安装使用 lua-resty-waf

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;
    #tcp_nodelay    on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    # Avoid Attack
    server_tokens off;

      # WAF
    init_by_lua_block {
        -- use resty.core for performance improvement, see the status note above
        require "resty.core"

        -- require the base module
        local lua_resty_waf = require "resty.waf"

        -- perform some preloading and optimization
        lua_resty_waf.init()
    }

    gzip on;

    include allHTTPS.conf;
    # WAF
    include xampp.conf;
    include www.conf;

    server {
        listen       80 default_server;
        server_name  _;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        rewrite      ^(.*) https://freewisdom.cn;

        location / {
            #root   html;
            #index  index.html index.htm;
        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
}

    server {
        listen       443;
        server_name  freewisdom.cn;
        root         /var/web/public;
        index        index.html index.htm;
        #error_log logs/www.error.log;

        location / {
            #expires 7d;
            access_by_lua_block {
                local lua_resty_waf = require "resty.waf"

                local waf = lua_resty_waf:new()

                -- define options that will be inherited across all scopes
                waf:set_option("debug", true)
                waf:set_option("mode", "ACTIVE")

                waf:set_option("event_log_target", "file")
                waf:set_option("event_log_target_path", "/tmp/event.log")

                waf:set_option("debug_log_level", ngx.DEBUG)
                waf:set_option("event_log_altered_only", false)
                waf:set_option("event_log_request_arguments", true)
                waf:set_option("event_log_request_body", true)
                waf:set_option("event_log_verbosity", 4)

                waf:set_option("event_log_periodic_flush", 30)
                waf:set_option("event_log_buffer_size", 128)

                -- this may be desirable for low-traffic or testing sites
                -- by default, event logs are not written until the buffer is full
                -- for testing, flush the log buffer every 5 seconds
                --
                -- this is only necessary when configuring a remote TCP/UDP
                -- socket server for event logs. otherwise, this is ignored
                -- waf:set_option("event_log_periodic_flush", 5)

                -- run the firewall
                waf:exec()
            }

            header_filter_by_lua_block {
                local lua_resty_waf = require "resty.waf"

                -- note that options set in previous handlers (in the same scope)
                -- do not need to be set again
                local waf = lua_resty_waf:new()

                waf:exec()
            }

            body_filter_by_lua_block {
                local lua_resty_waf = require "resty.waf"

                local waf = lua_resty_waf:new()

                waf:exec()
            }

            log_by_lua_block {
                local lua_resty_waf = require "resty.waf"

                local waf = lua_resty_waf:new()

                -- waf:exec()
                waf:write_log_events()
            }
        }

        location ~ .*\.(php?|cgi|pl|py)$ {
            deny all;
        }

        location ~ /\.ht {
            deny all;
        }

        location ~ /.+\.(inc|conf|cnf) {
            deny all;
        }

        #fastcgi_intercept_errors on;

        error_page 404 /404.html;
            location = /404.html {
            root /var/web/public;
        }
    }