macbre/nginx-http3

镜像概述和主要用途

https://github.com/macbre/docker-nginx-http3/actions/workflows/dockerimage.yml/badge.svg](https://github.com/macbre/docker-nginx-http3/actions/workflows/dockerimage.yml)

此镜像基于官方https://hub.docker.com/_/nginx/%E6%9E%84%E5%BB%BA%EF%BC%8C%E6%8F%90%E4%BE%9B%E7%A8%B3%E5%AE%9A%E4%B8%94%E6%9C%80%E6%96%B0%E7%9A%84nginx%E7%89%88%E6%9C%AC%EF%BC%8C%E6%94%AF%E6%8C%81QUIC + HTTP/3、https://github.com/google/ngx_brotli%E3%80%81njs%E6%A8%A1%E5%9D%97%E5%8F%8AA%E7%BA%A7SSL%E9%85%8D%E7%BD%AE%EF%BC%8C%E9%80%82%E7%94%A8%E4%BA%8E%E9%9C%80%E8%A6%81%E9%AB%98%E6%80%A7%E8%83%BD%E3%80%81%E5%AE%89%E5%85%A8%E4%B8%94%E6%94%AF%E6%8C%81%E7%8E%B0%E4%BB%A3%E7%BD%91%E7%BB%9C%E5%8D%8F%E8%AE%AE%E7%9A%84Web%E6%9C%8D%E5%8A%A1%E5%9C%BA%E6%99%AF%E3%80%82

核心功能和特性

包含组件

• 内置nginx模块：完整支持nginx官方模块
• headers-more-nginx-module：https://github.com/openresty/headers-more-nginx-module#readme
• ngx_brotli：https://github.com/google/ngx_brotli#configuration-directives%EF%BC%88%E7%AC%A6%E5%90%88RFC7932%E6%A0%87%E5%87%86%EF%BC%89
• ngx_http_geoip2_module：基于客户端IP从MaxMind GeoIP2数据库创建变量https://github.com/leev/ngx_http_geoip2_module#download-maxmind-geolite2-database-optional
• njs模块：JavaScript子集扩展nginx功能

技术规格

$ docker run -it macbre/nginx-http3 nginx -V
nginx version: nginx/1.25.2 (quic-44536076405c-boringssl-e1b8685770d0e82e5a4a3c5d24ad1602e05f2e83)
built by gcc 12.2.1 20220924 (Alpine 12.2.1_git20220924-r4) 
built with OpenSSL 1.1.1 (compatible; BoringSSL) (running with BoringSSL)
TLS SNI support enabled
configure arguments: 
	--build=quic-44536076405c-boringssl-e1b8685770d0e82e5a4a3c5d24ad1602e05f2e83 
	--prefix=/etc/nginx 
	--sbin-path=/usr/sbin/nginx 
	--modules-path=/usr/lib/nginx/modules 
	--conf-path=/etc/nginx/nginx.conf 
	--error-log-path=/var/log/nginx/error.log 
	--http-log-path=/var/log/nginx/access.log 
	--pid-path=/var/run/nginx.pid 
	--lock-path=/var/run/nginx.lock 
	--http-client-body-temp-path=/var/cache/nginx/client_temp 
	--http-proxy-temp-path=/var/cache/nginx/proxy_temp 
	--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp 
	--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp 
	--http-scgi-temp-path=/var/cache/nginx/scgi_temp 
	--user=nginx 
	--group=nginx 
	--with-http_ssl_module 
	--with-http_realip_module 
	--with-http_addition_module 
	--with-http_sub_module 
	--with-http_dav_module 
	--with-http_flv_module 
	--with-http_mp4_module 
	--with-http_gunzip_module 
	--with-http_gzip_static_module 
	--with-http_random_index_module 
	--with-http_secure_link_module 
	--with-http_stub_status_module 
	--with-http_auth_request_module 
	--with-http_xslt_module=dynamic 
	--with-http_image_filter_module=dynamic 
	--with-http_geoip_module=dynamic 
	--with-http_perl_module=dynamic 
	--with-threads 
	--with-stream 
	--with-stream_ssl_module 
	--with-stream_ssl_preread_module 
	--with-stream_realip_module 
	--with-stream_geoip_module=dynamic 
	--with-http_slice_module 
	--with-mail 
	--with-mail_ssl_module 
	--with-compat 
	--with-file-aio 
	--with-http_v2_module 
	--with-http_v3_module 
	--add-module=/usr/src/ngx_brotli 
	--add-module=/usr/src/headers-more-nginx-module-0.34 
	--add-module=/usr/src/njs/nginx 
	--add-dynamic-module=/usr/src/ngx_http_geoip2_module 
	--with-cc-opt=-I../boringssl/include 
	--with-ld-opt='-L../boringssl/build/ssl -L../boringssl/build/crypto'

$ docker run -it macbre/nginx-http3 njs -v
0.8.1

使用方法和配置说明

拉取镜像

此镜像基于官方https://hub.docker.com/_/nginx/%EF%BC%8C%E9%99%A4%E6%A0%87%E5%87%86%E9%85%8D%E7%BD%AE%E5%A4%96%EF%BC%8C%E8%BF%98%E6%94%AF%E6%8C%81Brotli%E6%A8%A1%E5%9D%97%E7%89%B9%E5%AE%9A%E6%8C%87%E4%BB%A4%EF%BC%88%E8%AF%A6%E8%A7%81https://github.com/google/ngx_brotli#configuration-directives%EF%BC%89%E3%80%82

从Docker Hub拉取：

docker pull macbre/nginx-http3:latest

从GitHub Container Registry拉取：

docker pull ghcr.io/macbre/nginx-http3:latest

配置示例

QUIC + HTTP/3支持

server {
    # http/3
    listen 443 quic reuseport;

    # http/2 和 http/1.1
    listen 443 ssl;
    http2 on;

    server_name localhost;  # 自定义为您的域名

    # 运行容器时需挂载以下文件
    ssl_certificate     /etc/nginx/ssl/localhost.crt;
    ssl_certificate_key /etc/nginx/ssl/localhost.key;

    # QUIC需要TLSv1.3
    ssl_protocols TLSv1.2 TLSv1.3;

    # 0-RTT QUIC连接恢复
    ssl_early_data on;

    # 添加Alt-Svc头协商HTTP/3
    add_header alt-svc 'h3=":443"; ma=86400';

    # 当使用QUIC时发送
    add_header QUIC-Status $http3;

    location / {
        # 自定义配置
    }
}

SSL A级处理

参考Mozilla SSL配置生成器，镜像已内置DHE密码套件的DH参数（路径：/etc/ssl/dhparam.pem）：

ssl_dhparam /etc/ssl/dhparam.pem;

配置文件包含

• /etc/nginx/main.d目录下的.conf文件将被包含在nginx主配置上下文（如可使用env指令）
• /etc/nginx/conf.d目录下的.conf文件将被包含在http配置上下文

开发

构建镜像

docker pull ghcr.io/macbre/nginx-http3:latest
DOCKER_BUILDKIT=1 docker build . -t macbre/nginx --cache-from=ghcr.io/macbre/nginx-http3:latest --progress=plain

运行容器

参考run-docker.sh脚本了解如何正确挂载配置文件和资源。