mirrors2/eiblog
1
0
Fork 0
mirror of https://github.com/eiblog/eiblog.git synced 2026-03-01 00:34:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of github.com:eiblog/eiblog

Browse Source
This commit is contained in:
deepzz0
2017-10-19 20:23:45 +08:00
parent 41daaa322e 894535fbe5
commit c9fc0cc75a
3 changed files with 26 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
Makefile
View File

@@ -24,7 +24,6 @@ dist:
@./dist.sh @./dist.sh
gencert:makedir gencert:makedir
@echo $(Ali_Key) $(Ali_Secret)
@if [ ! -n "$(sans)" ]; then \ @if [ ! -n "$(sans)" ]; then \
printf "Need one argument [sans=params]\n"; \ printf "Need one argument [sans=params]\n"; \
printf "example: sans=\"-d domain -d domain\"\n"; \ printf "example: sans=\"-d domain -d domain\"\n"; \
@@ -40,32 +39,23 @@ gencert:makedir
fi fi
@echo "generate rsa cert..." @echo "generate rsa cert..."
@$(acme.sh) --force --issue --dns dns_ali \ @$(acme.sh) --force --issue --dns dns_ali $(sans) --log \
$(sans) --log --renew-hook "ct-submit ctlog.api.venafi.com < $(config)/ssl/domain.rsa.pem > $(config)/scts/rsa/venafi.sct && \ --renew-hook "ct-submit ctlog.api.venafi.com < $(config)/ssl/domain.rsa.pem > $(config)/scts/rsa/venafi.sct \
ct-submit ctlog.wosign.com < $(config)/ssl/domain.rsa.pem > $(config)/scts/rsa/wosign.sct" && ct-submit ctlog.wosign.com < $(config)/ssl/domain.rsa.pem > $(config)/scts/rsa/wosign.sct"
@$(acme.sh) --install-cert -d $(cn) \ @$(acme.sh) --install-cert -d $(cn) \
--key-file $(config)/ssl/domain.rsa.key \ --key-file $(config)/ssl/domain.rsa.key \
--fullchain-file $(config)/ssl/domain.rsa.pem \ --fullchain-file $(config)/ssl/domain.rsa.pem \
--reloadcmd "service nginx force-reload" --reloadcmd "service nginx force-reload"
@echo "generate ecc cert..." @echo "generate ecc cert..."
@$(acme.sh) --force --issue --dns dns_ali \ @$(acme.sh) --force --issue --dns dns_ali $(sans) -k ec-256 --log \
$(sans) -k ec-256 --log --renew-hook "ct-submit ctlog.api.venafi.com < $(config)/ssl/domain.ecc.pem > $(config)/scts/ecc/venafi.sct && \ --renew-hook "ct-submit ctlog.api.venafi.com < $(config)/ssl/domain.ecc.pem > $(config)/scts/ecc/venafi.sct \
ct-submit ctlog.wosign.com < $(config)/ssl/domain.ecc.pem > $(config)/scts/ecc/wosign.sct" && ct-submit ctlog.wosign.com < $(config)/ssl/domain.ecc.pem > $(config)/scts/ecc/wosign.sct"
@$(acme.sh) --install-cert -d $(cn) --ecc \ @$(acme.sh) --install-cert -d $(cn) --ecc \
--key-file $(config)/ssl/domain.ecc.key \ --key-file $(config)/ssl/domain.ecc.key \
--fullchain-file $(config)/ssl/domain.ecc.pem \ --fullchain-file $(config)/ssl/domain.ecc.pem \
--reloadcmd "service nginx force-reload" --reloadcmd "service nginx force-reload"
# fullchained:
# @if [ ! -n "$(cn)" ]; then \
# printf "Use acme.sh generated certs, Need one argument [cn=params]\n"; \
# printf "example: cn=domain\n"; \
# exit 1; \
# fi
# @cp $(acme)/$(cn)/ca.cer $(config)/ssl/full_chained.pem && \
# echo $(X3) >> $(config)/ssl/full_chained.pem
dhparams: dhparams:
@openssl dhparam -out $(config)/ssl/dhparams.pem 2048 @openssl dhparam -out $(config)/ssl/dhparams.pem 2048

3
README.md
View File

@@ -84,6 +84,7 @@
### 成功搭建者博客 ### 成功搭建者博客
* [https://razeencheng.com/](https://razeencheng.com/) - Razeen's Blog * [https://razeen.me](https://razeen.me) - Razeen's Blog
* [https://mxthd.me](https://mxthd.me) - 梦醒逃荒岛
如果你的博客使用`Eiblog`搭建，你可以在 [这里](https://github.com/eiblog/eiblog/issues/1) 提交网址。 如果你的博客使用`Eiblog`搭建，你可以在 [这里](https://github.com/eiblog/eiblog/issues/1) 提交网址。

4
conf/nginx/domain/eiblog.conf
View File

@@ -94,7 +94,7 @@ server {
add_header Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: https:; img-src data: https: https://st.deepzz.com; media-src https://st.deepzz.com; style-src 'unsafe-inline' https:; child-src https:; connect-src 'self' https://translate.googleapis.com; frame-src https://disqus.com https://www.slideshare.net"; add_header Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: https:; img-src data: https: https://st.deepzz.com; media-src https://st.deepzz.com; style-src 'unsafe-inline' https:; child-src https:; connect-src 'self' https://translate.googleapis.com; frame-src https://disqus.com https://www.slideshare.net";
# 中间证书证书指纹 # 中间证书证书指纹
# https://imququ.com/post/http-public-key-pinning.html # https://imququ.com/post/http-public-key-pinning.html
add_header Public-Key-Pins 'pin-sha256="IiSbZ4pMDEyXvtl7Lg8K3FNmJcTAhKUTrB2FQOaAO/s="; pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; max-age=2592000; includeSubDomains'; add_header Public-Key-Pins 'pin-sha256="IiSbZ4pMDEyXvtl7Lg8K3FNmJcTAhKUTrB2FQOaAO/s="; pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; max-age=2592000;';
add_header Cache-Control no-cache; add_header Cache-Control no-cache;
add_header X-Via Aliyun.QingDao; add_header X-Via Aliyun.QingDao;
add_header X-XSS-Protection "1; mode=block"; add_header X-XSS-Protection "1; mode=block";
@@ -124,7 +124,7 @@ server {
# letsencrypt file verify # letsencrypt file verify
location ^~ /.well-known/acme-challenge/ { location ^~ /.well-known/acme-challenge/ {
alias /data/letsencrypt/challenges/; alias /data/eiblog/challenges/;
try_files $uri =404; try_files $uri =404;
} }