Nginx ±àÒ뿪Æô Quic »ò HTTP/3

# Debian 11»ò12
apt update
apt install build-essential ca-certificates zlib1g-dev libpcre3 libpcre3-dev tar unzip libssl-dev wget curl git cmake ninja-build mercurial libunwind-dev pkg-config
# Ubuntu 22.04»ò20.04
sudo su
cd /root
apt update
apt install build-essential ca-certificates zlib1g-dev libpcre3 libpcre3-dev tar unzip libssl-dev wget curl git cmake ninja-build mercurial libunwind-dev pkg-config
# CentOS 8 Stream/TencentOS Server 3.1
dnf update
dnf install gcc gcc-c++ pcre-devel openssl-devel zlib-devel cmake make libunwind-devel hg git wget
# OpenCloudOS Server 8
dnf update
dnf install gcc gcc-c++ pcre-devel openssl-devel zlib-devel cmake make hg git wget

wget https://dl.google.com/go/go1.22.1.linux-amd64.tar.gz
rm -rf /usr/local/go && tar -C /usr/local -xzf go1.22.1.linux-amd64.tar.gz

export PATH=$PATH:/usr/local/go/bin

go version

export GOPROXY=https://mirrors.cloud.tencent.com/go/

git clone --depth=1 https://github.com/google/boringssl.git
cd boringssl
mkdir build
cd build
cmake -GNinja ..
ninja
cd ../..

git clone --depth=1 https://github.com/google/boringssl.git
cd boringssl
mkdir build
cd build
cmake -DCMAKE_BUILD_TYPE=Release .. 
make
cd ../..

git clone --recurse-submodules -j8 https://github.com/google/ngx_brotli
cd ngx_brotli/deps/brotli
mkdir out && cd out
cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF -DCMAKE_C_FLAGS="-Ofast -march=native -mtune=native -flto -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" -DCMAKE_CXX_FLAGS="-Ofast -march=native -mtune=native -flto -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" -DCMAKE_INSTALL_PREFIX=./installed ..
cmake --build . --config Release --target brotlienc
cd ../../../..

hg clone https://hg.nginx.org/nginx
cd nginx
./auto/configure --user=www --group=www --prefix=/www/server/nginx --with-pcre  --add-module=/root/ngx_brotli --with-http_v2_module --with-stream --with-stream_ssl_module --with-http_ssl_module --with-http_gzip_static_module --with-http_gunzip_module --with-http_sub_module --with-http_flv_module --with-http_addition_module --with-http_realip_module --with-http_mp4_module --with-ld-opt=-Wl,-E --with-cc-opt=-Wno-error --with-ld-opt=-ljemalloc --with-http_dav_module --with-http_v3_module  --with-cc=c++ --with-cc-opt="-I../boringssl/include -x c" --with-ld-opt="-L../boringssl/build/ssl -L../boringssl/build/crypto"
make
make install

groupadd www
useradd -g www -s /sbin/nologin www

[Unit]
Description=nginx
After=network.target

[Service]
Type=forking
ExecStart=/www/server/nginx/sbin/nginx
ExecReload=/www/server/nginx/sbin/nginx -s reload
ExecStop=/www/server/nginx/sbin/nginx -s quit
PrivateTmp=true

[Install]
WantedBy=multi-user.target

systemctl start nginx

systemctl enable nginx

server {
       listen 443 ssl;
       listen [::]:443 ssl;

       # ÓÃÓÚÖ§³ÖQuic»òHTTP/3
       listen 443 quic reuseport;
       listen [::]:443 quic reuseport;

       # ÓÃÒÔÖ§³ÖHTTP/2
       http2 on;

       server_name r2wind.cn;

       # Quic»òHTTP/3ÏìӦͷ
       add_header Alt-Svc 'h3=":443"; ma=86400';
       # HSTS
       add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";

       location / {
           root /www/wwwroot/r2wind.cn; 
           index  index.html index.htm;
         }

       # Ö¤ÊéÅäÖÃ
       ssl_certificate /root/.acme.sh/smb.wiki/fullchain.cer; 
       ssl_certificate_key /root/.acme.sh/smb.wiki/smb.wiki.key;
       ssl_session_timeout 5m;
       ssl_protocols TLSv1.2 TLSv1.3; 
       ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; 
       ssl_prefer_server_ciphers on;
    }

systemctl reload nginx