申请 SSL 证书

进入控制台申请证书

Nginx 配置

1. 安装 Nginx 及相关操作

   # 安装 Nginx
   sudo apt install ngix
   # 查看 Nginx 版本
   nginx -v
   # 查看 Nginx 安装目录
   which nginx
   # 查看 Nginx 配置文件的路径
   sudo nginx -t
   # 更详细安装信息
   systemctl status nginx
   # 启动 Nginx
   sudo systemctl  start nginx
   # 停止 Nginx 服务
   sudo systemctl stop nginx
   # 重启服务
   sudo systemctl reload nginx

2. 下载证书&安装
   nginx 端口转发（反向代理）配置参考：Run grafana behind a proxy

   sudo vim /etc/nginx/sites-available/default

    # This is required to proxy Grafana Live WebSocket connections.
    map $http_upgrade $connection_upgrade {
       default upgrade;
       '' close;
    }
   
     upstream grafana {
        server localhost:3000;
     }
   
    server {
         # SSL 默认访问端口号为 443
         listen 443 ssl;
         # 请填写绑定证书的域名
         server_name example.com;
         # 请填写证书文件的相对路径或绝对路径
         ssl_certificate /path/to/your_certificate.crt;
         # 请填写私钥文件的相对路径或绝对路径
         ssl_certificate_key /path/to/your_certificate_key.key;
         #ssl_session_timeout 5m;
         # 请按照以下协议配置
         ssl_protocols TLSv1.2 TLSv1.3;
         # 请按照以下套件配置，配置加密套件，写法遵循 openssl 标准。
         ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
         ssl_prefer_server_ciphers on;
   
        # Grafana 反向代理
         location / {
               proxy_set_header Host $host;
               proxy_pass http://grafana;
               rewrite  ^/grafana/(.*)  /$1 break;
         }
   
         location /grafana/ {
               proxy_set_header Host $host;
               proxy_pass http://grafana;
               rewrite  ^/grafana/(.*)  /$1 break;
         }
   
         # Proxy Grafana Live WebSocket connections.
         location /grafana/api/live/ {
               proxy_http_version 1.1;
               proxy_set_header Upgrade $http_upgrade;
               proxy_set_header Connection $connection_upgrade;
               proxy_set_header Host $host;
               proxy_pass http://grafana;
       }
   }
   

配置防火墙

腾讯云后台只放行 443 端口，其他端口不对外访问：

防火墙配置后台添加端口放行规则

https://docs.github.com/en/actions/hosting-your-own-runners