centos8构建nginx1.27.1+BoringSSL+http3+lua+openresty

需要接入http3，索性最新的nginx在构建一波，趟一遍坑

准备工作

1.环境命令安装

yum install GeoIP -y
yum install GeoIP-devel -y
yum install libmaxminddb-devel -y
yum install -y patch wget zlib zlib-devel lftp gcc gcc-c++ make openssl-devel pcre-devel pcre net-tools yum-utils && yum clean all

2.最新nginx包下载
官方下载

3.准备boringssl
官网

# 下载使用git
git clone https://boringssl.googlesource.com/boringssl

4.准备ninja 用于构建boringssl
ninja-github-releases

unzip xx.zip
cp ./ninja /usr/bin

5.lua环境构建(可选)
需要以下这些包-可以在github下载相应的包
luajit2
lua-resty-core
lua-resty-lrucache

cd /opt/luajit2-2.1-20240815
make PREFIX=/usr/local/ && make install PREFIX=/usr/local/

cd /opt/lua-resty-core-0.1.29
make install LUA_LIB_DIR=/usr/local/share/lua/5.1

cd /opt/lua-resty-lrucache-0.14
make install LUA_LIB_DIR=/usr/local/share/lua/5.1

#设置环境变量
LUAJIT_INC=/usr/local/include/luajit-2.1
LUAJIT_LIB=/usr/local/lib

#构建映射
ln -s /usr/local/lib/libluajit-5.1.so.2 /lib64/
ln -s /usr/local/openresty/lualib /usr/local/lib/lua
ln -s /usr/local/openresty/lualib/resty /usr/local/lib

6.正向代理（可选）
使用ngx_http_proxy_connect_module 需要先安装补丁

patch -p1 </opt/ngx_http_proxy_connect_module-0.0.7/patch/proxy_connect_rewrite_102101.patch

编译nginx

cd /opt/nginx-1.27.1
./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_v3_module --with-cc=c++ --with-cc-opt="-I/opt/boringssl/include -x c"  --with-ld-opt="-L/opt/boringssl/build/ssl -L/opt/boringssl/build/crypto" --with-http_ssl_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module  --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --add-module=/opt/lua-nginx-module-0.10.27 --add-module=/opt/ngx-fancyindex-0.5.2 --add-module=/opt/ngx_devel_kit-0.3.1 --with-http_geoip_module --with-stream_ssl_module --with-stream_ssl_preread_module --add-module=/opt/ngx_http_geoip2_module-3.4 --add-module=/opt/ngx_http_proxy_connect_module-0.0.7 && make && make install

参数说明：

nginx中的ssl配置增加 quic关键字

server {
    listen 80;
    listen 443 ssl;
    listen 443 quic;
    http2 on;
    http3 on;
    http3_hq on;
    quic_retry on;
	ssl_early_data on;
    quic_gso on;
    add_header Alt-Svc 'quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443"; h3-25=":443"; h3-23=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"';
    }

可以使用https://www.http3check.net 检查网站是否启用http3

问题

1.未找到ssl library

checking for getaddrinfo() ... found
checking for PCRE2 library ... not found
checking for PCRE library ... found
checking for PCRE JIT support ... found
checking for OpenSSL library ... not found
checking for OpenSSL library in /usr/local/ ... not found
checking for OpenSSL library in /usr/pkg/ ... not found
checking for OpenSSL library in /opt/local/ ... not found
auto/configure: error: SSL modules require the OpenSSL library.
You can either do not enable the modules, or install the OpenSSL library
into the system, or build the OpenSSL library statically from the source
with nginx by using --with-openssl=<path> option.

解决办法：
需要注意引入动态库时,需要通过增加–with-cc=c++ 且同时在cc-opt 中需要通过-x c 指定为C语言

--with-cc=c++ -with-cc-opt="-I/opt/boringssl/include -x c"  --with-ld-opt="-L/opt/boringssl/build/ssl -L/opt/boringssl/build/crypto"

NGINX + BoringSSL build error (NGINX 1.25.4 required Openssl)
也给出了不同系统解决的办法

如果docker中使用nginx 需要注意映射端口放行tcp

附件

涉及到的部分附件 有需要的可以csdn下载

参考文档

nginx官方quic说明