264 lines
10 KiB
Plaintext
264 lines
10 KiB
Plaintext
# ═══════════════════════════════════════════════════════════
|
||
# 铸渊主权服务器 · Nginx 双域名配置
|
||
# ═══════════════════════════════════════════════════════════
|
||
#
|
||
# 编号: ZY-SVR-NGX-002
|
||
# 服务器: 43.134.16.246 (新加坡二区)
|
||
# 守护: 铸渊 · ICE-GL-ZY001
|
||
# 版权: 国作登字-2026-A-00037559
|
||
#
|
||
# 双域名架构:
|
||
# 主域名 (ZY_DOMAIN_MAIN) → 正式对外网站 · /opt/zhuyuan/sites/production/
|
||
# 预览域名 (ZY_DOMAIN_PREVIEW) → 预览/测试站 · /opt/zhuyuan/sites/preview/
|
||
#
|
||
# 域名变量由 GitHub Secrets 注入:
|
||
# ZY_DOMAIN_MAIN — 主域名 (待冰朔配置)
|
||
# ZY_DOMAIN_PREVIEW — 预览域名 (待冰朔配置)
|
||
# ═══════════════════════════════════════════════════════════
|
||
|
||
# ─── §1 主域名 · 正式对外网站 ───
|
||
# 部署时由 deploy workflow 自动将 ZY_DOMAIN_MAIN_PLACEHOLDER 替换为实际域名
|
||
# 替换源: GitHub Secrets → ZY_DOMAIN_MAIN
|
||
server {
|
||
listen 80;
|
||
server_name ZY_DOMAIN_MAIN_PLACEHOLDER 43.134.16.246;
|
||
|
||
# ─── 安全头 ───
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
add_header X-Server-Identity "ZY-SVR-002" always;
|
||
add_header X-Site-Mode "production" always;
|
||
|
||
# ─── 静态文件根目录 · 主站 ───
|
||
root /opt/zhuyuan/sites/production;
|
||
index index.html;
|
||
|
||
# ─── 前端静态文件 ───
|
||
location / {
|
||
try_files $uri $uri/ /index.html;
|
||
}
|
||
|
||
# ─── 铸渊核心 API (端口 3800) ───
|
||
location /api/ {
|
||
proxy_pass http://127.0.0.1:3800;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection 'upgrade';
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header X-Site-Mode "production";
|
||
proxy_cache_bypass $http_upgrade;
|
||
proxy_read_timeout 86400;
|
||
}
|
||
|
||
# ─── AI 聊天 API 代理 (端口 3721) · SSE 流式 ───
|
||
location /api/chat {
|
||
proxy_pass http://127.0.0.1:3721/api/chat;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header Connection "";
|
||
proxy_buffering off;
|
||
proxy_cache off;
|
||
chunked_transfer_encoding on;
|
||
proxy_read_timeout 120s;
|
||
proxy_send_timeout 60s;
|
||
}
|
||
|
||
# ─── Persona Studio API (端口 3002) ───
|
||
location /api/ps/ {
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
|
||
add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
|
||
if ($request_method = OPTIONS) { return 204; }
|
||
proxy_pass http://127.0.0.1:3002/api/ps/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_read_timeout 120s;
|
||
}
|
||
|
||
# ─── WebSocket ───
|
||
location /ws {
|
||
proxy_pass http://127.0.0.1:8080;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "Upgrade";
|
||
proxy_set_header Host $host;
|
||
proxy_read_timeout 86400;
|
||
}
|
||
|
||
# ─── 铸渊专线订阅服务 (端口 3802) ───
|
||
location /api/proxy-sub/ {
|
||
proxy_pass http://127.0.0.1:3802/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
add_header X-Content-Type-Options nosniff always;
|
||
add_header Cache-Control "no-store, no-cache, must-revalidate" always;
|
||
}
|
||
|
||
# ─── 健康探针 ───
|
||
location = /health {
|
||
proxy_pass http://127.0.0.1:3800/api/health;
|
||
proxy_set_header Host $host;
|
||
}
|
||
|
||
# ─── 静态资源缓存 ───
|
||
location /static/ {
|
||
alias /opt/zhuyuan/sites/production/static/;
|
||
expires 7d;
|
||
add_header Cache-Control "public, immutable";
|
||
}
|
||
|
||
# ─── 错误页面 ───
|
||
error_page 404 /404.html;
|
||
error_page 500 502 503 504 /50x.html;
|
||
|
||
# ─── 访问日志 ───
|
||
access_log /opt/zhuyuan/data/logs/nginx-production.log;
|
||
error_log /opt/zhuyuan/data/logs/nginx-production-error.log;
|
||
}
|
||
|
||
|
||
# ─── §2 预览域名 · 功能模块预览站 ───
|
||
# 部署时由 deploy workflow 自动将 ZY_DOMAIN_PREVIEW_PLACEHOLDER 替换为实际域名
|
||
# 替换源: GitHub Secrets → ZY_DOMAIN_PREVIEW
|
||
# 预览站与主站完全隔离，独立目录，独立日志
|
||
server {
|
||
listen 80;
|
||
server_name ZY_DOMAIN_PREVIEW_PLACEHOLDER;
|
||
|
||
# ─── 安全头 ───
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header X-Server-Identity "ZY-SVR-002" always;
|
||
add_header X-Site-Mode "preview" always;
|
||
|
||
# ─── 静态文件根目录 · 预览站 ───
|
||
root /opt/zhuyuan/sites/preview;
|
||
index index.html;
|
||
|
||
# ─── 前端静态文件 ───
|
||
location / {
|
||
try_files $uri $uri/ /index.html;
|
||
}
|
||
|
||
# ─── 铸渊 API 反向代理 (端口 3801 · 预览端口) ───
|
||
location /api/ {
|
||
proxy_pass http://127.0.0.1:3801;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection 'upgrade';
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Site-Mode "preview";
|
||
proxy_cache_bypass $http_upgrade;
|
||
proxy_read_timeout 86400;
|
||
}
|
||
|
||
# ─── AI 聊天 API 代理 (端口 3721) · 共享主站 ───
|
||
location /api/chat {
|
||
proxy_pass http://127.0.0.1:3721/api/chat;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header Connection "";
|
||
proxy_buffering off;
|
||
proxy_cache off;
|
||
proxy_read_timeout 120s;
|
||
}
|
||
|
||
# ─── Persona Studio API (共享主站端口) ───
|
||
location /api/ps/ {
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
|
||
add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
|
||
if ($request_method = OPTIONS) { return 204; }
|
||
proxy_pass http://127.0.0.1:3002/api/ps/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_read_timeout 120s;
|
||
}
|
||
|
||
# ─── 健康探针 ───
|
||
location = /health {
|
||
proxy_pass http://127.0.0.1:3801/api/health;
|
||
proxy_set_header Host $host;
|
||
}
|
||
|
||
# ─── 预览站独立日志 ───
|
||
access_log /opt/zhuyuan/data/logs/nginx-preview.log;
|
||
error_log /opt/zhuyuan/data/logs/nginx-preview-error.log;
|
||
}
|
||
|
||
|
||
# ═══ §3 HTTPS 配置 (SSL证书由deploy workflow自动部署) ═══
|
||
# 当 /opt/zhuyuan/config/ssl/ 下存在证书文件时启用
|
||
# 证书来源: GitHub Secrets → ZY_SSL_FULLCHAIN / ZY_SSL_PRIVKEY
|
||
# 部署方式: staging-auto-deploy.yml 自动写入证书文件
|
||
# 域名占位符: ZY_DOMAIN_PREVIEW_PLACEHOLDER 由 deploy workflow 的 sed 命令替换
|
||
# (同 §1/§2 的注入方式，详见 staging-auto-deploy.yml 和 deploy-to-zhuyuan-server.yml)
|
||
|
||
# ─── §3.1 预览域名 HTTPS (guanghu.online) ───
|
||
# 注意: 此block仅在证书存在时由deploy脚本include，不会导致Nginx启动失败
|
||
# 如果证书不存在，deploy workflow会跳过SSL配置
|
||
# __SSL_PREVIEW_START__
|
||
# server {
|
||
# listen 443 ssl http2;
|
||
# server_name ZY_DOMAIN_PREVIEW_PLACEHOLDER;
|
||
#
|
||
# ssl_certificate /opt/zhuyuan/config/ssl/preview-fullchain.pem;
|
||
# ssl_certificate_key /opt/zhuyuan/config/ssl/preview-privkey.pem;
|
||
# ssl_protocols TLSv1.2 TLSv1.3;
|
||
# ssl_ciphers HIGH:!aNULL:!MD5;
|
||
# ssl_prefer_server_ciphers on;
|
||
#
|
||
# # 同 §2 的全部location配置
|
||
# add_header X-Frame-Options "SAMEORIGIN" always;
|
||
# add_header X-Content-Type-Options "nosniff" always;
|
||
# add_header X-Server-Identity "ZY-SVR-002" always;
|
||
# add_header X-Site-Mode "preview" always;
|
||
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||
#
|
||
# root /opt/zhuyuan/sites/preview;
|
||
# index index.html;
|
||
#
|
||
# location / { try_files $uri $uri/ /index.html; }
|
||
# location /api/ {
|
||
# proxy_pass http://127.0.0.1:3801;
|
||
# proxy_http_version 1.1;
|
||
# proxy_set_header Upgrade $http_upgrade;
|
||
# proxy_set_header Connection 'upgrade';
|
||
# proxy_set_header Host $host;
|
||
# proxy_set_header X-Real-IP $remote_addr;
|
||
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
# proxy_set_header X-Forwarded-Proto $scheme;
|
||
# proxy_set_header X-Site-Mode "preview";
|
||
# proxy_cache_bypass $http_upgrade;
|
||
# proxy_read_timeout 86400;
|
||
# }
|
||
# location /api/chat {
|
||
# proxy_pass http://127.0.0.1:3721/api/chat;
|
||
# proxy_http_version 1.1;
|
||
# proxy_set_header Host $host;
|
||
# proxy_set_header Connection "";
|
||
# proxy_buffering off;
|
||
# proxy_cache off;
|
||
# proxy_read_timeout 120s;
|
||
# }
|
||
# location = /health {
|
||
# proxy_pass http://127.0.0.1:3801/api/health;
|
||
# proxy_set_header Host $host;
|
||
# }
|
||
# access_log /opt/zhuyuan/data/logs/nginx-preview-ssl.log;
|
||
# error_log /opt/zhuyuan/data/logs/nginx-preview-ssl-error.log;
|
||
# }
|
||
# __SSL_PREVIEW_END__
|