NewVFX中的Nginx配置HTTP3、HTTP2配置

在配置之前清确保Nginx版本大雨1.25，并正确编译配置了quictls模块，在你配置 Nginx 以支持 HTTP/3（QUIC）之前，确保 Nginx 版本 ≥ 1.25 且正确编译启用了 quictls 模块，这一步至关重要。下面是详细解释：

Nginx编译安装 QuicTLS（编译宝塔Nginx支持 HTTP/3 的）

server {
#################监听端口#############################
listen 80;
listen 443 ssl reuseport;
http2 on;
#listen 443 quic reuseport;
#http3 on;

############## 网站域名##############################
server_name newvfx.com www.newvfx.com *.newvfx.com v.newvfx.com docs.newvfx.com;

# 站点根目录与默认文件
index index.php index.html index.htm default.php default.htm default.html;
root /www/wwwroot/NewVFX;

###############Let's Encrypt 验证用###################
include /www/server/panel/vhost/nginx/well-known/newvfx.com.conf;
# SSL 证书配置（你已正确设置）
ssl_certificate /www/server/panel/vhost/cert/newvfx.com/fullchain.pem;
ssl_certificate_key /www/server/panel/vhost/cert/newvfx.com/privkey.pem;

######### 强制使用安全协议############################
ssl_protocols TLSv1.3 TLSv1.2;
#### TLS 1.2 使用的加密套件
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
#### TLS 1.3 使用的加密套件
ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
ssl_prefer_server_ciphers on;

############ 会话优化安全与兼容性其他细节#########################
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets on;
#####提前处理 TLS 握手，提高速度
ssl_early_data on;

#####遇到未使用 HTTPS 的请求，重定向
error_page 497 https://$host$request_uri;

####################### 安全 + HTTP/3 广播###############################
add_header Strict-Transport-Security "max-age=31536000" always;
add_header Alt-Svc 'h3=":443"; h2=":443"; ma=60' always; # 只缓存1分钟降低影响
#add_header Alt-Svc 'h2=":443"; ma=60' always; # 只广播H2
add_header QUIC-Status $http3 always;

#################### 跨域请求支持（可按需修改）###########################
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
#SSL-END

#########################jisongbin手工防火墙开始###############################
location ~* ^/members/(.*/activity/friends/|[0-9]+/media/[0-9]+/|535/activity/mentions/) {
# 默认不阻止
set $block_user_agent 0;

if ($http_user_agent ~* "Mozilla/5.0 \(Macintosh; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/124.0.0.0 Safari/537.36") {
set $block_user_agent 1;
}

if ($http_user_agent ~* "Mozilla/5.0 \(Windows NT 10.0; Win64; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/124.0.0.0 Safari/537.36 Edg/114.0.1823.43") {
set $block_user_agent 1;
}

if ($http_user_agent ~* "Chrome/124\.0\.0\.0") {
set $block_user_agent 1;
}

# 如果用户代理被阻止，则记录到单独的访问日志
if ($block_user_agent = 1) {
access_log /www/wwwlogs/blocked_user_agents.log;
return 403;
}
}
##############################jisongbin手工防火墙结束###########################

#引用重定向规则，注释后配置的重定向代理将无效
include /www/server/panel/vhost/nginx/redirect/newvfx.com/*.conf;
#SECURITY-START 防盗链配置
location ~ .*\.(jpg|jpeg|gif|mp4|mp3|png|js|css)$ {
expires 30d;
access_log /dev/null;
valid_referers none blocked *.qq.com *.fbcdn.net *.taobao.com *.qzone.qq.com *.xiaohongshu.com *.wx.qq.com *.toutiao.com *.bing.com *.baidu.com *.google.com *.weibo.com *.bilibili.com *.so.com *.zhihu.com *.twitter.com *.t.co *.wechat.com *.facebook.com *.tiktok.com *.douyin.com *.sina.com.cn *.163.com *.jd.com *.pinduoduo.com *.sm.cn *.sogou.com *.tmall.com *.newvfx.com;
if ($invalid_referer){
return 404;
}
}
#SECURITY-END

#ERROR-PAGE-START 错误页配置，可以注释、删除或修改
error_page 404 /404.html;
#error_page 502 /502.html;
#ERROR-PAGE-END

#PHP-INFO-START PHP引用配置，可以注释或修改
include enable-php-82.conf;
#PHP-INFO-END

#REWRITE-START URL重写规则引用,修改后将导致面板设置的伪静态规则失效
include /www/server/panel/vhost/rewrite/newvfx.com.conf;
#REWRITE-END

#禁止访问的文件或目录
location ~ ^/(\.user.ini|\.htaccess|\.git|\.env|\.svn|\.project|LICENSE|README.md)
{
return 404;
}

#一键申请SSL证书验证目录相关设置
location ~ \.well-known{
allow all;
}

#禁止在证书验证目录放入敏感文件
if ( $uri ~ "^/\.well-known/.*\.(php|jsp|py|js|css|lua|ts|go|zip|tar\.gz|rar|7z|sql|bak)$" ) {
return 403;
}

location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{
expires 30d;
error_log /dev/null;
access_log /dev/null;
}

location ~ .*\.(js|css)?$
{
expires 12h;
error_log /dev/null;
access_log /dev/null;
}
access_log /www/wwwlogs/newvfx.com.log;
error_log /www/wwwlogs/newvfx.com.error.log;
}

同时这里面有一段我写的防火墙功能，运行良好，可以替换为自己要拦截的User Agent即可。