Repository: docmirror/dev-sidecar-doc Branch: main Commit: f1a9f8775d5e Files: 12 Total size: 12.6 KB Directory structure: gitextract_d1jnicqc/ ├── .gitignore ├── README.md ├── cf-works.md ├── docker/ │ ├── Dockerfile │ ├── config/ │ │ ├── nginx.conf │ │ └── start.sh │ └── docker-compose.yml ├── docker.md ├── ds-nginx/ │ ├── docker-compose.yml │ └── ssl/ │ ├── cert.crt │ └── cert.key └── ow.md ================================================ FILE CONTENTS ================================================ ================================================ FILE: .gitignore ================================================ # Created by .ignore support plugin (hsz.mobi) .idea ================================================ FILE: README.md ================================================ # dev-sidecar-doc ================================================ FILE: cf-works.md ================================================ # 部署到cloudflare免费workers上 ## 1、 注册cloudflare账号 https://www.cloudflare.com/ 验证完邮箱 ## 2、创建workers * 点击左侧Workers菜单 * 点击右边创建服务按钮 * 服务名称随意填写（YourWorkersName） * 点击右下角的创建服务，创建成功后会自动进入服务配置页面 ## 3、部署代理脚本 * 点击快速编辑按钮 * 删除左侧原有的代码 * 将下方代码粘贴进去 * 按照代码中注释部分进行修改 ```js addEventListener("fetch", event => { event.respondWith(eventHandler(event)) }) async function eventHandler(event) { const req = event.request const url = req.url // YourWorkersName.YourAccountName.修改为你的works地址 // xxxxxxx改成任意一串字符，作为path，当做密码，不要公开 const target = url.replace("https://YourWorkersName.YourAccountName.workers.dev/xxxxxxxx/","") req.url = target; if(target.startsWith("http")){ return new Response("500") } const resp = await fetch("https://"+target,req) return resp } ``` ## 4、 点击部署按钮 ## 5、 配置DevSidecar功能增强的代理服务端 域名 = YourWorkersName.YourAccountName.workers.dev 路径 = xxxxxxxx 配置你代码中的域名和路径，点击应用即可 ## 6、 测试访问 ================================================ FILE: docker/Dockerfile ================================================ FROM nginx:1.19.4 ENV TZ=Asia/Shanghai ENV PASSWORD='' COPY ./config/nginx.conf /etc/nginx/nginx-template.conf COPY ./config/start.sh /app/start.sh RUN chmod +x /app/start.sh CMD ["/app/start.sh"] ================================================ FILE: docker/config/nginx.conf ================================================ user nginx; worker_processes auto; worker_rlimit_nofile 10000; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { use epoll; multi_accept on; worker_connections 10240; } http { include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '[$time_local] $remote_addr "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; sendfile on; #tcp_nopush on; #gzip on; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; keepalive_timeout 65; client_max_body_size 50m; server { listen 443 ssl; # 1.1版本后这样写 server_name ${HOSTNAME} ; #填写绑定证书的域名 ssl_certificate ${SSL_CERTIFICATE}; # 指定证书的位置，绝对路径 ssl_certificate_key ${SSL_CERTIFICATE_KEY}; # 绝对路径，同上 ssl_session_timeout 5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; #按照这个协议配置 ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;#按照这个套件配置 ssl_prefer_server_ciphers on; client_max_body_size 50M; client_body_buffer_size 10M; location ^~/${CONTEXT_PATH}/ { resolver 1.1.1.1 ipv6=off; if ( $http_dspassword != '${PASSWORD}' ){ return 403; } set $_full_uri $uri$is_args$args; if ( $_full_uri ~ /${CONTEXT_PATH}/([^/]+)/(.*) ){ set $_host $1; set $_uri $2; } proxy_pass $scheme://$_host/$_uri; proxy_redirect https://${HOSTNAME}/${CONTEXT_PATH}/ /; proxy_buffer_size 64k; proxy_buffers 64 64k; proxy_busy_buffers_size 1m; proxy_temp_file_write_size 512k; proxy_max_temp_file_size 128m; # proxy_set_header referer $scheme://$_host; 要去掉 proxy_set_header Host $_host; proxy_ssl_server_name on; proxy_set_header dspassword ''; } location /${CONTEXT_PATH}/robots.txt { resolver 1.1.1.1; deny all; } location / { resolver 1.1.1.1; deny all; } } include /etc/nginx/conf.d/*.conf; } ================================================ FILE: docker/config/start.sh ================================================ cp -f '/etc/nginx/nginx-template.conf' '/etc/nginx/nginx.conf' sed -i 's#${SSL_CERTIFICATE}#'"$SSL_CERTIFICATE"'#g' '/etc/nginx/nginx.conf' sed -i 's#${SSL_CERTIFICATE_KEY}#'"$SSL_CERTIFICATE_KEY"'#g' '/etc/nginx/nginx.conf' sed -i 's#${HOSTNAME}#'"$HOSTNAME"'#g' '/etc/nginx/nginx.conf' sed -i 's#${PASSWORD}#'"$PASSWORD"'#g' '/etc/nginx/nginx.conf' sed -i 's#${CONTEXT_PATH}#'"$CONTEXT_PATH"'#g' '/etc/nginx/nginx.conf' nginx -g 'daemon off;' ================================================ FILE: docker/docker-compose.yml ================================================ version: '2.4' services: nginx: container_name: dev-sidecar-nginx image: docmirror/dev-sidecar-nginx:1.3.0 build: context: ./ dockerfile: Dockerfile restart: always ports: - 443:443 volumes: - /disk02/www:/usr/share/nginx/html environment: - TZ=Asia/Shanghai - SSL_CERTIFICATE=/app/ssl/cert.crt - SSL_CERTIFICATE_KEY=/app/ssl/cert.key - HOSTNAME=yourdomain.com - PASSWORD=123456 - CONTEXT_PATH=change_me ================================================ FILE: docker.md ================================================ # docker镜像启动 安装步骤 * 安装docker * 安装docker-compose * 启动nginx容器 * 配置dev-sidecar * go ## 1、安装docker 如果你是centos8.x ```shell yum remove podman # 先卸载podman，docker-ce与podman有冲突 # 如果你的系统已经有应用跑在podman上，就不要卸载了，请安装podman-compose，然后直接看第3步 ``` 如果你是centos，执行如下命令即可 ```shell sudo yum install -y yum-utils sudo yum-config-manager \ --add-repo \ https://download.docker.com/linux/centos/docker-ce.repo sudo yum install docker-ce docker-ce-cli containerd.io sudo systemctl enable docker.service sudo systemctl start docker ``` 如果不是centos，请按如下官方步骤安装好docker https://docs.docker.com/engine/install/centos/ ## 2、安装docker-compose ```shell sudo curl -L "https://github.com/docker/compose/releases/download/1.28.6/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose sudo chmod +x /usr/local/bin/docker-compose ``` 更多安装信息，请参考官方文档 https://docs.docker.com/compose/install/ ## 3、启动nginx容器 * 先 clone 本仓库到本地 * 复制你的证书文件到`ds-nginx/ssl`目录下 * 修改`ds-nginx`下的`docker-compose.yml`文件(按照里面的提示修改) * 将`ds-nginx`整个目录，上传到你服务器的`~/deploy/`目录下 * 执行启动命令 ```shell cd ~/deploy/ds-nginx/ docker-compose up -d ``` ## 4、修改dev-sidecar服务端配置 按如下设置 应用---> 功能增强 ---> 代理服务端 填上一步时配置的三个变量（域名、路径、密码），应用即可 ![](./image/server.png) # 问题排查 打印nginx日志,看看有什么报错 ```shell docker logs -f --tail 200 dev-sidecar-nginx ``` ================================================ FILE: ds-nginx/docker-compose.yml ================================================ version: '2.4' services: nginx: container_name: dev-sidecar-nginx image: docmirror/dev-sidecar-nginx:1.3.0 restart: always ports: - 443:443 volumes: - ~/deploy/ds-nginx/ssl:/app/ssl/ # 证书目录映射，不用动 environment: - TZ=Asia/Shanghai - SSL_CERTIFICATE=/app/ssl/cert.crt # 这里修改为 /app/ssl/你的证书名称 - SSL_CERTIFICATE_KEY=/app/ssl/cert.key # 这里修改为 /app/ssl/你的证书私钥名称 - HOSTNAME=yourdomain.com # 修改为你的域名 - CONTEXT_PATH=ertccawe24234 # 路径，随便乱输入就行 - PASSWORD=yourpassword # 密码 ================================================ FILE: ds-nginx/ssl/cert.crt ================================================ -----BEGIN CERTIFICATE----- MIIFIDCCBAigAwIBAgISBJrGhBBxZvgI/BOL+CjuGKe2MA0GCSqGSIb3DQEBCwUA MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD EwJSMzAeFw0yMTAyMDgwNDUyMTlaFw0yMTA1MDkwNDUyMTlaMBkxFzAVBgNVBAMM DiouZG9jbWlycm9yLmNuMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA wgs/L3dz1lSCsPQ96G1+qlBKl0orJb9lu7DU5f/xSRQ+yguuzuKp81cswD5O8fl+ kBnHha9s83NtMovDRUtbg/wUnZnvYkIHwTR6keItTw632yFBD9ms3l+WBaINx1Xr o8CBYraUIEP+PNpNvEerPzxAj7Qd00Pg0w/zztLDfgrpgbSSJdX6LbYFJyQlj5bv j58hLAMQYayV9fjfbYnMWnsugjrdRzr3Jlv0cIC9fOOrrb0FaequPsfRT4rQpjfy phrO4KFziyLvYcjhC90GS38ff0Jl0Yritk9HgpYFOlhZZrhqJXsaIix6kwlU83sn TFQ3NexVoHjGmxOyTXEJVwIDAQABo4ICRzCCAkMwDgYDVR0PAQH/BAQDAgWgMB0G A1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1Ud DgQWBBS0hy/hOrr/zAqUbyKsy8JTU0tDlzAfBgNVHSMEGDAWgBQULrMXt1hWy65Q CUDmH6+dixTCxjBVBggrBgEFBQcBAQRJMEcwIQYIKwYBBQUHMAGGFWh0dHA6Ly9y My5vLmxlbmNyLm9yZzAiBggrBgEFBQcwAoYWaHR0cDovL3IzLmkubGVuY3Iub3Jn LzAZBgNVHREEEjAQgg4qLmRvY21pcnJvci5jbjBMBgNVHSAERTBDMAgGBmeBDAEC ATA3BgsrBgEEAYLfEwEBATAoMCYGCCsGAQUFBwIBFhpodHRwOi8vY3BzLmxldHNl bmNyeXB0Lm9yZzCCAQIGCisGAQQB1nkCBAIEgfMEgfAA7gB1AJQgvB6O1Y1siHMf gosiLA3R2k1ebE+UPWHbTi9YTaLCAAABd4AyqGAAAAQDAEYwRAIgA3E2ZayN+1ib NcCj0IO8utCmiiOlH8Q9anUJRIKVKhQCIELac+SSuabDz4N3zShFE5Cl+Gx0VxmQ BULvE55PoFxsAHUAfT7y+I//iFVoJMLAyp5SiXkrxQ54CX8uapdomX4i8NcAAAF3 gDKoUwAABAMARjBEAiA6uVlyVH6aLBaBXvj3ZHHIy7xg/Y7TOxuDhgEn56/fzwIg b+CT4OWHEHjdoQ4+sf7k+GoHBSYUfEPcKmgI2RqjfWkwDQYJKoZIhvcNAQELBQAD ggEBAJb8+tmI1UKuTkNgusbNWLm4IskCmBVkjU9WLuReZmu5eBWLV++y8nHzmwok fDqGXuIeVRYLVdXj5pquiaZxw7/KFP5FXDBh3RHQWwAINDKY1xilOoGDG6aVheBV zo5vTeyxs2VinMDP3exGwxDkuxiyT1OllXb2acTzV7BbH2YovdQKBKfkRbhWvTlp Zbr36/dYyixr6owWg4SH+TpUSfj2O7Hu7EvrY5u88HWbeD/mTz9AMtw2p/kQaET/ 1l+GAYV/u6etiSXsLf0xtiIlIgIA/w+VJGeeBtwQ5E4S9EWLDm7mo4HPx4UtCQ/+ CQlckuKGAH+G9zKM93vE68kXrLI= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEZTCCA02gAwIBAgIQQAF1BIMUpMghjISpDBbN3zANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0MFoXDTIxMDkyOTE5MjE0MFow MjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMT AlIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuwIVKMz2oJTTDxLs jVWSw/iC8ZmmekKIp10mqrUrucVMsa+Oa/l1yKPXD0eUFFU1V4yeqKI5GfWCPEKp Tm71O8Mu243AsFzzWTjn7c9p8FoLG77AlCQlh/o3cbMT5xys4Zvv2+Q7RVJFlqnB U840yFLuta7tj95gcOKlVKu2bQ6XpUA0ayvTvGbrZjR8+muLj1cpmfgwF126cm/7 gcWt0oZYPRfH5wm78Sv3htzB2nFd1EbjzK0lwYi8YGd1ZrPxGPeiXOZT/zqItkel /xMY6pgJdz+dU/nPAeX1pnAXFK9jpP+Zs5Od3FOnBv5IhR2haa4ldbsTzFID9e1R oYvbFQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E BAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5p ZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTE p7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEE AYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2Vu Y3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0 LmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYf r52LFMLGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0B AQsFAAOCAQEA2UzgyfWEiDcx27sT4rP8i2tiEmxYt0l+PAK3qB8oYevO4C5z70kH ejWEHx2taPDY/laBL21/WKZuNTYQHHPD5b1tXgHXbnL7KqC401dk5VvCadTQsvd8 S8MXjohyc9z9/G2948kLjmE6Flh9dDYrVYA9x2O+hEPGOaEOa1eePynBgPayvUfL qjBstzLhWVQLGAkXXmNs+5ZnPBxzDJOLxhF2JIbeQAcH5H0tZrUlo5ZYyOqA7s9p O5b85o3AM/OJ+CktFBQtfvBhcJVd9wvlwPsk+uyOy2HI7mNxKKgsBTt375teA2Tw UdHkhVNcsAKX1H7GNNLOEADksd86wuoXvg== -----END CERTIFICATE----- ================================================ FILE: ds-nginx/ssl/cert.key ================================================ -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY----- ================================================ FILE: ow.md ================================================ # 梯子原理 1. 通过两层代理，将目标请求链接隐藏在https之中被加密，规避GFW的https握手特征检查 2. 通过二级路径（下图的xxxxxxxx），规避GFW的试探性钓鱼检查 ``` 浏览器访问： https://www.google.com | DevSidecar【第一层代理】： https://yourdomain.com/xxxxxxxx/www.google.com/ | GFW： GFW | 境外Nginx【第二层代理】： 获取到xxxxxxxx之后的域名和地址，代理到https://www.google.com | DevSidecar： 返回给DevSidecar | 浏览器访问： 返回给浏览器 ``` 在GFW看来你的流量就是在访问`yourdomain.com`这个正常的网站而已 缺点： > 1、 仅支持HTTPS > 2、 只是简单的代理转发。 > 所以服务端可以篡改内容，存在安全风险，为了安全，最好是自建服务端。 > 理论上可以在`yourdomain.com/xxxxxxxx`的wss作为加密传输通道，通道内传输http访问请求，就可以不需要信任根证书了（有空再研究，现阶段的简单实现已经够用，不介意根证书的话） 总结两点： > 大道至简：做的越多，错的越多。简单最有效，大隐隐于市。 > 降维打击：安全我都不要了。(自建服务器可以解决) ## 自建服务端步骤 配置非常简单，会搭nginx即可 ### 1. 准备工作 * 一台境外服务器 * 一个域名，免费证书 * 下载[DevSidecar](https://github.com/docmirror/dev-sidecar) 我的服务器是[1核1G的香港主机](https://www.ucloud.cn/site/active/kuaijie.html?invitation_code=C1xF886DAFF2658) 如果你没有合适的境外主机，可以点击链接去购买，新用户还是挺划算的 > 另外感谢群友@#贡献的一台日本服务器 ### 2. nginx配置 ``` 你需要定义如下三个变量 域名：yourdomain.com 你注册域名，千万别跟google facebook github这些重点监控的域名相似 路径：xxxxxxxx 你随便乱敲一串字母就行 密码：yourpassword 同上 证书：/xx/ssl证书.crt 绝对路径 /xx/ssl证书私钥.key ``` ``` server { listen 443 ssl; server_name yourdomain.com ; # 修改为你的域名 ssl_certificate /app/ssl/ssl证书.crt; # 修改为你域名ssl证书的绝对路径 ssl_certificate_key /app/ssl/ssl证书私钥.key; # 修改为ssl证书私钥绝对路径 ssl_session_timeout 5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; ssl_prefer_server_ciphers on; location ^~/xxxxxxxx/ { # xxxxxxxx 改成你自己随便任意的前缀地址 resolver 1.1.1.1 ipv6=off; if ( $http_dspassword != 'your password' ){ # 校验密码，如果不配置密码，去掉它即可 return 404; # 也可以改成403、502等其他错误,最好与下面的返回一致 } set $_full_uri $uri$is_args$args; if ( $_full_uri ~ /xxxxxxxx/([^/]+)/(.*) ){ # 将xxxxxxxx修改为你路径前缀 set $_host $1; # 获取路径后的目标网站的域名 set $_uri $2; # 获取目标网站的请求地址 } proxy_pass $scheme://$_host/$_uri; proxy_redirect https://yourdomain.com/xxxxxxxx/ /; # 修改为你的域名和路径前缀 proxy_buffer_size 32k; proxy_buffers 64 32k; proxy_busy_buffers_size 1m; proxy_temp_file_write_size 512k; proxy_max_temp_file_size 128m; proxy_set_header Host $_host; proxy_ssl_server_name on; proxy_set_header dspassword ''; } location / { # 其他访问全部拒绝，规避GFW的钓鱼试探 resolver 1.1.1.1; return 404; # 也可以改成403、502等其他错误，最好与上面的密码错误返回一致，或者返回一个伪装网站 } } ``` ### 3. DevSidecar配置 按如下设置 应用---> 功能增强 ---> 代理服务端 填上nginx配置时用的那三个变量，应用即可 ![](./image/server.png) > `xxxxxxxx`一定要修改成你自己的，你把它也当成是一个密码 > 注意保护好 `域名、路径 和密码`，不要公开 ## 其他部署方式 ### 1、docker镜像启动 如果你不会安装nginx，推荐你按下面的docker镜像启动更方便 [docker启动教程](./docker.md) ### 2、cf-workers 你也可以试试免费的[cf-workers](./cf-works.md)