CentOS 7 编译安装 nginx+quic —— 筑梦之路

nginx-quic编译安装
 
操作系统： centos 7 minal x86_64
 
nginx-quic：https://quic.nginx.org/readme.html 官方安装文档
 
 
安装常用工具：
yum install -y lrzsz wget curl unzip vim hg git gcc-c++ make automake openssl-devel
 
# CentOS 安装libunwind扩展库
yum install libunwind-devel -y
 
#安装go
wget https://dl.google.com/go/go1.15.2.linux-amd64.tar.gz
tar -C /usr/local -xzf go1.15.2.linux-amd64.tar.gz
# 设置系统环境变量，也可以写入到profile中
export PATH=$PATH:/usr/local/go/bin
export PATH=$PATH:$HOME/.cargo/bin
export GOROOT=/usr/local/go
export GOBIN=$GOROOT/bin
export PATH=$PATH:$GOBIN
#设置国内代理
go env -w GOPROXY=https://goproxy.cn,direct
 
#安装cmake3
wget https://cmake.org/files/v3.16/cmake-3.16.0-rc2.tar.gz
tar xvzf cmake-3.16.0-rc2.tar.gz
cd cmake-3.16.0-rc2
#yum install -y gcc-c++ make automake openssl-devel
./bootstrap
gmake
gmake install
 
cmake --version
 
#boringssl库
git clone https://github.com/google/boringssl.git
cd boringssl
mkdir build
cd build 
cmake ../
make
 
###报错解决
https://blog.csdn.net/aria_miazzy/article/details/107532236
 
 
src/event/ngx_event_quic_transport.c: In function ‘ngx_quic_create_stream’:
src/event/ngx_event_quic_transport.c:54:9: error: comparison is always true due to limited range of data type [-Werror=type-limits]
      : ((uint32_t) value) <= 16383 ? 2                                        \
         ^
src/event/ngx_event_quic_transport.c:1299:15: note: in expansion of macro ‘ngx_quic_varint_len’
         len = ngx_quic_varint_len(sf->type);
               ^
cc1: all warnings being treated as errors
make[1]: *** [objs/src/event/ngx_event_quic_transport.o] Error 1
make[1]: Leaving directory `/root/nginx-quic'
make: *** [build] Error 2
 
 
####
cd nginx-quic\objs
  
vi Makefile
  
找到 CFLAGS = -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g -I../boringssl/include将-Werror参数去掉。
 
 
 
#安装rust
curl https://sh.rustup.rs -sSf | sh
 
#下载源码并配置
$ hg clone -b quic https://hg.nginx.org/nginx-quic
$ cd nginx-quic
$ ./auto/configure --with-debug --with-http_v3_module       \
    --with-stream_quic_module --with-http_ssl_module --with-http_v2_module \
                       --with-cc-opt="-I../boringssl/include"   \
                       --with-ld-opt="-L../boringssl/build/ssl  \
                                      -L../boringssl/build/crypto"
 
 
--with-http_v3_module     - enable QUIC and HTTP/3
        --with-http_quic_module   - enable QUIC for older HTTP versions
        --with-stream_quic_module - enable QUIC in Stream
 
make && make install
 
#配置nginx:
server {
    listen 443 ssl http2;              # TCP listener for HTTP/2
    listen 443 http3 reuseport;  # UDP listener for QUIC+HTTP/3
  
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # QUIC requires TLS 1.3
    ssl_certificate     ssl/www.example.com.crt;
    ssl_certificate_key ssl/www.example.com.key;
  
    add_header Alt-Svc 'quic=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"'; # Advertise that QUIC is available
     
    location / {
                # required for browsers to direct them into quic port
        add_header Alt-Svc '$http3=":443"; ma=86400';
    }
 
}
 
firewall-cmd --zone=public --add-port=443/udp --permaent
firewall-cmd --reload
 
#openssl自签名证书
https://www.cnblogs.com/hnxxcxg/p/7610582.html
 
#生成私钥：
openssl genrsa -des3 -out server.key 1024
 
#证书签名请求
openssl req -new -key server.key -out server.csr
 
说明：需要依次输入国家，地区，城市，组织，组织单位，Common Name和Email。其中Common Name，可以写自己的名字或者域名，
 
如果要支持https，Common Name应该与域名保持一致，否则会引起浏览器警告
#删除私钥密码：
openssl rsa -in server.key -out server.key
 
#生成自签名证书
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
 
 
 
#配置流媒体服务器
需要使用nginx-rtmp模块，需要重新编译
#下载nginx-rtmp模块 
git clone https://github.com/arut/nginx-rtmp-module.git
重新配置
./auto/configure --with-http_v3_module --with-stream --with-http_quic_module --with-http_gunzip_module \
    --with-stream_quic_module --with-http_ssl_module --with-http_v2_module --add-module=/opt/nginx-rtmp-module --with-http_stub_status_module --with-pcre --with-http_dav_module --with-http_flv_module --with-http_mp4_module \
                       --with-cc-opt="-I../boringssl/include"   \
                       --with-ld-opt="-L../boringssl/build/ssl  \
                                      -L../boringssl/build/crypto"
                                       
                                       
                                       
                                       
make && make install
 
#流媒体配置：
这里自己编译的始终不行，还需要再研究研究。
https://github.com/evansun922/nginx-quic 参考此开源项目
 
     
参考文章：
https://www.nange.cn/quic-and-http3-for-nginx.html
https://blog.csdn.net/maimang1001/article/details/103603434
https://blog.csdn.net/aria_miazzy/article/details/107532236
 
简单安装方式：
https://www.mingilin.com/2020/11/06/centos/centos-nginx-quic/
https://copr.fedorainfracloud.org/coprs/ryoh/nginx-quic/
 
Centos 7:
sudo yum install epel-release
sudo yum install centos-release-scl
sudo yum install yum-plugin-copr
sudo yum copr enable ryoh/nginx-quic
sudo yum install nginx-quic
 
Centos 8:
sudo dnf install epel-release
sudo dnf copr enable ryoh/nginx-quic
sudo dnf install nginx-quic
 
增加配置：
listen 443 http3 reuseport;  # UDP listener for QUIC+HTTP/3
ssl_protocols TLSv1.3; # QUIC requires TLS 1.3
add_header Alt-Svc '$http3=":443"; ma=86400'; # Advertise that QUIC is available
add_header QUIC-Status $quic;

仅供参考

使用 BoringSSL 编译 NGINX_小叶寒笑的技术博客_51CTO博客

centos7升级gcc版本_51CTO博客_centos7 升级gcc

NGINX QUIC Preview

利用Nginx-Quic重新编译Nginx支持HTTP3+TLSv1.3 – 云否归档

# 下载 https://quic.nginx.org/readme.html

wget https://hg.nginx.org/nginx-quic/archive/tip.zip

# 配置

cd nginx-quic-70ce1e927715

./auto/configure \
--prefix=/usr/share/nginx \
--conf-path=/etc/nginx/nginx.conf \
--http-log-path=/var/log/nginx/access.log \
--error-log-path=/var/log/nginx/error.log \
--lock-path=/var/lock/nginx.lock \
--pid-path=/run/nginx.pid \
--modules-path=/usr/lib/nginx/modules \
--http-client-body-temp-path=/var/lib/nginx/body \
--http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
--http-proxy-temp-path=/var/lib/nginx/proxy \
--http-scgi-temp-path=/var/lib/nginx/scgi \
--http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
--with-compat \
--with-debug \
--with-pcre-jit \
--with-http_ssl_module \
--with-http_stub_status_module \
--with-http_realip_module \
--with-http_auth_request_module \
--with-http_v2_module \
--with-http_dav_module \
--with-http_slice_module \
--with-threads \
--with-http_addition_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_sub_module \
--with-stream \
--with-http_v3_module \
--with-cc-opt="-I../boringssl/include" --with-ld-opt="-L../boringssl/build/ssl -L../boringssl/build/crypto" \
--with-stream_quic_module \
--with-ld-opt="-L../boringssl/build/ssl -L../boringssl/build/crypto"


# 编译
make

# 检查验证

./objs/nginx -V
nginx version: nginx/1.23.2
built by gcc 8.3.1 20190311 (Red Hat 8.3.1-3) (GCC) 
built with OpenSSL 1.1.1 (compatible; BoringSSL) (running with BoringSSL)
TLS SNI support enabled
configure arguments: --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-compat --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_sub_module --with-stream --with-http_v3_module --with-cc-opt=-I../boringssl/include --with-ld-opt='-L../boringssl/build/ssl -L../boringssl/build/crypto' --with-stream_quic_module --with-ld-opt='-L../boringssl/build/ssl -L../boringssl/build/crypto'

# 配置示例

server {
        listen       80;
        server_name  xx.xxx.com;
        root /usr/share/nginx/html;
        index  index.html index.htm;
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }
}
server {
        listen 443 http3;
        listen 443 ssl http2;
        server_name  xx.xxx.com;
        ssl_certificate /apps/nginx/sslkey/xxx.com/fullchain.crt;
        ssl_certificate_key /apps/nginx/sslkey/xxx.com/private.key;
        ssl_prefer_server_ciphers on;
        keepalive_timeout 60;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        ssl_early_data on;
        ssl_protocols TLSv1.3 TLSv1.2;
        ssl_ecdh_curve X25519:P-256:P-384;
        ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256;
        proxy_set_header Early-Data $ssl_early_data;
        add_header Alt-Svc 'h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"';
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
        root /usr/share/nginx/html;
        index  index.html index.htm;
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }
}

测试网站：

Check if HTTP/3 is enabled - Geekflare Tools

HTTP/3 Check