如何配置Nginx让子域名api.dostoevsky.rest返回指定接口的JSON响应

当前配置存在3个核心问题：

• 子域名api.dostoevsky.rest对应的server块未配置listen端口规则，Nginx无法匹配对应端口上的子域名请求
• proxy_pass转发目标为公网IP的80端口，主域名80端口配置了强制HTTPS跳转，会打断代理逻辑，同时服务器安全组/防火墙未放行公网IP回环访问时，会直接触发超时错误
• 未配置子域名的SSL证书与HTTPS监听规则，HTTPS访问子域名会直接报错

步骤1：申请子域名SSL证书 #

执行certbot命令申请对应域名的免费SSL证书：

certbot certonly --webroot -w /var/www/html -d api.dostoevsky.rest -d www.api.dostoevsky.rest

步骤2：替换子域名Nginx配置 #

删除原有api.dostoevsky.rest对应的server块，替换为以下配置：

# 子域名80端口配置，用于证书验证和HTTPS跳转
server {
    listen 80;
    listen [::]:80;
    server_name api.dostoevsky.rest www.api.dostoevsky.rest;

    location ~ /.well-known/acme-challenge {
        allow all;
        root /var/www/html;
    }

    location / {
        rewrite ^ https://$host$request_uri? permanent;
    }
}

# 子域名443端口配置，处理实际业务请求
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name api.dostoevsky.rest www.api.dostoevsky.rest;

    # SSL配置和主域名保持一致
    ssl_certificate /etc/letsencrypt/live/api.dostoevsky.rest/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.dostoevsky.rest/privkey.pem;
    ssl_buffer_size 8k;
    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;

    location / {
        default_type application/json;
        # 直接内部转发到Docker内的Node.js服务，无需绕公网
        proxy_pass http://nodejs:8080/api/rand;
        # 补充代理请求头，避免上游服务识别异常
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

步骤3：生效配置 #

执行以下命令验证配置语法正确性，重载Nginx生效：

nginx -t
systemctl reload nginx

配置生效后访问https://api.dostoevsky.rest即可直接返回https://dostoevsky.rest/api/rand的响应内容。

内容的提问来源于stack exchange，提问作者Rahul