTOP/echkeydir/echconfig.pem.ech;
        # proxy_pass          $targetBackend;
        proxy_pass 127.0.0.1:3484; # running in lighttpd usually
    }
}