[Nginx] Nginx 配置反向代理使用 Google fonts 字体并开启 HTTP2/SSL 支持

./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-openssl=/usr/local/ssl --with-http_v2_module --with-http_sub_module

upstream google {
  server fonts.googleapis.com:80;
}
 
upstream gstatic {
  server fonts.gstatic.com:80;
}
proxy_temp_path  /your/path/tmp 1 2;
proxy_cache_path /your/path/cache levels=1:2 keys_zone=cache1:100m inactive=30d max_size=1g;

server {
  listen 80;
  server_name your.proxy.domain;
  root /your/path/;
  location /css {
  sub_filter 'fonts.gstatic.com' 'your.proxy.domain';
  sub_filter_once off;
  sub_filter_types text/css;
  proxy_pass_header Server;
  proxy_set_header Host fonts.googleapis.com;
  proxy_set_header Accept-Encoding '';
  proxy_redirect off;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Scheme $scheme;
  proxy_pass http://google;
  proxy_cache cache1;
  proxy_cache_key $host$uri$is_args$args;
  proxy_cache_valid 200 304 10m;
  expires 365d;
  }
  location / {
  proxy_pass_header Server;
  proxy_set_header Host fonts.gstatic.com;
  proxy_redirect off;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Scheme $scheme;
  proxy_pass http://gstatic;
  proxy_cache cache1;
  proxy_cache_key $host$uri$is_args$args;
  proxy_cache_valid 200 304 10m;
  expires 365d;
  }
}

server {
  listen 443 ssl http2;
 
  ssl on;
  ssl_certificate /etc/letsencrypt/live/your.proxy.domain/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/your.proxy.domain/privkey.pem;
  ssl_dhparam /etc/ssl/certs/dhparams.pem;
  ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers HIGH:!aNULL:!MD5;
 
  server_name your.proxy.domain;
  root /var/sites/fonts/;
 
  location /css {
  sub_filter 'http://fonts.gstatic.com' 'https://your.proxy.domain';
  sub_filter_once off;
  sub_filter_types text/css;
  proxy_pass_header Server;
  proxy_set_header Host fonts.googleapis.com;
  proxy_set_header Accept-Encoding '';
  proxy_redirect off;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Scheme $scheme;
  proxy_pass http://google;
  proxy_cache cache1;
  proxy_cache_key $host$uri$is_args$args;
  proxy_cache_valid 200 304 10m;
  expires 365d;
  }
 
  location / {
  proxy_pass_header Server;
  proxy_set_header Host fonts.gstatic.com;
  proxy_redirect off;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Scheme $scheme;
  proxy_pass http://gstatic;
  proxy_cache cache1;
  proxy_cache_key $host$uri$is_args$args;
  proxy_cache_valid 200 304 10m;
  expires 365d;
  }
}

valid_referers server_name *.your.domain.com *.other.domain.com;
if ($invalid_referer) {
  return 403;
}