From 7907053588bec302fbf10a346dd773e70a2a8a54 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 5 Apr 2026 09:00:50 +0000
Subject: [PATCH] =?UTF-8?q?D57=E4=BF=AE=E5=A4=8D:=20Nginx=E5=8F=8D?=
 =?UTF-8?q?=E4=BB=A3=E7=AB=AF=E5=8F=A33802=E2=86=923803=20+=20=E5=A4=A7?=
 =?UTF-8?q?=E8=84=91=E6=9C=8D=E5=8A=A1=E5=99=A8=E8=87=AA=E5=8A=A8Nginx?=
 =?UTF-8?q?=E9=85=8D=E7=BD=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

根因: nginx-proxy-snippet.conf指向V1端口3802, 但V2订阅服务监听3803
修复:
- 新建nginx-brain-proxy-snippet.conf (V2·端口3803)
- deploy-brain-proxy.sh新增configure_nginx函数
- install/update操作自动配置Nginx反向代理
- 自动检测并修复3802→3803端口错误
- health_check新增Nginx反代检查
- 更新V1 snippet注释标明仅用于面孔服务器

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/2d8735f4-e1e5-40a4-afec-464aa2dbae9d

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
---
 .../config/nginx-brain-proxy-snippet.conf     |  30 ++++
 server/proxy/config/nginx-proxy-snippet.conf  |   7 +-
 server/proxy/deploy-brain-proxy.sh            | 137 +++++++++++++++++-
 3 files changed, 165 insertions(+), 9 deletions(-)
 create mode 100644 server/proxy/config/nginx-brain-proxy-snippet.conf

diff --git a/server/proxy/config/nginx-brain-proxy-snippet.conf b/server/proxy/config/nginx-brain-proxy-snippet.conf
new file mode 100644
index 00000000..cd060704
--- /dev/null
+++ b/server/proxy/config/nginx-brain-proxy-snippet.conf
@@ -0,0 +1,30 @@
+# ═══════════════════════════════════════════════
+# 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001
+# 📜 Copyright: 国作登字-2026-A-00037559
+# ═══════════════════════════════════════════════
+# 铸渊专线V2 · 大脑服务器 Nginx反向代理配置
+# 添加到 /etc/nginx/sites-enabled/ 中的server块内
+#
+# ⚠️ V2版本 · 端口3803 · 独立于面孔服务器V1(3802)
+# ═══════════════════════════════════════════════
+
+# §3 铸渊专线V2订阅服务 (大脑服务器 · ZY-SVR-005)
+# 通过 /api/proxy-sub/ 路径访问
+# 实际由 subscription-server-v2.js (port 3803) 处理
+
+location /api/proxy-sub/ {
+    proxy_pass http://127.0.0.1:3803/;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_connect_timeout 10s;
+    proxy_read_timeout 30s;
+    proxy_send_timeout 30s;
+
+    # 订阅服务安全头
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options DENY always;
+    add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+}
diff --git a/server/proxy/config/nginx-proxy-snippet.conf b/server/proxy/config/nginx-proxy-snippet.conf
index 978560f0..628b9e79 100644
--- a/server/proxy/config/nginx-proxy-snippet.conf
+++ b/server/proxy/config/nginx-proxy-snippet.conf
@@ -1,9 +1,12 @@
 # ═══════════════════════════════════════════════
-# 铸渊专线 · Nginx订阅服务反向代理
+# 铸渊专线V1 · 面孔服务器 Nginx订阅服务反向代理
 # 添加到 /etc/nginx/sites-enabled/ 中的主配置
+#
+# ⚠️ 仅用于面孔服务器 (ZY-SVR-002) · V1 · 端口3802
+# ⚠️ 大脑服务器 (ZY-SVR-005) 请使用 nginx-brain-proxy-snippet.conf
 # ═══════════════════════════════════════════════
 
-# §3 铸渊专线订阅服务
+# §3 铸渊专线V1订阅服务 (面孔服务器)
 # 通过主域名的 /api/proxy-sub/ 路径访问
 # 实际由 subscription-server.js (port 3802) 处理
 
diff --git a/server/proxy/deploy-brain-proxy.sh b/server/proxy/deploy-brain-proxy.sh
index 84b56a82..83c49080 100644
--- a/server/proxy/deploy-brain-proxy.sh
+++ b/server/proxy/deploy-brain-proxy.sh
@@ -45,23 +45,23 @@ EOF
 # ── install: 首次完整安装 ─────────────────────
 install() {
     echo ""
-    echo "═══ [1/7] 安装Xray-core + BBR ═══"
+    echo "═══ [1/8] 安装Xray-core + BBR ═══"
     bash "$REPO_PROXY_DIR/setup/install-xray.sh"
 
     echo ""
-    echo "═══ [2/7] 创建V2目录结构 ═══"
+    echo "═══ [2/8] 创建V2目录结构 ═══"
     mkdir -p "$PROXY_DIR"/{config,data,logs,service}
 
     echo ""
-    echo "═══ [3/7] 生成V2密钥 ═══"
+    echo "═══ [3/8] 生成V2密钥 ═══"
     generate_v2_keys
 
     echo ""
-    echo "═══ [4/7] 部署V2服务代码 ═══"
+    echo "═══ [4/8] 部署V2服务代码 ═══"
     deploy_services
 
     echo ""
-    echo "═══ [5/7] 配置Xray ═══"
+    echo "═══ [5/8] 配置Xray ═══"
     ensure_xray_root_user
     mkdir -p "$PROXY_DIR/logs"
     chmod 755 "$PROXY_DIR/logs"
@@ -75,11 +75,15 @@ install() {
     sleep 2
 
     echo ""
-    echo "═══ [6/7] 启动PM2服务 ═══"
+    echo "═══ [6/8] 配置Nginx反向代理 ═══"
+    configure_nginx
+
+    echo ""
+    echo "═══ [7/8] 启动PM2服务 ═══"
     start_pm2_services
 
     echo ""
-    echo "═══ [7/7] 健康检查 ═══"
+    echo "═══ [8/8] 健康检查 ═══"
     health_check
 
     echo ""
@@ -192,6 +196,9 @@ deploy_services() {
     cp "$REPO_PROXY_DIR"/service/vpn-worker.js "$PROXY_DIR/service/"
     cp "$REPO_PROXY_DIR"/ecosystem.brain-proxy.config.js "$PROXY_DIR/"
 
+    # 复制V2 Nginx配置参考
+    cp "$REPO_PROXY_DIR"/config/nginx-brain-proxy-snippet.conf "$PROXY_DIR/config/" 2>/dev/null || true
+
     # 复制共用文件(发邮件等)
     cp "$REPO_PROXY_DIR"/service/send-subscription.js "$PROXY_DIR/service/" 2>/dev/null || true
 
@@ -216,6 +223,108 @@ start_pm2_services() {
     pm2 list
 }
 
+# ── 配置Nginx反向代理 (V2·端口3803) ──────────
+configure_nginx() {
+    # 安装Nginx (如果未安装)
+    if ! command -v nginx &>/dev/null; then
+        echo "  安装Nginx..."
+        apt-get update -qq && apt-get install -y nginx >/dev/null 2>&1
+        systemctl enable nginx
+        echo "  ✅ Nginx已安装"
+    fi
+
+    # 查找Nginx配置文件
+    NGINX_CONF=""
+    for candidate in /etc/nginx/sites-enabled/zhuyuan-brain.conf /etc/nginx/sites-enabled/default; do
+        if [ -f "$candidate" ]; then
+            NGINX_CONF="$candidate"
+            break
+        fi
+    done
+
+    # 如果没有配置文件，创建大脑服务器专用配置
+    if [ -z "$NGINX_CONF" ]; then
+        NGINX_CONF="/etc/nginx/sites-enabled/zhuyuan-brain.conf"
+        echo "  创建大脑服务器Nginx配置..."
+        cat > "$NGINX_CONF" <<'NGINXEOF'
+server {
+    listen 80 default_server;
+    server_name localhost 127.0.0.1;
+
+    # ─── 铸渊专线V2订阅服务 (端口 3803) ───
+    location /api/proxy-sub/ {
+        proxy_pass http://127.0.0.1:3803/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 10s;
+        proxy_read_timeout 30s;
+        proxy_send_timeout 30s;
+        add_header X-Content-Type-Options nosniff always;
+        add_header X-Frame-Options DENY always;
+        add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+    }
+
+    # ─── 健康探针 ───
+    location = /health {
+        return 200 '{"status":"ok","server":"ZY-SVR-005-brain"}';
+        add_header Content-Type application/json;
+    }
+}
+NGINXEOF
+        # 移除默认配置避免冲突
+        if [ -f /etc/nginx/sites-enabled/default ] && [ "$NGINX_CONF" != "/etc/nginx/sites-enabled/default" ]; then
+            rm -f /etc/nginx/sites-enabled/default
+            echo "  ✅ 已移除冲突的default配置"
+        fi
+        echo "  ✅ 已创建大脑服务器Nginx配置"
+    else
+        echo "  使用现有Nginx配置: $NGINX_CONF"
+
+        # 修复端口错误: 如果存在3802端口配置，替换为3803
+        if grep -q "proxy_pass.*127.0.0.1:3802" "$NGINX_CONF" 2>/dev/null; then
+            sed -i 's|proxy_pass http://127.0.0.1:3802/;|proxy_pass http://127.0.0.1:3803/;|g' "$NGINX_CONF"
+            echo "  ✅ 已修复端口: 3802 → 3803"
+        fi
+
+        # 如果没有proxy-sub配置，注入V2配置
+        if ! grep -q "proxy-sub" "$NGINX_CONF" 2>/dev/null; then
+            echo "  添加V2订阅服务反向代理配置..."
+            # 在最后一个 } 之前插入location块
+            sed -i '/^}/i\
+    # ─── 铸渊专线V2订阅服务 (端口 3803) ───\
+    location /api/proxy-sub/ {\
+        proxy_pass http://127.0.0.1:3803/;\
+        proxy_http_version 1.1;\
+        proxy_set_header Host $host;\
+        proxy_set_header X-Real-IP $remote_addr;\
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\
+        proxy_set_header X-Forwarded-Proto $scheme;\
+        proxy_connect_timeout 10s;\
+        proxy_read_timeout 30s;\
+        proxy_send_timeout 30s;\
+        add_header X-Content-Type-Options nosniff always;\
+        add_header X-Frame-Options DENY always;\
+        add_header Cache-Control "no-store, no-cache, must-revalidate" always;\
+    }' "$NGINX_CONF" || true
+            echo "  ✅ V2 proxy-sub配置已注入"
+        else
+            echo "  proxy-sub配置已存在"
+        fi
+    fi
+
+    # 验证并重载Nginx
+    if nginx -t 2>/dev/null; then
+        nginx -s reload || systemctl reload nginx || true
+        echo "  ✅ Nginx配置验证通过并已重载"
+    else
+        echo "  ⚠️ Nginx配置验证失败:"
+        nginx -t 2>&1 || true
+    fi
+}
+
 # ── 健康检查 ──────────────────────────────────
 health_check() {
     echo "检查V2服务状态..."
@@ -243,6 +352,17 @@ health_check() {
         echo "  ❌ V2订阅服务: 端口3803无响应"
     fi
 
+    # Nginx反向代理
+    if systemctl is-active --quiet nginx 2>/dev/null; then
+        if curl -sf http://127.0.0.1:80/api/proxy-sub/health >/dev/null 2>&1; then
+            echo "  ✅ Nginx反代: 正常 (/api/proxy-sub/ → 3803)"
+        else
+            echo "  ⚠️ Nginx反代: /api/proxy-sub/ 无法访问 (检查proxy_pass端口)"
+        fi
+    else
+        echo "  ⚠️ Nginx: 未运行"
+    fi
+
     # PM2
     pm2 list 2>/dev/null || echo "  ⚠️ PM2: 未配置"
 
@@ -276,6 +396,9 @@ update() {
         ufw allow 443/tcp comment "Xray VLESS+Reality V2" 2>/dev/null || true
     fi
 
+    # 修复/更新Nginx反向代理配置
+    configure_nginx
+
     start_pm2_services
     health_check
     echo "✅ V2更新完成"