TechOverflow Logo
TechOverflow

Headscale nginx 反向代理配置

English Deutsch 简体中文

使用 nginx 反向代理 headscale 非常简单。你不需要任何特殊配置。

这是我的启用 Let’s Encrypt 的配置（部分配置是使用 certbot --nginx 自动生成的）。

确保设置端口（27896）以匹配映射到 Headscale 端口的端口。

headscale-nginx-reverse-proxy-config.txt
server {
    server_name  headscale.mydomain.com;

    location / {
        proxy_pass http://localhost:27896/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_redirect http:// https://;
        proxy_buffering off;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
        add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
    }

    listen [::]:443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mydomain-wildcard/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mydomain-wildcard/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot


}
server {
    if ($host = headscale.mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name  headscale.mydomain.com;

    listen [::]:80; # managed by Certbot
    return 404; # managed by Certbot
}

proxy_… upgrade 相关内容用于代理 websockets。我不知道是否需要，因为我没有尝试过，但保留它不会有什么坏处。

Check out similar posts by category: Headscale, Networking, Nginx