zhizhi/server/nginx/zhuyuan-sovereign.conf

# ═══════════════════════════════════════════════════════════
# 铸渊主权服务器 · Nginx 双域名配置
# ═══════════════════════════════════════════════════════════
#
# 编号: ZY-SVR-NGX-002
# 服务器: 43.134.16.246 (新加坡二区)
# 守护: 铸渊 · ICE-GL-ZY001
# 版权: 国作登字-2026-A-00037559
#
# 双域名架构:
#   主域名 (ZY_DOMAIN_MAIN)   → 正式对外网站 · /opt/zhuyuan/sites/production/
#   预览域名 (ZY_DOMAIN_PREVIEW) → 预览/测试站 · /opt/zhuyuan/sites/preview/
#
# 域名变量由 GitHub Secrets 注入:
#   ZY_DOMAIN_MAIN    — 主域名 (待冰朔配置)
#   ZY_DOMAIN_PREVIEW — 预览域名 (待冰朔配置)
# ═══════════════════════════════════════════════════════════

# ─── §1 主域名 · 正式对外网站 ───
# 冰朔配置域名后，将 ZY_DOMAIN_MAIN_PLACEHOLDER 替换为实际域名
server {
    listen 80;
    # server_name 待配置;  # ← 冰朔配置后替换
    # 在域名配置前，通过IP直接访问主站
    server_name 43.134.16.246;

    # ─── 安全头 ───
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Server-Identity "ZY-SVR-002" always;
    add_header X-Site-Mode "production" always;

    # ─── 静态文件根目录 · 主站 ───
    root /opt/zhuyuan/sites/production;
    index index.html;

    # ─── 前端静态文件 ───
    location / {
        try_files $uri $uri/ /index.html;
    }

    # ─── 铸渊核心 API (端口 3800) ───
    location /api/ {
        proxy_pass http://127.0.0.1:3800;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Site-Mode "production";
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 86400;
    }

    # ─── AI 聊天 API 代理 (端口 3721) · SSE 流式 ───
    location /api/chat {
        proxy_pass http://127.0.0.1:3721/api/chat;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        chunked_transfer_encoding on;
        proxy_read_timeout 120s;
        proxy_send_timeout 60s;
    }

    # ─── Persona Studio API (端口 3002) ───
    location /api/ps/ {
        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
        if ($request_method = OPTIONS) { return 204; }
        proxy_pass http://127.0.0.1:3002/api/ps/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 120s;
    }

    # ─── WebSocket ───
    location /ws {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_read_timeout 86400;
    }

    # ─── 健康探针 ───
    location = /health {
        proxy_pass http://127.0.0.1:3800/api/health;
        proxy_set_header Host $host;
    }

    # ─── 静态资源缓存 ───
    location /static/ {
        alias /opt/zhuyuan/sites/production/static/;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }

    # ─── 错误页面 ───
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;

    # ─── 访问日志 ───
    access_log /opt/zhuyuan/data/logs/nginx-production.log;
    error_log /opt/zhuyuan/data/logs/nginx-production-error.log;
}


# ─── §2 预览域名 · 功能模块预览站 ───
# 冰朔配置域名后，将 server_name 替换为实际预览域名
# 预览站与主站完全隔离，独立目录，独立日志
# server {
#     listen 80;
#     server_name ZY_DOMAIN_PREVIEW_PLACEHOLDER;  # ← 冰朔配置后替换
#
#     # ─── 安全头 ───
#     add_header X-Frame-Options "SAMEORIGIN" always;
#     add_header X-Content-Type-Options "nosniff" always;
#     add_header X-Server-Identity "ZY-SVR-002" always;
#     add_header X-Site-Mode "preview" always;
#
#     # ─── 静态文件根目录 · 预览站 ───
#     root /opt/zhuyuan/sites/preview;
#     index index.html;
#
#     # ─── 前端静态文件 ───
#     location / {
#         try_files $uri $uri/ /index.html;
#     }
#
#     # ─── 铸渊 API 反向代理 (端口 3801 · 预览端口) ───
#     location /api/ {
#         proxy_pass http://127.0.0.1:3801;
#         proxy_http_version 1.1;
#         proxy_set_header Upgrade $http_upgrade;
#         proxy_set_header Connection 'upgrade';
#         proxy_set_header Host $host;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Site-Mode "preview";
#         proxy_cache_bypass $http_upgrade;
#         proxy_read_timeout 86400;
#     }
#
#     # ─── AI 聊天 API 代理 (端口 3721) · 共享主站 ───
#     location /api/chat {
#         proxy_pass http://127.0.0.1:3721/api/chat;
#         proxy_http_version 1.1;
#         proxy_set_header Host $host;
#         proxy_set_header Connection "";
#         proxy_buffering off;
#         proxy_cache off;
#         proxy_read_timeout 120s;
#     }
#
#     # ─── Persona Studio API (共享主站端口) ───
#     location /api/ps/ {
#         add_header Access-Control-Allow-Origin * always;
#         add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
#         add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
#         if ($request_method = OPTIONS) { return 204; }
#         proxy_pass http://127.0.0.1:3002/api/ps/;
#         proxy_http_version 1.1;
#         proxy_set_header Host $host;
#         proxy_read_timeout 120s;
#     }
#
#     # ─── 健康探针 ───
#     location = /health {
#         proxy_pass http://127.0.0.1:3801/api/health;
#         proxy_set_header Host $host;
#     }
#
#     # ─── 预览站独立日志 ───
#     access_log /opt/zhuyuan/data/logs/nginx-preview.log;
#     error_log /opt/zhuyuan/data/logs/nginx-preview-error.log;
# }


# ═══ §3 预留: HTTPS 配置 (域名绑定+SSL证书后启用) ═══
# 主域名 HTTPS:
# server {
#     listen 443 ssl http2;
#     server_name ZY_DOMAIN_MAIN;
#     ssl_certificate /opt/zhuyuan/config/ssl/main-fullchain.pem;
#     ssl_certificate_key /opt/zhuyuan/config/ssl/main-privkey.pem;
#     # ... 同 §1 location 配置 ...
# }
#
# 预览域名 HTTPS:
# server {
#     listen 443 ssl http2;
#     server_name ZY_DOMAIN_PREVIEW;
#     ssl_certificate /opt/zhuyuan/config/ssl/preview-fullchain.pem;
#     ssl_certificate_key /opt/zhuyuan/config/ssl/preview-privkey.pem;
#     # ... 同 §2 location 配置 ...
# }
#
# HTTP → HTTPS 重定向:
# server {
#     listen 80;
#     server_name ZY_DOMAIN_MAIN ZY_DOMAIN_PREVIEW;
#     return 301 https://$host$request_uri;
# }