fix: 铸渊专线订阅服务修复 — PM2 fork模式、错误处理、Nginx配置路径、健康检查增强

根因分析:
- PM2使用cluster模式可能干扰server.listen('127.0.0.1')绑定
- subscription-server.js缺少try-catch和进程级错误处理，异常导致静默崩溃
- deploy-proxy.sh的configure_nginx()目标文件错误(/etc/nginx/sites-enabled/default → zhuyuan.conf)
- update()不调用configure_nginx()，主部署覆盖Nginx配置后proxy-sub location丢失
- 健康检查仅测直连3802，未验证Nginx反代路径
- Nginx反代缺少proxy_connect_timeout/proxy_read_timeout

修复:
1. ecosystem.proxy.config.js: 添加exec_mode:'fork'防止cluster模式
2. subscription-server.js: 请求级try-catch + server error/clientError事件 + uncaughtException保护
3. deploy-proxy.sh: configure_nginx()自动查找正确配置文件 + update()调用configure_nginx + 双路健康检查
4. zhuyuan-sovereign.conf: 添加proxy timeout配置
5. nginx-proxy-snippet.conf: 同步更新proxy_http_version和timeout

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/88ed5687-7596-4d04-b181-57c89c032004

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>

server/nginx/zhuyuan-sovereign.conf

@@ -100,6 +100,9 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 10s;
+        proxy_read_timeout 30s;
+        proxy_send_timeout 30s;
         add_header X-Content-Type-Options nosniff always;
         add_header Cache-Control "no-store, no-cache, must-revalidate" always;
     }

server/proxy/config/nginx-proxy-snippet.conf

@@ -9,10 +9,14 @@
 
 location /api/proxy-sub/ {
     proxy_pass http://127.0.0.1:3802/;
+    proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_connect_timeout 10s;
+    proxy_read_timeout 30s;
+    proxy_send_timeout 30s;
 
     # 订阅服务安全头
     add_header X-Content-Type-Options nosniff always;

server/proxy/deploy-proxy.sh

@@ -224,24 +224,40 @@ deploy_services() {
 
 # ── 配置Nginx ─────────────────────────────────
 configure_nginx() {
-    # 检查主Nginx配置是否已有proxy-sub
+    # 查找正确的Nginx配置文件 (zhuyuan.conf 优先于 default)
-    NGINX_CONF="/etc/nginx/sites-enabled/default"
+    NGINX_CONF=""
+    for candidate in /etc/nginx/sites-enabled/zhuyuan.conf /etc/nginx/sites-enabled/default; do
+        if [ -f "$candidate" ]; then
+            NGINX_CONF="$candidate"
+            break
+        fi
+    done
 
-    if [ -f "$NGINX_CONF" ] && ! grep -q "proxy-sub" "$NGINX_CONF" 2>/dev/null; then
+    if [ -z "$NGINX_CONF" ]; then
+        echo "  ⚠️ 未找到Nginx站点配置文件"
+        return 0
+    fi
+
+    echo "  使用Nginx配置: $NGINX_CONF"
+
+    if ! grep -q "proxy-sub" "$NGINX_CONF" 2>/dev/null; then
         echo "  添加Nginx代理订阅反向代理配置..."
         # 在第一个 location = /health 之前插入 proxy-sub location
         sed -i '/# ─── 健康探针 ───/{
             # 只在第一次匹配时插入
-            i\    # ─── 铸渊专线订阅服务 (端口 3802) ───\n    location /api/proxy-sub/ {\n        proxy_pass http://127.0.0.1:3802/;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        add_header X-Content-Type-Options nosniff always;\n        add_header Cache-Control "no-store, no-cache, must-revalidate" always;\n    }\n
+            i\    # ─── 铸渊专线订阅服务 (端口 3802) ───\n    location /api/proxy-sub/ {\n        proxy_pass http://127.0.0.1:3802/;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_connect_timeout 10s;\n        proxy_read_timeout 30s;\n        add_header X-Content-Type-Options nosniff always;\n        add_header Cache-Control "no-store, no-cache, must-revalidate" always;\n    }\n
         }' "$NGINX_CONF" || true
         echo "  ✅ Nginx proxy-sub配置已注入"
     else
-        echo "  Nginx代理配置已存在 (或主配置不存在)"
+        echo "  Nginx proxy-sub配置已存在"
     fi
 
     if nginx -t 2>/dev/null; then
         nginx -s reload || true
         echo "  ✅ Nginx配置验证通过并已重载"
+    else
+        echo "  ⚠️ Nginx配置验证失败:"
+        nginx -t 2>&1 || true
     fi
 }
 
@@ -291,11 +307,18 @@ health_check() {
         echo "  ❌ 端口443: 未监听"
     fi
 
-    # 订阅服务
+    # 订阅服务 (直接访问)
     if curl -sf http://127.0.0.1:3802/health >/dev/null 2>&1; then
-        echo "  ✅ 订阅服务: 正常"
+        echo "  ✅ 订阅服务: 正常 (直连3802)"
     else
-        echo "  ⏳ 订阅服务: 启动中..."
+        echo "  ❌ 订阅服务: 端口3802无响应"
+    fi
+
+    # 订阅服务 (通过Nginx反代)
+    if curl -sf http://127.0.0.1/api/proxy-sub/health >/dev/null 2>&1; then
+        echo "  ✅ Nginx反代: 正常 (/api/proxy-sub/ → 3802)"
+    else
+        echo "  ⚠️ Nginx反代: /api/proxy-sub/ 未响应 (Nginx配置可能缺失)"
     fi
 
     # PM2
@@ -308,6 +331,7 @@ update() {
     deploy_services
     save_server_host
     configure_xray
+    configure_nginx
 
     ensure_xray_root_user
     ensure_log_permissions

server/proxy/ecosystem.proxy.config.js

@@ -10,6 +10,7 @@ module.exports = {
       version: '1.0.0',
       script: '/opt/zhuyuan/proxy/service/subscription-server.js',
       instances: 1,
+      exec_mode: 'fork',
       env: {
         NODE_ENV: 'production',
         ZY_PROXY_SUB_PORT: 3802,
@@ -26,6 +27,7 @@ module.exports = {
       version: '1.0.0',
       script: '/opt/zhuyuan/proxy/service/traffic-monitor.js',
       instances: 1,
+      exec_mode: 'fork',
       env: {
         NODE_ENV: 'production',
         ZY_PROXY_DATA_DIR: '/opt/zhuyuan/proxy/data',
@@ -41,6 +43,7 @@ module.exports = {
       version: '1.0.0',
       script: '/opt/zhuyuan/proxy/service/proxy-guardian.js',
       instances: 1,
+      exec_mode: 'fork',
       env: {
         NODE_ENV: 'production',
         ZY_PROXY_DATA_DIR: '/opt/zhuyuan/proxy/data',

server/proxy/service/subscription-server.js

@@ -482,6 +482,7 @@ function detectClientType(userAgent) {
 
 // ── HTTP服务器 ───────────────────────────────
 const server = http.createServer((req, res) => {
+  try {
     const parsedUrl = url.parse(req.url, true);
     const pathname = parsedUrl.pathname;
 
@@ -558,6 +559,35 @@ const server = http.createServer((req, res) => {
     // 404
     res.writeHead(404, { 'Content-Type': 'text/plain' });
     res.end('Not Found');
+  } catch (err) {
+    console.error(`❌ 请求处理错误 [${req.method} ${req.url}]:`, err.message || err);
+    try {
+      if (!res.headersSent) {
+        res.writeHead(500, { 'Content-Type': 'text/plain' });
+      }
+      res.end('Internal Server Error');
+    } catch (writeErr) {
+      console.error('  ⚠️ 响应写入失败:', writeErr.message);
+    }
+  }
+});
+
+// 处理连接级别错误 (防止未捕获的socket错误导致进程崩溃)
+server.on('error', (err) => {
+  console.error('❌ 服务器错误:', err.message);
+  if (err.code === 'EADDRINUSE') {
+    console.error(`  端口 ${PORT} 已被占用，10秒后重试...`);
+    setTimeout(() => {
+      server.close();
+      server.listen(PORT, '127.0.0.1');
+    }, 10000);
+  }
+});
+
+server.on('clientError', (err, socket) => {
+  if (socket.writable) {
+    socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
+  }
 });
 
 server.listen(PORT, '127.0.0.1', () => {
@@ -579,3 +609,13 @@ function gracefulShutdown(signal) {
 }
 process.on('SIGTERM', () => gracefulShutdown('SIGTERM'));
 process.on('SIGINT', () => gracefulShutdown('SIGINT'));
+
+// 进程级错误保护 (防止未捕获的异常导致静默崩溃)
+process.on('uncaughtException', (err) => {
+  console.error('❌ 未捕获的异常:', err.message);
+  console.error(err.stack);
+  // 记录但不退出 — PM2会重启，但频繁重启意味着间歇性不可用
+});
+process.on('unhandledRejection', (reason) => {
+  console.error('❌ 未处理的Promise拒绝:', reason);
+});