FRP 端口映射配置注释

给 web 服务做转发，比如从内网 443 端口转发到外网 10443 端口，在外网访问时要加上协议。

直接访问 <ip>:10443 浏览器会把请求解析为 http://<ip>:10443 使用 https 协议需要写 https://<ip>:10443 显式指定。

下面是一个服务端配置文件的例子:

# 下面这句开头必须要有，表示配置的开始
[common]

# frp 服务端端口（必须）
bind_port = <port>

# frp 服务端密码（必须）
token = <passwd-token>

# 认证超时时间，由于时间戳会被用于加密认证，防止报文劫持后被他人利用
# 因此服务端与客户端所在机器的时间差不能超过这个时间（秒）
# 默认为900秒，即15分钟，如果设置成0就不会对报文时间戳进行超时验证
authentication_timeout = 900

# 仪表盘端口，只有设置了才能使用仪表盘（即后台）
dashboard_port = 7500

# 仪表盘访问的用户名密码，如果不设置，则默认都是 admin
# 注意和 token 区分开。token 用于客户端与服务端通信
# dashboard_pwd 用于登录 web 后台
dashboard_user = <uname>
dashboard_pwd = <passwd-uname>

# 如果想要用 frp 穿透访问内网中的网站（例如路由器设置页面）
# 则必须要设置以下两个监听端口，不设置则不会开启这项功能
vhost_http_port = 10080
vhost_https_port = 10443

# 此设置需要配合客户端设置，仅在穿透到内网中的 http 或 https 时有用（可选）
# 假设此项设置为 example.com，客户端配置 http 时将 subdomain 字段设置为 test
# 在将 test.example.com 通过 DNS 解析到服务端 IP 后
# 可以使用此域名来访问客户端指定的 http
subdomain_host = lishouzhong.top

给一个自用的例子以供参考:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {
    include         /etc/nginx/mime.types;
    include         /etc/nginx/conf.d/*.conf;
    include         /etc/nginx/sites-enabled/*;
    default_type    application/octet-stream;

    log_format      main    '$remote_addr - $remote_user [$time_local] "$request" '
                            '$status $body_bytes_sent "$http_referer" '
                            '"$http_user_agent" "$http_x_forwarded_for" $upstream_cache_status';

    access_log      /var/log/nginx/access.log    main;
    error_log       /var/log/nginx/error.log;

    sendfile                on;
    tcp_nopush              on;
    tcp_nodelay             on;
    keepalive_timeout       65;
    types_hash_max_size     4096;

    resolver 8.8.8.8 8.8.4.4 valid=30s;

    # gzip
    gzip                on;
    gzip_buffers        16 8K;
    gzip_comp_level     6;
    gzip_min_length     1k;
    gzip_types          *;
    gzip_disable        "MSIE [1-6]\."; # ie6 and previous version do not suport gzip
    gzip_vary           on;

    proxy_cache_path    /var/lib/nginx/cache levels=1:2 keys_zone=my_cache:30m
                        max_size=2g inactive=3d use_temp_path=off
                        loader_threshold=300 loader_files=200;

    # ssl config
    ssl_certificate         </path/to/fullchain.pem>;
    ssl_certificate_key     </path/to/privkey.pem>;
    ssl_session_timeout     1d;
    ssl_session_cache       shared:MozSSL:10m;  # about 40000 sessions
    ssl_session_tickets     off;
    ssl_stapling            on; # open OCSP
    ssl_stapling_verify     on; # open OCSP verify

    # TLS version
    ssl_protocols           TLSv1.2 TLSv1.3;
    ssl_ciphers             ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    # ssl_prefer_server_ciphers   OFF; # default OFF

    ssl_trusted_certificate </path/to/fullchain.pem>;

    # WebSocket upgrade
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    # http to https
    server {
        listen                  80;
        listen                  [::]:80;
        server_name             .lishouzhong.top;

        location / {
            return 301          https://$host$request_uri;
        }
    }

    # frp admin
    server {
        listen              443 ssl http2;
        listen              [::]:443 ssl http2;
        server_name         frpdashboard.lishouzhong.top;

        location / {
            proxy_pass      http://127.0.0.1:7500;
        }
    }

    # frp http proxy psss
    server{
        listen                      443 ssl http2;
        server_name                 ~.*frp\.lishouzhong\.top$;

        location / {
            proxy_pass              http://127.0.0.1:10080;
            proxy_ssl_server_name   on;
            proxy_set_header        Host $host;
            # webwocket
            proxy_http_version      1.1;
            proxy_set_header        Upgrade $http_upgrade;
            proxy_set_header        Connection $connection_upgrade;
            proxy_read_timeout      300s;
            proxy_send_timeout      300s;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
    }

    # frp https proxy pass
    server{
        listen                      443 ssl http2 ;
        server_name                 ~.*frps\.lishouzhong\.top$;

        location / {
            proxy_pass              https://$host:10443;
            proxy_ssl_server_name   on;
            proxy_set_header        Host $host;
            # webwocket
            proxy_http_version      1.1;
            proxy_set_header        Upgrade $http_upgrade;
            proxy_set_header        Connection $connection_upgrade;
            proxy_read_timeout      300s;
            proxy_send_timeout      300s;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
    }
}