搭建 Imgproxy 图片代理：URL 动态裁剪压缩与 WebP 转换

# ================= 全局参数定义 =================
DOMAIN="imgproxy.0000996.xyz"       # Imgproxy 对外访问域名 (已解析至本服务器)
ALLOWED_SOURCE="https://img.0000996.xyz/" # 允许拉取原图的图床或存储桶前缀
DATA_DIR="/opt/imgproxy"            # 配置文件与 Nginx 缓存存放根目录
PORT="8080"                         # 容器内部监听端口 (本地回环暴露)
# ================================================

# 1. 创建规范持久化目录
sudo mkdir -p /opt/imgproxy/cache
cd /opt/imgproxy

# 2. 生成 64 位 HEX Key 与 Salt 并妥善记录
HEX_KEY=$(openssl rand -hex 32)
HEX_SALT=$(openssl rand -hex 32)

echo "KEY : $HEX_KEY"
echo "SALT: $HEX_SALT"

sudo tee /opt/imgproxy/docker-compose.yml << EOF
version: '3.8'

services:
  imgproxy:
    image: darthsim/imgproxy:latest
    container_name: imgproxy
    restart: always
    ports:
      - "127.0.0.1:8080:8080"  # 仅绑定本地回环，交由 Nginx 缓存层代理
    environment:
      # --- 安全签名防护 (填入刚才生成的 Key 与 Salt) ---
      - IMGPROXY_KEY=${HEX_KEY}
      - IMGPROXY_SALT=${HEX_SALT}

      # --- 上游源站域名白名单 (防止被当作全网公共代理) ---
      - IMGPROXY_ALLOWED_SOURCES=https://img.0000996.xyz/,https://blog.0000996.xyz/

      # --- 格式与画质智能协商 ---
      - IMGPROXY_QUALITY=85              # 视觉无损推荐画质 (75-85 最佳平衡)
      - IMGPROXY_AUTO_WEBP=true          # 客户端支持时自动输出 WebP
      - IMGPROXY_AUTO_AVIF=true          # 客户端支持时自动输出更高压缩比的 AVIF
      - IMGPROXY_ENFORCE_WEBP=false

      # --- 算力与内存保护基线 ---
      - IMGPROXY_CONCURRENCY=4           # 最大并发处理线程
      - IMGPROXY_MAX_SRC_RESOLUTION=30   # 最大支持 3000 万像素源图，防御超大图攻击
      - IMGPROXY_DOWNLOAD_TIMEOUT=10     # 下载原图超时 10 秒
      - IMGPROXY_TTL=2592000             # 客户端缓存 30 天 (Cache-Control)
    resources:
      limits:
        memory: 1024M                    # 限制单容器内存不超过 1GB
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "3"
EOF

sudo docker compose up -d
sudo docker compose logs -n 10 imgproxy

# 1. 声明 1GB 的图片静态缓存池 (30 天不访问自动清理)
proxy_cache_path /opt/imgproxy/cache levels=1:2 keys_zone=IMG_CACHE:50m max_size=5g inactive=30d use_temp_path=off;

server {
    listen 80;
    server_name imgproxy.0000996.xyz;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name imgproxy.0000996.xyz;

    # SSL 证书配置
    ssl_certificate     /etc/nginx/ssl/imgproxy.0000996.xyz.crt;
    ssl_certificate_key /etc/nginx/ssl/imgproxy.0000996.xyz.key;
    ssl_protocols       TLSv1.2 TLSv1.3;

    # 客户端上传与接收大图缓冲配置
    client_max_body_size 20m;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 核心：开启 Nginx 磁盘级长效缓存
        proxy_cache IMG_CACHE;
        # 必须带上 Accept 标头参与缓存哈希，确保 WebP 与原图客户端各自命中正确版本
        proxy_cache_key "$scheme$request_method$host$request_uri$http_accept";
        proxy_cache_valid 200 302 30d;
        proxy_cache_valid 404 1m;

        # 在响应头中回显缓存命中状态 (HIT / MISS / EXPIRED)
        add_header X-Cache-Status $upstream_cache_status;
        add_header Cache-Control "public, max-age=2592000, immutable";
    }
}

sudo nginx -t && sudo systemctl reload nginx

https://<你的域名>/<signature>/<processing_options>/<source_url>

sudo tee /usr/local/bin/gen-imgproxy-url << 'EOF'
#!/usr/bin/env python3
import hmac
import hashlib
import base64
import sys

# 填入第一步生成的配置
KEY = "REPLACE_WITH_YOUR_KEY"
SALT = "REPLACE_WITH_YOUR_SALT"
DOMAIN = "https://imgproxy.0000996.xyz"

def sign_url(image_url, options="rs:fill:1200:0:0/q:82"):
    key_bytes = bytes.fromhex(KEY)
    salt_bytes = bytes.fromhex(SALT)

    # 1. 对目标图片 URL 进行 urlsafe base64 编码
    encoded_url = base64.urlsafe_b64encode(image_url.encode()).decode().rstrip("=")

    # 2. 组装待签名路径
    path = f"/{options}/{encoded_url}".encode()

    # 3. 计算 HMAC-SHA256 签名
    h = hmac.new(key_bytes, salt_bytes + path, hashlib.sha256)
    signature = base64.urlsafe_b64encode(h.digest()).decode().rstrip("=")

    return f"{DOMAIN}/{signature}{path.decode()}"

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("用法: gen-imgproxy-url <原图公网URL> [处理参数, 默认: rs:fill:1200:0:0/q:82]")
        sys.exit(1)
    url = sys.argv[1]
    opts = sys.argv[2] if len(sys.argv) > 2 else "rs:fill:1200:0:0/q:82"
    print(sign_url(url, opts))
EOF

sudo chmod +x /usr/local/bin/gen-imgproxy-url

# 1. 原始图片大小探测 (假设是一张 3.5MB 的高清风景原图)
curl -sI "https://img.0000996.xyz/2026/08/fj/01.jpg" | grep -i "content-length"

# 2. 经过 Imgproxy 限宽 1200px、质量 82 处理的链接
curl -sI -H "Accept: image/webp" "<生成的签名URL>"

HTTP/2 200
content-type: image/webp
content-length: 142850     <--- 仅约 140KB，相比原图骤降 95%！
x-cache-status: MISS       <--- 首次请求 MISS

curl -sI -H "Accept: image/webp" "<生成的签名URL>" | grep -i "x-cache-status"

X-Cache-Status: HIT