curlコマンドの使い方：オプションの読み方とHTTP通信を切り分ける手順

curl --version
curl 8.18.0 (x86_64-pc-linux-gnu) libcurl/8.18.0 OpenSSL/3.5.5 zlib/1.3.1 brotli/1.2.0 zstd/1.5.7 libidn2/2.3.8 libpsl/0.21.2 libssh2/1.11.1 nghttp2/1.68.0 librtmp/2.3 mit-krb5/1.22.1 OpenLDAP/2.6.10
Release-Date: 2026-01-07, security patched: 8.18.0-1ubuntu2.7

curl -sS https://www.example.test/
hello from the old server
curl -sS -i https://www.example.test/
HTTP/1.1 200 OK
Server: nginx/1.28.3 (Ubuntu)
Date: Mon, 05 Oct 2026 05:15:52 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 26
Connection: keep-alive

hello from the old server
curl -sS -o /dev/null -w '%{http_code}\n' https://www.example.test/
200

curl --help all | grep -E '^ -[oOiIsSxXkKfFcCdDlLhHvV],'
 -K, --config <file>               Read config from a file
 -C, --continue-at <offset>        Resumed transfer offset
 -c, --cookie-jar <filename>       Save cookies to <filename> after operation
 -d, --data <data>                 HTTP POST data
 -D, --dump-header <filename>      Write the received headers to <filename>
 -f, --fail                        Fail fast with no output on HTTP errors
 -F, --form <name=content>         Specify multipart MIME data
 -I, --head                        Show document info only
 -H, --header <header/@file>       Pass custom header(s) to server
 -h, --help <subject>              Get help for commands
 -k, --insecure                    Allow insecure server connections
 -l, --list-only                   List only mode
 -L, --location                    Follow redirects
 -o, --output <file>               Write to file instead of stdout
 -x, --proxy <[protocol://]host[:port]>  Use this proxy
 -O, --remote-name                 Write output to file named as remote file
 -X, --request <method>            Specify request method to use
 -S, --show-error                  Show error even when -s is used
 -i, --show-headers                Show response headers in output
 -s, --silent                      Silent mode
 -v, --verbose                     Make the operation more talkative
 -V, --version                     Show version number and quit

curl --help all | wc -l
273
for o in --json --fail-with-body --follow; do printf '%s: ' "$o"; curl --help "$o" | tr -s ' ' | grep -o 'Added in [0-9.]*[0-9]'; done
--json: Added in 7.82.0
--fail-with-body: Added in 7.76.0
--follow: Added in 8.16.0

curl -v https://www.example.test/
* Host www.example.test:443 was resolved.
* IPv6: (none)
* IPv4: 198.51.100.10
*   Trying 198.51.100.10:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
*   CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
…
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
* ALPN: server accepted http/1.1
* Server certificate:
*   subject: CN=www.example.test
*   start date: Oct  5 05:05:14 2026 GMT
*   expire date: Nov  4 05:05:14 2026 GMT
*   issuer: CN=Lab Throwaway CA
*   subjectAltName: "www.example.test" matches cert's "www.example.test"
* SSL certificate verified via OpenSSL.
* Established connection to www.example.test (198.51.100.10 port 443) from 198.51.100.5 port 42394
* using HTTP/1.x
> GET / HTTP/1.1
> Host: www.example.test
> User-Agent: curl/8.18.0
> Accept: */*
>
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/1.1 200 OK
< Server: nginx/1.28.3 (Ubuntu)
< Date: Mon, 05 Oct 2026 05:06:57 GMT
< Content-Type: text/plain; charset=utf-8
< Content-Length: 26
< Connection: keep-alive
<
hello from the old server
* Connection #0 to host www.example.test:443 left intact

   namelookup: %{time_namelookup}\n
      connect: %{time_connect}\n
   appconnect: %{time_appconnect}\n
  pretransfer: %{time_pretransfer}\n
starttransfer: %{time_starttransfer}\n
        total: %{time_total}\n
    http_code: %{http_code}\n
    remote_ip: %{remote_ip}\n

curl -sS -o /dev/null -w @curl-timing.txt https://www.example.test/
   namelookup: 0.000662
      connect: 0.000824
   appconnect: 0.010884
  pretransfer: 0.010941
starttransfer: 0.012186
        total: 0.012240
    http_code: 200
    remote_ip: 198.51.100.10
curl -sS -o /dev/null -w @curl-timing.txt 'https://www.example.test/slow?s=2'
   namelookup: 0.000982
      connect: 0.001113
   appconnect: 0.011911
  pretransfer: 0.012141
starttransfer: 2.013397
        total: 2.013463
    http_code: 200
    remote_ip: 198.51.100.10

getent hosts www.example.test nagoyadevlab02
198.51.100.10   www.example.test
198.51.100.20   nagoyadevlab02
curl -sS https://www.example.test/
hello from the old server
curl -sS --resolve www.example.test:443:198.51.100.20 https://www.example.test/
hello from the new server
curl -sS --connect-to www.example.test:443:nagoyadevlab02:443 https://www.example.test/
hello from the new server

curl -sv -o /dev/null --resolve www.example.test:443:198.51.100.20 https://www.example.test/ 2>&1 | grep -E 'DNS cache|Trying|subject:|expire date|issuer:|subjectAltName|verified|Established|^< HTTP'
* Added www.example.test:443:198.51.100.20 to DNS cache
* Hostname www.example.test was found in DNS cache
*   Trying 198.51.100.20:443...
*   subject: CN=www.example.test
*   expire date: Nov  4 05:05:14 2026 GMT
*   issuer: CN=Lab Throwaway CA
*   subjectAltName: "www.example.test" matches cert's "www.example.test"
* SSL certificate verified via OpenSSL.
* Established connection to www.example.test (198.51.100.20 port 443) from 198.51.100.5 port 53846
< HTTP/1.1 200 OK

curl -sS -H 'Host: www.example.test' https://198.51.100.20/; echo "exit=$?"
curl: (60) SSL: no alternative certificate subject name matches target ipv4 address '198.51.100.20'
exit=60

curl -sS -L --resolve www.example.test:80:198.51.100.20 http://www.example.test/
hello from the old server
curl -sS -L --resolve www.example.test:80:198.51.100.20 --resolve www.example.test:443:198.51.100.20 http://www.example.test/
hello from the new server
curl -sS -L --connect-to ::nagoyadevlab02: http://www.example.test/
hello from the new server
curl -sS -o /dev/null -w '%{http_code} %{remote_ip}\n' --resolve www.example.test:443:198.51.100.20 https://www.example.test/
200 198.51.100.20

curl -sS https://wwww.example.test/; echo "exit=$?"
curl: (6) Could not resolve host: wwww.example.test
exit=6
curl -sS https://www.example.test:8443/; echo "exit=$?"
curl: (7) Failed to connect to www.example.test port 8443 after 0 ms: Could not connect to server
exit=7
curl -sS https://198.51.100.99/; echo "exit=$?"
curl: (7) Failed to connect to 198.51.100.99 port 443 after 3064 ms: Could not connect to server
exit=7
curl -sS --connect-timeout 1 https://198.51.100.99/; echo "exit=$?"
curl: (28) Connection timed out after 1001 milliseconds
exit=28
curl -sS --max-time 1 'https://www.example.test/slow?s=5'; echo "exit=$?"
curl: (28) Operation timed out after 1002 milliseconds with 0 bytes received
exit=28
curl -sS https://www.example.test:80/; echo "exit=$?"
curl: (35) TLS connect error: error:0A00010B:SSL routines::wrong version number
exit=35
curl -sS https://nagoyadevlab02/; echo "exit=$?"
curl: (60) SSL: no alternative certificate subject name matches target hostname 'nagoyadevlab02'
exit=60

curl -sS https://www.example.test/status/503; echo "exit=$?"
{"status": 503, "detail": "lab backend returned this on purpose"}
exit=0
curl -sS -f https://www.example.test/status/503; echo "exit=$?"
curl: (22) The requested URL returned error: 503
exit=22
curl -sS --fail-with-body https://www.example.test/status/503; echo "exit=$?"
curl: (22) The requested URL returned error: 503
{"status": 503, "detail": "lab backend returned this on purpose"}
exit=22

curl -s https://wwww.example.test/; echo "exit=$?"
exit=6
curl -sS https://wwww.example.test/; echo "exit=$?"
curl: (6) Could not resolve host: wwww.example.test
exit=6

curl -sS -f --retry 3 https://www.example.test/flaky; echo "exit=$?"
curl: (22) The requested URL returned error: 503
curl: (22) The requested URL returned error: 503
attempt 3: ok
exit=0
curl -sS -f --retry 2 --retry-delay 1 https://www.example.test/status/404; echo "exit=$?"
curl: (22) The requested URL returned error: 404
exit=22
curl -sS -f --retry 2 --retry-delay 1 https://www.example.test:8443/; echo "exit=$?"
curl: (7) Failed to connect to www.example.test port 8443 after 0 ms: Could not connect to server
exit=7
curl -sS -f --retry 2 --retry-delay 1 --retry-connrefused https://www.example.test:8443/; echo "exit=$?"
curl: (7) Failed to connect to www.example.test port 8443 after 0 ms: Could not connect to server
curl: (7) Failed to connect to www.example.test port 8443 after 0 ms: Could not connect to server
curl: (7) Failed to connect to www.example.test port 8443 after 0 ms: Could not connect to server
exit=7

start=$(date +%s); curl -sS -f --max-time 2 --retry 2 --retry-delay 1 -o /dev/null 'https://www.example.test/slow?s=5'; echo "exit=$? elapsed=$(( $(date +%s) - start ))s"
curl: (28) Operation timed out after 2002 milliseconds with 0 bytes received
curl: (28) Operation timed out after 2001 milliseconds with 0 bytes received
curl: (28) Operation timed out after 2002 milliseconds with 0 bytes received
exit=28 elapsed=8s
start=$(date +%s); curl -sS -f --max-time 2 --retry 2 --retry-delay 1 --retry-max-time 3 -o /dev/null 'https://www.example.test/slow?s=5'; echo "exit=$? elapsed=$(( $(date +%s) - start ))s"
curl: (28) Operation timed out after 2002 milliseconds with 0 bytes received
curl: (28) Operation timed out after 2002 milliseconds with 0 bytes received
exit=28 elapsed=5s

#!/bin/sh
# check-http.sh URL — HTTPの応答を1行にまとめ、curl の終了コードをそのまま返す
url="$1"

out=$(curl -fsS \
  --connect-timeout 3 \
  --max-time 10 \
  --retry 2 --retry-delay 1 \
  -o /dev/null \
  -w 'http=%{http_code} ip=%{remote_ip} total=%{time_total}' \
  "$url" 2>&1)
rc=$?

echo "rc=$rc $out"
exit $rc

sh check-http.sh https://www.example.test/; echo "exit=$?"
rc=0 http=200 ip=198.51.100.10 total=0.011622
exit=0
sh check-http.sh https://www.example.test/status/503; echo "exit=$?"
rc=22 curl: (22) The requested URL returned error: 503
curl: (22) The requested URL returned error: 503
curl: (22) The requested URL returned error: 503
http=503 ip=198.51.100.10 total=0.008073
exit=22
sh check-http.sh https://www.example.test:8443/; echo "exit=$?"
rc=7 curl: (7) Failed to connect to www.example.test port 8443 after 0 ms: Could not connect to server
http=000 ip= total=0.000899
exit=7
start=$(date +%s); sh check-http.sh 'https://www.example.test/slow?s=12'; echo "exit=$? elapsed=$(( $(date +%s) - start ))s"
rc=28 curl: (28) Operation timed out after 10001 milliseconds with 0 bytes received
curl: (28) Operation timed out after 10002 milliseconds with 0 bytes received
curl: (28) Operation timed out after 10002 milliseconds with 0 bytes received
http=000 ip=198.51.100.10 total=10.002293
exit=28 elapsed=32s

curl -sv -o /dev/null -d '{"host":"nagoyadevlab02","state":"ok"}' https://www.example.test/echo 2>&1 | grep '^>'
> POST /echo HTTP/1.1
> Host: www.example.test
> User-Agent: curl/8.18.0
> Accept: */*
> Content-Length: 38
> Content-Type: application/x-www-form-urlencoded
>
curl -sv -o /dev/null --json '{"host":"nagoyadevlab02","state":"ok"}' https://www.example.test/echo 2>&1 | grep '^>'
> POST /echo HTTP/1.1
> Host: www.example.test
> User-Agent: curl/8.18.0
> Content-Type: application/json
> Accept: application/json
> Content-Length: 38
>

printf '{\n  "host": "nagoyadevlab02",\n  "state": "ok"\n}\n' > payload.json && cat payload.json && wc -c payload.json
{
  "host": "nagoyadevlab02",
  "state": "ok"
}
48 payload.json
curl -sS -H 'Content-Type: application/json' -d @payload.json https://www.example.test/echo
method: POST
content-type: application/json
accept: */*
body (44 bytes): {  "host": "nagoyadevlab02",  "state": "ok"}
curl -sS --json @payload.json https://www.example.test/echo
method: POST
content-type: application/json
accept: application/json
body (48 bytes): {\n  "host": "nagoyadevlab02",\n  "state": "ok"\n}\n

curl -sS -L -d 'state=ok' https://www.example.test/redirect/302
method: GET
content-type: (none)
accept: */*
body (0 bytes):
curl -sS -L -d 'state=ok' https://www.example.test/redirect/307
method: POST
content-type: application/x-www-form-urlencoded
accept: */*
body (8 bytes): state=ok

curl -sv -o /dev/null -L -d 'state=ok' https://www.example.test/redirect/302 2>&1 | grep -E '^[<>] (POST|GET|HTTP|Location|Content-Length|Content-Type)|^\* (Issue|Switch|Re-using|Need|Stick|Ignoring)'
> POST /redirect/302 HTTP/1.1
> Content-Length: 8
> Content-Type: application/x-www-form-urlencoded
< HTTP/1.1 302 Found
< Content-Type: text/plain; charset=utf-8
< Content-Length: 15
* Need to rewind upload for next request
< Location: /echo
* Ignoring the response-body
* Issue another request to this URL: 'https://www.example.test/echo'
> GET /echo HTTP/1.1
< HTTP/1.1 200 OK
< Content-Type: text/plain; charset=utf-8
< Content-Length: 62

mkdir -p ~/dl && cd ~/dl && curl -sS -O https://www.example.test/files/data-20m.bin && ls -l
total 20480
-rw-r--r-- 1 ryoma ryoma 20971520 Oct  5 05:08 data-20m.bin

curl -sS -O https://www.example.test/files/nothing.bin; echo "exit=$?"; ls -l nothing.bin; cat nothing.bin
exit=0
-rw-r--r-- 1 ryoma ryoma 162 Oct  5 05:08 nothing.bin
<html>
<head><title>404 Not Found</title></head>
<body>
<center><h1>404 Not Found</h1></center>
<hr><center>nginx/1.28.3 (Ubuntu)</center>
</body>
</html>

rm -f nothing.bin; curl -sS -f -O https://www.example.test/files/nothing.bin; echo "exit=$?"; ls -l nothing.bin
curl: (22) The requested URL returned error: 404
exit=22
ls: cannot access 'nothing.bin': No such file or directory

rm -f data-20m.bin; curl -sS --limit-rate 4M --max-time 2 -O https://www.example.test/files/data-20m.bin; echo "exit=$?"; ls -l data-20m.bin
curl: (28) Operation timed out after 2002 milliseconds with 8388608 out of 20971520 bytes received
exit=28
-rw-r--r-- 1 ryoma ryoma 8388608 Oct  5 05:09 data-20m.bin
curl -sv -C - -O https://www.example.test/files/data-20m.bin 2>&1 | grep -E 'Resuming|Range|HTTP/1.1 206'
> Range: bytes=8388608-
< HTTP/1.1 206 Partial Content
< Content-Range: bytes 8388608-20971519/20971520
ls -l data-20m.bin; sha256sum data-20m.bin
-rw-r--r-- 1 ryoma ryoma 20971520 Oct  5 05:09 data-20m.bin
e39cc3f010e60956813fe905b20c1c568a0d040a7e9e2e126832c5b124be88fc  data-20m.bin

sha256sum /var/www/lab/files/data-20m.bin
e39cc3f010e60956813fe905b20c1c568a0d040a7e9e2e126832c5b124be88fc  /var/www/lab/files/data-20m.bin

https_proxy=http://nagoyadevlab02:8888 curl -sv -o /dev/null https://www.example.test/ 2>&1 | grep -E 'proxy|CONNECT|^< HTTP|Established|tunnel|Proxy'
* Uses proxy env variable https_proxy == 'http://nagoyadevlab02:8888'
* CONNECT: no ALPN negotiated
* Establish HTTP proxy tunnel to www.example.test:443
> CONNECT www.example.test:443 HTTP/1.1
> Proxy-Connection: Keep-Alive
< HTTP/1.1 200 Connection established
< Proxy-agent: tinyproxy
* CONNECT phase completed
* CONNECT tunnel established, response 200
* Established connection to nagoyadevlab02 (198.51.100.20 port 8888) from 198.51.100.5 port 52004
< HTTP/1.1 200 OK

HTTP_PROXY=http://nagoyadevlab02:8888 curl -sv -o /dev/null http://www.example.test/ 2>&1 | grep -E 'proxy env|^> GET|Established connection'
* Established connection to www.example.test (198.51.100.10 port 80) from 198.51.100.5 port 42962
> GET / HTTP/1.1
http_proxy=http://nagoyadevlab02:8888 curl -sv -o /dev/null http://www.example.test/ 2>&1 | grep -E 'proxy env|^> GET|Established connection'
* Uses proxy env variable http_proxy == 'http://nagoyadevlab02:8888'
* Established connection to nagoyadevlab02 (198.51.100.20 port 8888) from 198.51.100.5 port 39676
> GET http://www.example.test/ HTTP/1.1

https_proxy=http://nagoyadevlab02:8888 NO_PROXY=www.example.test curl -sv -o /dev/null https://www.example.test/ 2>&1 | grep -E 'proxy env|^> CONNECT|Established connection'
* Uses proxy env variable NO_PROXY == 'www.example.test'
* Established connection to www.example.test (198.51.100.10 port 443) from 198.51.100.5 port 50168
https_proxy=http://nagoyadevlab02:8888 curl -sv -o /dev/null --noproxy www.example.test https://www.example.test/ 2>&1 | grep -E 'proxy env|^> CONNECT|Established connection'
* Established connection to www.example.test (198.51.100.10 port 443) from 198.51.100.5 port 50172

https_proxy=http://nagoyadevlab02:3128 curl -sS https://www.example.test/; echo "exit=$?"
curl: (7) Failed to connect to www.example.test port 443 via nagoyadevlab02 after 0 ms: Could not connect to server
exit=7
https_proxy=http://nagoyadevlab02:8888 curl -sS https://wwww.example.test/; echo "exit=$?"
curl: (7) CONNECT tunnel failed, response 500
exit=7

curl -sS -o /dev/null -H 'Authorization: Bearer lab-token-12345' 'https://www.example.test/slow?s=3' & sleep 1; ps -C curl -o args=; wait
curl -sS -o /dev/null -H Authorization: Bearer lab-token-12345 https://www.example.test/slow?s=3
curl -sS -o /dev/null -u ryoma:lab-pass-12345 'https://www.example.test/slow?s=3' & sleep 1; ps -C curl -o args=; wait
curl -sS -o /dev/null -u ******************** https://www.example.test/slow?s=3

Authorization: Bearer lab-token-12345

header = "Authorization: Bearer lab-token-12345"
fail
silent
show-error
max-time = 10

machine www.example.test login ryoma password lab-pass-12345

install -d -m 700 ~/.curl
chmod 600 ~/.curl/api.header ~/.curl/api.conf ~/.curl/netrc && ls -l ~/.curl
total 12
-rw------- 1 ryoma ryoma 86 Oct  5 05:10 api.conf
-rw------- 1 ryoma ryoma 38 Oct  5 05:10 api.header
-rw------- 1 ryoma ryoma 61 Oct  5 05:10 netrc

curl -sS -H @"$HOME/.curl/api.header" https://www.example.test/private
ok: token accepted
curl -sS -o /dev/null -H @"$HOME/.curl/api.header" 'https://www.example.test/slow?s=3' & sleep 1; ps -C curl -o args=; wait
curl -sS -o /dev/null -H @/home/ryoma/.curl/api.header https://www.example.test/slow?s=3
curl -K ~/.curl/api.conf https://www.example.test/private
ok: token accepted
curl -sS --netrc-file ~/.curl/netrc https://www.example.test/private
ok: password accepted
sed 's/^machine www.example.test/machine nagoyadevlab02/' ~/.curl/netrc > ~/.curl/netrc-other && chmod 600 ~/.curl/netrc-other
curl -sS -w '%{http_code}\n' --netrc-file ~/.curl/netrc-other https://www.example.test/private
authentication required
401

wget --version | head -1
GNU Wget 1.25.0 built on linux-gnu.
wget -nv https://www.example.test/files/nothing.bin; echo "exit=$?"; ls nothing.bin
https://www.example.test/files/nothing.bin:
2026-10-05 05:11:02 ERROR 404: Not Found.
exit=8
ls: cannot access 'nothing.bin': No such file or directory

rm -f data-20m.bin; wget -nv https://www.example.test/files/data-20m.bin; echo "exit=$?"; ls -l data-20m.bin
2026-10-05 05:11:02 URL:https://www.example.test/files/data-20m.bin [20971520/20971520] -> "data-20m.bin" [1]
exit=0
-rw-r--r-- 1 ryoma ryoma 20971520 Oct  5 05:05 data-20m.bin
wget -nv https://www.example.test/files/data-20m.bin; echo "exit=$?"; ls -l
2026-10-05 05:11:02 URL:https://www.example.test/files/data-20m.bin [20971520/20971520] -> "data-20m.bin.1" [1]
exit=0
total 40960
-rw-r--r-- 1 ryoma ryoma 20971520 Oct  5 05:05 data-20m.bin
-rw-r--r-- 1 ryoma ryoma 20971520 Oct  5 05:05 data-20m.bin.1
wget -nv -O - http://www.example.test/; echo "exit=$?"
hello from the old server
2026-10-05 05:11:03 URL:https://www.example.test/ [26/26] -> "-" [1]
exit=0

# curl という名前が別名（Alias）か実行ファイル（Application）かを確認する
Get-Command curl

# 本物の curl を明示して呼ぶ
curl.exe --version

docker network create --subnet 198.51.100.0/24 curl-lab-net
docker volume create curl-lab
docker run -d --name curl-lab-www --network curl-lab-net --ip 198.51.100.10 --network-alias www.example.test -v curl-lab:/lab ubuntu:26.04 sleep infinity
docker run -d --name curl-lab-new --hostname nagoyadevlab02 --network curl-lab-net --ip 198.51.100.20 --network-alias nagoyadevlab02 -v curl-lab:/lab ubuntu:26.04 sleep infinity
docker run -d --name curl-lab-client --hostname nagoyadevlab01 --network curl-lab-net --ip 198.51.100.5 -v curl-lab:/lab ubuntu:26.04 sleep infinity
docker cp lab.conf curl-lab-www:/lab/lab.conf
docker cp backend.py curl-lab-www:/lab/backend.py

apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nginx python3 openssl >/dev/null 2>&1; echo "exit=$?"
exit=0

mkdir -p /lab/pki && cd /lab/pki
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes -days 30 -subj "/CN=Lab Throwaway CA" -keyout ca.key -out ca.crt
-----
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes -days 30 -subj "/CN=www.example.test" -addext "subjectAltName=DNS:www.example.test" -addext "basicConstraints=CA:FALSE" -CA ca.crt -CAkey ca.key -keyout www.key -out www.crt
-----
openssl verify -CAfile ca.crt www.crt
www.crt: OK

# 80番は HTTPS へ転送するだけ
server {
    listen 80;
    server_name www.example.test;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name www.example.test;

    ssl_certificate     /lab/pki/www.crt;
    ssl_certificate_key /lab/pki/www.key;

    # ダウンロードの検証に使う静的ファイル（Range リクエストに nginx が応える）
    location /files/ {
        root /var/www/lab;
    }

    # それ以外は自作のバックエンドへ
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
    }
}

#!/usr/bin/env python3
"""curl の検証用バックエンド。127.0.0.1:8080 で待ち受け、nginx から proxy_pass される。
使い方: python3 backend.py old   （引数は GET / の応答に入れるサーバーの呼び名）"""
import sys
import time
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from urllib.parse import parse_qs, urlsplit

ROLE = sys.argv[1] if len(sys.argv) > 1 else "old"
TOKEN = "lab-token-12345"                    # /private が受け付ける Bearer トークン（検証用の値）
BASIC = "cnlvbWE6bGFiLXBhc3MtMTIzNDU="       # ryoma:lab-pass-12345 を Base64 にしたもの
flaky_hits = 0


class Handler(BaseHTTPRequestHandler):
    protocol_version = "HTTP/1.1"

    def reply(self, status, text, ctype="text/plain; charset=utf-8", extra=None):
        body = text.encode()
        self.send_response(status)
        self.send_header("Content-Type", ctype)
        self.send_header("Content-Length", str(len(body)))
        for name, value in (extra or {}).items():
            self.send_header(name, value)
        self.end_headers()
        if self.command != "HEAD":
            self.wfile.write(body)

    def route(self):
        global flaky_hits
        url = urlsplit(self.path)
        size = int(self.headers.get("Content-Length") or 0)
        body = self.rfile.read(size).decode("utf-8", "replace")

        if url.path == "/":
            self.reply(200, f"hello from the {ROLE} server\n")
        elif url.path == "/echo":
            # 届いたリクエストをそのまま文字で返す。改行は \n と表示する
            lines = [f"method: {self.command}"]
            for name in ("Content-Type", "Accept"):
                lines.append(f"{name.lower()}: {self.headers.get(name, '(none)')}")
            lines.append(f"body ({size} bytes): " + body.replace("\r", "\\r").replace("\n", "\\n"))
            self.reply(200, "\n".join(lines) + "\n")
        elif url.path.startswith("/redirect/"):
            # /redirect/302 なら 302 で /echo へ飛ばす
            self.reply(int(url.path.rsplit("/", 1)[1]), "moved to /echo\n", extra={"Location": "/echo"})
        elif url.path.startswith("/status/"):
            code = int(url.path.rsplit("/", 1)[1])
            self.reply(code, '{"status": %d, "detail": "lab backend returned this on purpose"}\n' % code,
                       ctype="application/json")
        elif url.path == "/slow":
            # /slow?s=2 なら 2 秒待ってから応答する
            wait = min(float(parse_qs(url.query).get("s", ["1"])[0]), 30)
            time.sleep(wait)
            self.reply(200, f"waited {wait:g} s\n")
        elif url.path == "/flaky":
            # 2回続けて 503 を返し、3回目に 200 を返す
            flaky_hits += 1
            if flaky_hits % 3:
                self.reply(503, f"attempt {flaky_hits % 3}: try again\n")
            else:
                self.reply(200, "attempt 3: ok\n")
        elif url.path == "/private":
            auth = self.headers.get("Authorization", "")
            if auth == f"Bearer {TOKEN}":
                self.reply(200, "ok: token accepted\n")
            elif auth == f"Basic {BASIC}":
                self.reply(200, "ok: password accepted\n")
            else:
                self.reply(401, "authentication required\n", extra={"WWW-Authenticate": 'Bearer realm="lab"'})
        else:
            self.reply(404, "no such path\n")

    do_GET = do_HEAD = do_POST = do_PUT = do_DELETE = route


ThreadingHTTPServer(("127.0.0.1", 8080), Handler).serve_forever()

cp /lab/lab.conf /etc/nginx/conf.d/lab.conf && rm /etc/nginx/sites-enabled/default && nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
mkdir -p /var/www/lab/files && head -c 20M /dev/urandom > /var/www/lab/files/data-20m.bin && ls -l /var/www/lab/files/
total 20480
-rw-r--r-- 1 root root 20971520 Oct  5 05:05 data-20m.bin
nohup python3 /lab/backend.py old >/var/log/lab-backend.log 2>&1 &
nginx; echo "exit=$?"
exit=0

cp /lab/lab.conf /etc/nginx/conf.d/lab.conf && rm /etc/nginx/sites-enabled/default && nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
nohup python3 /lab/backend.py new >/var/log/lab-backend.log 2>&1 &
nginx; echo "exit=$?"
exit=0
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq tinyproxy >/dev/null 2>&1; echo "exit=$?"
exit=0
echo 'Allow 198.51.100.0/24' >> /etc/tinyproxy/tinyproxy.conf && tinyproxy; echo "exit=$?"
exit=0
tinyproxy -v
tinyproxy 1.11.3

apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq curl ca-certificates >/dev/null 2>&1; echo "exit=$?"
exit=0
useradd -m -s /bin/bash ryoma && id ryoma
uid=1001(ryoma) gid=1001(ryoma) groups=1001(ryoma)
cp /lab/pki/ca.crt /usr/local/share/ca-certificates/lab-ca.crt && update-ca-certificates
Updating certificates in /etc/ssl/certs...
rehash: warning: skipping ca-certificates.crt, it does not contain exactly one certificate or CRL
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq wget >/dev/null 2>&1; echo "exit=$?"
exit=0
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nano >/dev/null 2>&1; echo "exit=$?"
exit=0

curl -sS https://www.example.test/; echo "exit=$?"
curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)
exit=60
curl -sS --cacert /lab/pki/ca.crt https://www.example.test/; echo "exit=$?"
hello from the old server
exit=0

curl -sS -H @~/.curl/api.header https://www.example.test/private; echo "exit=$?"
curl: Failed to open ~/.curl/api.header
curl: option -H: error encountered when reading a file
curl: try 'curl --help' or 'curl --manual' for more information
exit=26

curl -sS https://www.example.test:80/; echo "exit=$?"
curl: (35) TLS connect error: error:0A00010B:SSL routines::wrong version number
exit=35
curl -sS http://www.example.test:443/; echo "exit=$?"
<html>
<head><title>400 The plain HTTP request was sent to HTTPS port</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>The plain HTTP request was sent to HTTPS port</center>
<hr><center>nginx/1.28.3 (Ubuntu)</center>
</body>
</html>
exit=0

curl -sS -o /dev/null -w '%{url_effective}\n' https://www.example.test/echo?a=1&b=2
https://www.example.test/echo?a=1
curl -sS -o /dev/null -w '%{url_effective}\n' 'https://www.example.test/echo?a=1&b=2'
https://www.example.test/echo?a=1&b=2

curl -sS -o /dev/null -w '%{http_code} %{remote_ip}\n' https://www.example.test/
200 198.51.100.10
curl -sS -o /dev/null -w '%{http_code} %{remote_ip}\n' --resolve www.example.test:443:198.51.100.20 https://www.example.test/
200 198.51.100.20
curl -sS -f https://www.example.test/status/503; echo "exit=$?"
curl: (22) The requested URL returned error: 503
exit=22
sh check-http.sh https://www.example.test/; echo "exit=$?"
rc=0 http=200 ip=198.51.100.10 total=0.011622
exit=0