如何配置nginx以预防扫描IP暴露相关的域名

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    ssl_certificate /etc/cert/server.crt;
    ssl_certificate_key /etc/cert/server.key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
    ssl_session_tickets off;
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;
    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;
    server_name testdomain.com;
    location / {
        try_files $uri $uri/ =404;
    }
}

user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
}

http {
    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;
    access_log /var/log/nginx/access.log;
    gzip on;
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
}

http {
    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;
    access_log /var/log/nginx/access.log;
    gzip on;

    # 添加此处两行以向后端传递客户端的来源IP地址
    proxy_set_header X-Real-IP $proxy_protocol_addr;
    proxy_set_header X-Forwarded-For $proxy_protocol_addr;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

# 添加以下整个stream块，用于从4层处理连接
stream {
    map $ssl_preread_server_name $name {
        # 这里填写你绑定的域名和其别名，一对一行，空格分隔，分号结尾
        testdomain.com        web;
        default               block;    # 该行用于不能匹配到绑定域名的情况
    }
    # 对应地添加upstream块，upstream后面接对应的别名
    upstream web {
        server unix:/var/run/web.sock;  # 此处用Unix Socket，也可以用监听本地端口
    }
    server {
        listen            443 reuseport;
        listen            [::]:443 reuseport;
        proxy_pass        $name;     # 指示根据条件选择不同的上游server
        ssl_preread       on;        # SSL预读，允许提前处理
        proxy_protocol    on;
    }
}

# 在原server块前添加以下server块，用于接收Host字段不匹配的连接
server {
    listen 80 default_server;          # 设置为默认server块，下同
    listen [::]:80 default_server;
    server_name  _;                    # 不绑定主机名
    return 444;                        # 444响应码是nginx提供的特殊响应码，返回该响应码指示nginx断开该连接
}
# 原server块
server {
    # 以下两行去掉
    #listen 443 ssl http2;
    #listen [::]:443 ssl http2;
    
    # 添加以下行
    listen unix:/var/run/web.sock ssl proxy_protocol;    # 此处用Unix Socket，也可以用监听本地端口
    set_real_ip_from        127.0.0.1;
    set_real_ip_from        unix:;
    real_ip_header          proxy_protocol;
    
    # SSL配置不变
    ssl_certificate /etc/cert/server.crt;
    ssl_certificate_key /etc/cert/server.key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
    ssl_session_tickets off;
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;
    
    # 以下配置不变
    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;
    server_name testdomain.com;
    location / {
        try_files $uri $uri/ =404;
    }
}