111 lines
4.8 KiB
Plaintext
111 lines
4.8 KiB
Plaintext
# ═══════════════════════════════════════════════════════════
|
||
# Awen 域名反向代理配置 · 新加坡中转
|
||
# ═══════════════════════════════════════════════════════════
|
||
#
|
||
# 编号: ZY-SVR-NGX-AWEN
|
||
# 中转服务器: ZY-SVR-002 (43.134.16.246 · 新加坡)
|
||
# 后端服务器: ZY-SVR-AWEN (广州 · Awen实际服务)
|
||
# 守护: 铸渊 · ICE-GL-ZY001
|
||
# 版权: 国作登字-2026-A-00037559
|
||
#
|
||
# 架构:
|
||
# 用户浏览器 → Awen域名(DNS→新加坡IP)
|
||
# → ZY-SVR-002 Nginx(本配置·反向代理)
|
||
# → Awen广州服务器(实际服务)
|
||
#
|
||
# 域名未备案解决方案:
|
||
# 域名DNS A记录指向新加坡IP → 无需中国大陆ICP备案
|
||
# 新加坡Nginx将请求反向代理到广州后端
|
||
# 延迟约30-50ms · 对Web应用可接受
|
||
#
|
||
# 占位符由 deploy workflow 自动替换:
|
||
# AWEN_DOMAIN_PLACEHOLDER ← GitHub Secret: AWEN_DOMAIN
|
||
# AWEN_BACKEND_HOST_PLACEHOLDER ← GitHub Secret: AWEN_BACKEND_HOST
|
||
# AWEN_BACKEND_PORT_PLACEHOLDER ← GitHub Secret: AWEN_BACKEND_PORT
|
||
# ═══════════════════════════════════════════════════════════
|
||
|
||
# ─── Awen 域名 · 反向代理到广州后端 ───
|
||
server {
|
||
listen 80;
|
||
server_name AWEN_DOMAIN_PLACEHOLDER;
|
||
|
||
# ─── 安全头 ───
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
add_header X-Server-Identity "ZY-SVR-002" always;
|
||
add_header X-Proxy-Mode "awen-reverse-proxy" always;
|
||
|
||
# ─── 请求体大小限制 (允许文件上传) ───
|
||
client_max_body_size 50m;
|
||
|
||
# ─── 主路由 · 反向代理到广州后端 ───
|
||
location / {
|
||
proxy_pass http://AWEN_BACKEND_HOST_PLACEHOLDER:AWEN_BACKEND_PORT_PLACEHOLDER;
|
||
proxy_http_version 1.1;
|
||
|
||
# ─── 请求头透传 ───
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header X-Forwarded-Host $host;
|
||
|
||
# ─── WebSocket 支持 ───
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection $connection_upgrade;
|
||
|
||
# ─── 超时设置 (跨境延迟考虑 · 新加坡↔广州) ───
|
||
proxy_connect_timeout 15s;
|
||
proxy_read_timeout 120s;
|
||
proxy_send_timeout 60s;
|
||
|
||
# ─── 缓冲设置 ───
|
||
proxy_buffering on;
|
||
proxy_buffer_size 16k;
|
||
proxy_buffers 4 32k;
|
||
proxy_busy_buffers_size 64k;
|
||
|
||
# ─── 错误处理 · 后端不可达时返回友好页面 ───
|
||
proxy_intercept_errors on;
|
||
error_page 502 503 504 /awen_backend_unavailable.html;
|
||
}
|
||
|
||
# ─── 健康检查端点 (不记录日志 · 减少噪音) ───
|
||
location = /health {
|
||
proxy_pass http://AWEN_BACKEND_HOST_PLACEHOLDER:AWEN_BACKEND_PORT_PLACEHOLDER/health;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_connect_timeout 5s;
|
||
proxy_read_timeout 10s;
|
||
access_log off;
|
||
}
|
||
|
||
# ─── Let's Encrypt 证书验证路径 ───
|
||
location /.well-known/acme-challenge/ {
|
||
root /var/www/certbot;
|
||
allow all;
|
||
}
|
||
|
||
# ─── 后端不可达时的友好错误页 ───
|
||
location = /awen_backend_unavailable.html {
|
||
internal;
|
||
default_type text/html;
|
||
return 502 '<!DOCTYPE html><html><head><meta charset="utf-8"><title>Service Temporarily Unavailable</title><style>body{font-family:sans-serif;text-align:center;padding:80px 20px;background:#f7f7f7}h1{color:#333}p{color:#666}</style></head><body><h1>503 Service Temporarily Unavailable</h1><p>The backend server is currently unreachable. Please try again later.</p><p style="font-size:12px;color:#999">Proxy: ZY-SVR-002 (Singapore) → Backend: Guangzhou</p></body></html>';
|
||
}
|
||
|
||
# ─── 访问日志 · 独立文件便于监控 ───
|
||
access_log /opt/zhuyuan/data/logs/nginx-awen-proxy.log;
|
||
error_log /opt/zhuyuan/data/logs/nginx-awen-proxy-error.log;
|
||
}
|
||
|
||
# ─── WebSocket 升级映射 ───
|
||
# 注意: 此 map 块必须位于 http {} 上下文 (不在 server {} 内)
|
||
# 如果 nginx.conf 或其他配置文件已定义 $connection_upgrade，
|
||
# 部署 workflow 会自动检测并移除本段避免冲突
|
||
map $http_upgrade $connection_upgrade {
|
||
default upgrade;
|
||
'' close;
|
||
}
|