hitrust · May 18, 2022 07:40 · Sep 1, 2020 · Sep 1, 2020 · Aug 25, 2020 · Aug 25, 2020
diff --git a/trojan.conf b/trojan.conf
@@ -6,7 +6,7 @@
 
 server {
     listen 127.0.0.1:80;
-    server_name ;
+    server_name trojan.example.com;
 
     root /var/www/html;
     index index.php index.html index.htm;

diff --git a/web.conf b/web.conf
@@ -1,4 +1,4 @@
-# 其他網站全部監聽 127.0.0.1:8082, 在這個端口進行 TLS 握手
+# 其他網站全部監聽 127.0.0.1:8443, 在這個端口進行 TLS 握手
 # 將此檔案放到以下三種位置之一
 # 位置1 (推荐): 放到 /etc/nginx/sites-available 下, 建立軟鏈到 /etc/nginx/sites-enabled
 # 位置2: 放到 /etc/nginx/conf.d

diff --git a/nginx.conf b/nginx.conf
@@ -8,15 +8,15 @@ stream {
 	}
 
 	upstream web {
-		server 127.0.0.1:8080;
+		server 127.0.0.1:80;
 	}
 
 	upstream trojan {
-		server 127.0.0.1:8081;
+		server 127.0.0.1:8080;
 	}
 
 	upstream tls_backend {
-		server 127.0.0.1:8082;
+		server 127.0.0.1:8443;
 	}
 
 	server {

diff --git a/trojan-go.conf b/trojan-go.conf
@@ -1,9 +1,9 @@
 {
   "run_type": "server",
   "local_addr": "127.0.0.1",
-  "local_port": 8081,
+  "local_port": 8080,
   "remote_addr": "127.0.0.1",
-  "remote_port": 8080,
+  "remote_port": 80,
   "log_level": 5,
   "password": [
     "your_awesome_password"

diff --git a/trojan.conf b/trojan.conf
@@ -5,7 +5,7 @@
 # 位置3: 放到 /etc/nginx/sites-enabled
 
 server {
-    listen 127.0.0.1:8080;
+    listen 127.0.0.1:80;
     server_name ;
 
     root /var/www/html;

diff --git a/web.conf b/web.conf
@@ -5,7 +5,7 @@
 # 位置3: 放到 /etc/nginx/sites-enabled
 
 server {
-    listen 127.0.0.1:8082 ssl http2;
+    listen 127.0.0.1:8443 ssl http2;
     server_name website1.example.com;
 
     ssl_certificate /path/to/fullchain.crt;
@@ -17,7 +17,7 @@ server {
 }
 
 server {
-    listen 127.0.0.1:8082 ssl http2;
+    listen 127.0.0.1:8443 ssl http2;
     server_name website2.example.com;
 
     ssl_certificate /path/to/fullchain.crt;

diff --git a/nginx.conf b/nginx.conf
@@ -3,7 +3,7 @@ stream {
 	map $ssl_preread_server_name $backend_name {
 		trojan.example.com trojan;
 		website1.example.com tls_backend;
-    website2.example.com tls_backend;
+		website2.example.com tls_backend;
 		default web;
 	}
 

diff --git a/trojan-with-nginx-stream-module.md → a-trojan-with-nginx-stream-module.md b/trojan-with-nginx-stream-module.md → a-trojan-with-nginx-stream-module.md
diff --git a/README.md → trojan-with-nginx-stream-module.md b/README.md → trojan-with-nginx-stream-module.md
diff --git a/README.md b/README.md
@@ -0,0 +1 @@
+利用 NGINX 的 Stream 模塊 sni_preread 功能，可以做到讓 Trojan 和其他網站在同一台機器上共享 443 端口。
diff --git a/default.conf b/default.conf
@@ -0,0 +1,8 @@
+# 將 /etc/nginx/sites-available/default 的內容改成如下，可以實現全局 https 跳轉
+
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
diff --git a/nginx.conf b/nginx.conf
@@ -0,0 +1,28 @@
+# 在 /etc/nginx/nginx.conf 加入這段, 原先的內容不要刪
+stream {
+	map $ssl_preread_server_name $backend_name {
+		trojan.example.com trojan;
+		website1.example.com tls_backend;
+    website2.example.com tls_backend;
+		default web;
+	}
+
+	upstream web {
+		server 127.0.0.1:8080;
+	}
+
+	upstream trojan {
+		server 127.0.0.1:8081;
+	}
+
+	upstream tls_backend {
+		server 127.0.0.1:8082;
+	}
+
+	server {
+		listen 443 reuseport;
+		listen [::]:443 reuseport;
+		proxy_pass  $backend_name;
+		ssl_preread on;
+	}
+}
diff --git a/trojan-go.conf b/trojan-go.conf
@@ -0,0 +1,23 @@
+{
+  "run_type": "server",
+  "local_addr": "127.0.0.1",
+  "local_port": 8081,
+  "remote_addr": "127.0.0.1",
+  "remote_port": 8080,
+  "log_level": 5,
+  "password": [
+    "your_awesome_password"
+  ],
+  "ssl": {
+    "verify_hostname": true,
+    "cert": "/etc/ssl/trojan/fullchain.crt",
+    "key": "/etc/ssl/trojan/key.key",
+    "sni": "trojan.example.com",
+    "alpn": [
+      "http/1.1"
+    ]
+  },
+  "router": {
+    "enabled": false
+  }
+}
diff --git a/trojan.conf b/trojan.conf
@@ -0,0 +1,13 @@
+# trojan 偽裝站設置
+# 將此檔案放到以下三種位置之一
+# 位置1 (推荐): 放到 /etc/nginx/sites-available 下, 建立軟鏈到 /etc/nginx/sites-enabled
+# 位置2: 放到 /etc/nginx/conf.d
+# 位置3: 放到 /etc/nginx/sites-enabled
+
+server {
+    listen 127.0.0.1:8080;
+    server_name ;
+
+    root /var/www/html;
+    index index.php index.html index.htm;
+}
diff --git a/web.conf b/web.conf
@@ -0,0 +1,29 @@
+# 其他網站全部監聽 127.0.0.1:8082, 在這個端口進行 TLS 握手
+# 將此檔案放到以下三種位置之一
+# 位置1 (推荐): 放到 /etc/nginx/sites-available 下, 建立軟鏈到 /etc/nginx/sites-enabled
+# 位置2: 放到 /etc/nginx/conf.d
+# 位置3: 放到 /etc/nginx/sites-enabled
+
+server {
+    listen 127.0.0.1:8082 ssl http2;
+    server_name website1.example.com;
+
+    ssl_certificate /path/to/fullchain.crt;
+    ssl_certificate_key /path/to/key.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    location / {
+    }
+}
+
+server {
+    listen 127.0.0.1:8082 ssl http2;
+    server_name website2.example.com;
+
+    ssl_certificate /path/to/fullchain.crt;
+    ssl_certificate_key /path/to/key.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    location / {
+    }
+}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		利用 NGINX 的 Stream 模塊 sni_preread 功能，可以做到讓 Trojan 和其他網站在同一台機器上共享 443 端口。