AgentLabCn
94 lines
3.9 KiB
Nginx Configuration File
94 lines
3.9 KiB
Nginx Configuration File
# ============================================================
|
||
# 青叶 (QingYe) —— 宿主机 Nginx 反向代理配置
|
||
# ------------------------------------------------------------
|
||
# 目标域名：www.e4s.world
|
||
# 部署步骤：
|
||
# 1) 复制到 /etc/nginx/sites-available/www.e4s.world.conf
|
||
# 2) ln -s /etc/nginx/sites-available/www.e4s.world.conf /etc/nginx/sites-enabled/
|
||
# 3) 删除默认站点（如有冲突）：rm /etc/nginx/sites-enabled/default
|
||
# 4) nginx -t && systemctl reload nginx
|
||
# 5) 确认 DNS 已生效且 http://www.e4s.world 能打开前端
|
||
# 6) 申请 SSL 证书：certbot --nginx -d www.e4s.world
|
||
# certbot 会自动把 80 端口改为 301 跳转到 443，并将下列 location
|
||
# 复制到新增的 443 server 块（WebSocket 也由 443 处理）。
|
||
# ------------------------------------------------------------
|
||
# 流量走向：
|
||
# https://www.e4s.world/ → 127.0.0.1:8080 (前端容器, SPA)
|
||
# https://www.e4s.world/api/... → 127.0.0.1:8000 (后端容器)
|
||
# https://www.e4s.world/uploads/ → 127.0.0.1:8000 (后端 StaticFiles)
|
||
# wss://www.e4s.world/ws → 127.0.0.1:8000 (后端 WebSocket)
|
||
# ============================================================
|
||
|
||
upstream qingye_frontend {
|
||
server 127.0.0.1:8080;
|
||
}
|
||
|
||
upstream qingye_backend {
|
||
server 127.0.0.1:8000;
|
||
}
|
||
|
||
server {
|
||
listen 80;
|
||
server_name www.e4s.world;
|
||
|
||
# 上传体积上限：须 >= 后端 MAX_UPLOAD_SIZE_MB（默认 10MB）。
|
||
# 这里设 12MB 为 multipart 编码留余量；若调大后端限制需同步调大此值。
|
||
client_max_body_size 12M;
|
||
|
||
# 基础安全响应头（HSTS 仅在 HTTPS 下有意义，须在 certbot 生成 443 块后补上，见 DEPLOYMENT.md）
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
|
||
# ---- 前端 SPA（默认路由，最低优先级）----
|
||
location / {
|
||
proxy_pass http://qingye_frontend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
}
|
||
|
||
# ---- API 接口（proxy_pass 不带尾部斜杠，保留 /api/ 前缀）----
|
||
location /api/ {
|
||
proxy_pass http://qingye_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
}
|
||
|
||
# ---- 上传文件（后端 StaticFiles 挂载于 /uploads）----
|
||
# nosniff：防止用户上传的 .html/.svg 在同源执行（避免读取 localStorage token 的存储型 XSS）
|
||
location /uploads/ {
|
||
proxy_pass http://qingye_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
expires 7d;
|
||
access_log off;
|
||
}
|
||
|
||
# ---- WebSocket（精确匹配 /ws，优先级高于上面的 location /）----
|
||
# 注意：必须 proxy_http_version 1.1 + Upgrade/Connection，否则握手失败。
|
||
location = /ws {
|
||
proxy_pass http://qingye_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
# 长连接超时（秒），避免空闲被切断
|
||
proxy_read_timeout 86400s;
|
||
proxy_send_timeout 86400s;
|
||
# 不记录含 token 的查询串，避免 JWT 落入访问日志
|
||
access_log off;
|
||
}
|
||
}
|