同一个服务器上用Nginx同时支持Caddy和WordPress

假定Caddy用了4443端口和880端口，在它前端用nginx作为反向代理，同时nginx作为wordpress的web服务器。

Caddy安装和wordpress安装略。

nginx配置

# vi /etc/nginx/nginx.conf

user nginx;

worker_processes auto;

error_log /var/log/nginx/error.log;

pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.

include /usr/share/nginx/modules/*.conf;

events {

    worker_connections 1024;

}

http {

    log_format  main  ‘$remote_addr – $remote_user [$time_local] “$request” ‘

                      ‘$status $body_bytes_sent “$http_referer” ‘

                      ‘”$http_user_agent” “$http_x_forwarded_for”‘;

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;

    tcp_nopush          on;

    tcp_nodelay         on;

    keepalive_timeout   65;

    types_hash_max_size 4096;

    include             /etc/nginx/mime.types;

    # Load modular configuration files from the /etc/nginx/conf.d directory.

    # See http://nginx.org/en/docs/ngx_core_module.html#include

    # for more information.

    include /etc/nginx/conf.d/*.conf;

    gzip on;

    gzip_static on;

    gzip_min_length 1k;

    gzip_buffers 4 8k;

    gzip_http_version 1.1;

    gzip_comp_level 2;

    gzip_types application/atom+xml application/javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component;

    gzip_vary on;

    server {

    # 本人的博客

        listen       80;

        listen       [::]:80;

        server_name  www.max-shu.com;

        # 强制跳转到 HTTPS，保留原始请求 URI 和参数

        return 301 https://$host$request_uri;

    }

    # Settings for a TLS enabled server.

    server {

    # 本人的博客

        listen       443 ssl http2;

        listen       [::]:443 ssl http2;

        server_name  www.max-shu.com;

        root         /var/www/html;

        index        index.php index.html index.htm;

        ssl_certificate “/root/.acme.sh/nginx/ssl/max-shu.com/fullchain.cer”;

        ssl_certificate_key “/root/.acme.sh/nginx/ssl/max-shu.com/max-shu.com.key”;

        ssl_session_cache shared:SSL:1m;

        ssl_session_timeout  10m;

        ssl_ciphers HIGH:!aNULL:!MD5;

        ssl_prefer_server_ciphers on;

    # 根目录主站点（/var/www/html 下的普通 HTML / 静态文件）

    location / {

        try_files $uri $uri/ =404;

    }

    # 替代 .htaccess 伪静态关键规则,子目录 WordPress在blog目录

    location /blog/ {

        index index.php index.html;

        try_files $uri $uri/ /blog/index.php?$args;

    }

    # PHP 请求转发至 PHP-FPM Socket

    location ~ \.php$ {

        try_files $uri =404;

        fastcgi_pass   unix:/var/run/php-fpm/php-fpm.sock;

        fastcgi_index  index.php;

        fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;

        include        fastcgi_params;

    }

    # 禁止直接访问隐藏文件（如 .htaccess、.git）

    location ~ /\.ht {

        deny  all;

    }

    # 静态资源长期缓存

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {

        expires max;

        log_not_found off;

    }

    # 隐藏版本号

        server_tokens off;

        # 定义错误码对应的处理路径

        error_page 404 /404.html;

        error_page 500 502 503 504 /5xx.html;

        # 指定静态错误页面的存放位置

        location = /404.html {

            root /usr/share/nginx/html; # 你的 404.html 文件所在目录

            internal;                   # 仅允许内部跳转，不允许外部直接访问 /404.html

        }

        location = /5xx.html {

            root /usr/share/nginx/html;

            internal;

        }

    }

    ## 支持后端的 caddy ##

    # 定义 Caddy 的 upstream 后端

    upstream caddy_backend {

        server 127.0.0.1:880;

        keepalive 32; # 开启长连接提高性能

    }

    server {

        listen 80;

        server_name me3.max-shu.com;

        # 放行 acme.sh 验证文件的回调路径

        location / {

            proxy_pass http://caddy_backend;

            # 传递标准 HTTP 请求头，确保 Caddy 能拿到客户端真实 IP 和 Host

            proxy_http_version 1.1;

            proxy_set_header Connection “”; # 搭配 keepalive

            proxy_set_header Host $host;

            proxy_set_header X-Real-IP $remote_addr;

            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            proxy_set_header X-Forwarded-Proto $scheme;

        }

    }

    server {

        listen       443 ssl http2;

        server_name  me3.max-shu.com;

        ssl_certificate “/root/.acme.sh/nginx/ssl/max-shu.com/fullchain.cer”;

        ssl_certificate_key “/root/.acme.sh/nginx/ssl/max-shu.com/max-shu.com.key”;

        ssl_session_cache shared:SSL:1m;

        ssl_session_timeout  10m;

        ssl_ciphers HIGH:!aNULL:!MD5;

        ssl_prefer_server_ciphers on;

        location / {

            # 代理到原先 stream 指向的后端 443/其他端口

            proxy_pass https://127.0.0.1:4443;

            # 关键配置：让 Nginx 向后端发起 TLS 握手时带上 SNI 域名

            proxy_ssl_server_name on;

            proxy_ssl_name $host;  # 或者直接填 me3.max-shu.com

            # 如果后端 4443 使用的是自签名证书或临时证书，跳过证书校验

            proxy_ssl_verify off;

            # 支持 WS 协议

            proxy_http_version 1.1;

            proxy_set_header Upgrade $http_upgrade;

            proxy_set_header Connection “upgrade”;

            proxy_set_header Host $host;

            proxy_set_header X-Real-IP $remote_addr;

            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            proxy_set_header X-Forwarded-Proto $scheme;

        }

    }

}