在NGINX上安装GHOST后损坏SSL配置导致服务无法重启求助

问题根因 #

nginx启动报错的核心原因是/etc/nginx/sites-enabled/creationist.codes-ssl.conf文件中，主域名SSL server块的闭合括号}之后，直接放置了websocket相关的proxy配置，proxy_pass指令仅允许在location块、location内的if块、limit_except块中使用，出现在server块之外属于非法配置，直接导致配置校验失败。

方案1：无需保留websocket配置，快速恢复服务 #

1. 打开配置文件：
   nano /etc/nginx/sites-enabled/creationist.codes-ssl.conf
2. 找到文件末尾、主SSL server块结束之后的9行websocket配置，全部删除：

proxy_pass http://websocket;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header HOST $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_pass_request_headers on;

3. 保存退出后校验配置合法性：
   nginx -t
4. 校验提示成功后重启nginx即可：
   systemctl restart nginx

方案2：需要保留websocket配置的正确写法 #

websocket相关配置必须包裹在对应域名的location块内，比如要给主域名的/ws路径配置websocket代理，修改后的配置如下：

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name creationist.codes;
    root /var/www/creationist/system/nginx-root;

    ssl_certificate /etc/letsencrypt/creationist.codes/fullchain.cer;
    ssl_certificate_key /etc/letsencrypt/creationist.codes/creationist.codes.key;
    include /etc/nginx/snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;
        proxy_pass http://127.0.0.1:2369;
        
    }

    # websocket配置放在独立location块中
    location /ws {
        proxy_pass http://websocket;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header HOST $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass_request_headers on;
    }

    location ~ /.well-known {
        allow all;
    }

    client_max_body_size 50m;
}

如果需要给something.creationist.codes子域名配置websocket，只需将上述location块放到子域名对应的server块内即可。

你提供的something.creationist.codes80端口配置本身没有语法错误，不会影响nginx启动，如需配置HTTPS可单独申请对应域名的SSL证书补充443端口配置即可。

内容的提问来源于stack exchange，提问作者Pranjal Pratap Singh