kocherman

Нужен общий SSL-сертификат.

Почему нужен один сертификат на все сайты?

Потому что, защищенное соединение достигается программой OpenSSL и когда происходит "рукопожатие" клиентской машины и сервера, ему по барабану на какой домен пришел посетитель.

А вот заголовки запроса получит Nginx уже по защищенному соединению, поменять сертификат будет поздно. Но Nginx таки получит нужный домен в заголовках.

Конфиг рабочий

# Sets worker processes across CPUs (4 processors each w/ 4 cores totaling 16 cores)
# Usually 2 processes per core will suffice, as most operating systems at this time only utilize 2 cores per processor.
worker_processes  8;

pid /usr/local/nginx/logs/nginxlocal.pid;

# events module is used to define network-related directives, many of which are for performance
events {
    # number of connections per worker process. 1024 represents 1 core. 4096
    # would take advantage of up to 4 cores. The simultaneous connections to be
    # served could be as high as 16,384.

    worker_connections  4096;

    #scales the server to reduce spawning threads while synchronizing requests across limited available threads.
    use epoll;
}

#http block. Only one block allowed per conf. file
http {

#Uses the IP-to-location database downloaded from Maxmind
#This module is configured to only allow traffic from the US
    geoip_country /usr/share/GeoIP/GeoIP.dat;
    map $geoip_country_code $allowed_country {
        default no;
        US yes;

    }

   #global to all server blocks
   #==========================================================================

           # Set log paths
           #^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
            error_log  /usr/local/nginx/logs/accesslocal.log;
            access_log  /usr/local/nginx/logs/errorlocal.log;

           # Set data/file types
           #^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
            include       mime.types;
            default_type  application/octet-stream;
            sendfile        on;
            keepalive_timeout  65;

           # Set proxy specifics and set variables (i.e., remote IP address)
           #^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
            proxy_redirect     off;

            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
            proxy_max_temp_file_size 0;

            client_max_body_size       10m;
            client_body_buffer_size    128k;

            proxy_connect_timeout      90;
            proxy_send_timeout         90;
            proxy_read_timeout         90;

            proxy_buffer_size          4k;
            proxy_buffers              4 32k;
            proxy_busy_buffers_size    64k;
            proxy_temp_file_write_size 64k;

           # Set SSL specifics
           #^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
            ssl_session_timeout  5m;

            ssl_protocols  TLSv1; #required by SNI
            ssl_ciphers  HIGH:!aNULL:!MD5;
            ssl_prefer_server_ciphers   on;

            ssl                  on;


    # HTTPS server www.yourfirstdomain.com port 8080
    #------------------------------------------------------------------------
    server {

        listen       10.1.10.136:443 ssl;
        server_name  test.example.com;

    #Set up your cert paths
        ssl_certificate_key  /etc/httpd/ssl/apache/star_example_com.key;
        ssl_certificate   /etc/httpd/ssl/apache/star_example_com.crt;

    #Prevent any access other than to the path specified below
       location / {
             deny all;
        }

        location /testing {

        if ($allowed_country = yes) {
                      proxy_pass   https://127.0.0.1:8080;
        }
        }

    }


    # HTTPS server test2.example.com port 8447
    #------------------------------------------------------------------------
    server {
        listen       10.1.10.136:443 ssl;
        server_name  test2.example.com;

        ssl_certificate      /etc/httpd/ssl/apache/star_example_com.crt;
        ssl_certificate_key  /etc/httpd/ssl/apache/star_example_com.key;

       location / {
             deny all;
        }

        location /testing {


            if ($allowed_country = yes) {
                   proxy_pass         https://127.0.0.1:8447;
             }

        }

    }

}

Можно

server {
      access_log  logs/access.log;
      error_log   logs/error.log;
      index       index.html;
      listen      202.54.1.5:80 default;
      root        /usr/local/nginx/html;
      server_name example.com www.example.com 0.example.com;
 
 
     ## PROXY - Web
      location / {
        proxy_pass  http://myproxybackend;
        if ($http_user_agent ~ MSIE ) {
              proxy_pass  http://msiebackend;
        }
        if ($http_user_agent ~ Mozilla ) {
              proxy_pass  http://mozillabackend;
        }
 
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
 
        ...
         ..
}

Какой nginx? Зачем nginx? Твой выбор: Cloudflare / recaptcha!

Самое быстрое из того что я трогал (в порядке убывания):
lwan
rocket
caddyserver
tornado