|
|
@@ -0,0 +1,448 @@
|
|
|
+user root;
|
|
|
+worker_processes auto;
|
|
|
+
|
|
|
+events {
|
|
|
+ worker_connections 8192;
|
|
|
+ use epoll;
|
|
|
+ multi_accept on;
|
|
|
+}
|
|
|
+
|
|
|
+http {
|
|
|
+ include mime.types;
|
|
|
+ default_type application/octet-stream;
|
|
|
+ charset utf-8;
|
|
|
+
|
|
|
+ sendfile on;
|
|
|
+ tcp_nopush on;
|
|
|
+ tcp_nodelay on;
|
|
|
+ keepalive_timeout 65;
|
|
|
+ types_hash_max_size 2048;
|
|
|
+ server_tokens off;
|
|
|
+
|
|
|
+ # 全局 gzip
|
|
|
+ gzip on;
|
|
|
+ gzip_vary on;
|
|
|
+ gzip_min_length 1024;
|
|
|
+ gzip_proxied any;
|
|
|
+ gzip_comp_level 6;
|
|
|
+ gzip_types
|
|
|
+ text/plain
|
|
|
+ text/css
|
|
|
+ text/js
|
|
|
+ text/xml
|
|
|
+ text/javascript
|
|
|
+ application/javascript
|
|
|
+ application/xml+rss
|
|
|
+ application/json
|
|
|
+ image/svg+xml;
|
|
|
+
|
|
|
+# =========================
|
|
|
+ # ZKXW 管理端（测试环境 8112）
|
|
|
+ # 静态目录: /root/zkxw/dist
|
|
|
+ # API 反代: 47.99.164.66:8112
|
|
|
+ # =========================
|
|
|
+ server {
|
|
|
+ listen 8112;
|
|
|
+ listen [::]:8112;
|
|
|
+ server_name 47.121.120.79 localhost 127.0.0.1;
|
|
|
+
|
|
|
+ root /root/zkxw/dist;
|
|
|
+ index index.html;
|
|
|
+
|
|
|
+ client_max_body_size 100M;
|
|
|
+
|
|
|
+ access_log /var/log/nginx/zkxw_admin_8112_access.log;
|
|
|
+ error_log /var/log/nginx/zkxw_admin_8112_error.log;
|
|
|
+
|
|
|
+ # 健康检查 / Swagger（须在 location / 之前；否则 /health 会走 SPA 返回 index.html）
|
|
|
+ location = /health {
|
|
|
+ proxy_pass http://47.99.164.66:8112/health;
|
|
|
+ proxy_http_version 1.1;
|
|
|
+ proxy_set_header Host $host;
|
|
|
+ proxy_connect_timeout 10s;
|
|
|
+ proxy_read_timeout 30s;
|
|
|
+ }
|
|
|
+
|
|
|
+ location ^~ /docs {
|
|
|
+ proxy_pass http://47.99.164.66:8112;
|
|
|
+ proxy_http_version 1.1;
|
|
|
+ proxy_set_header Host $host;
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
+ }
|
|
|
+
|
|
|
+ location = /openapi.json {
|
|
|
+ proxy_pass http://47.99.164.66:8112/openapi.json;
|
|
|
+ proxy_http_version 1.1;
|
|
|
+ proxy_set_header Host $host;
|
|
|
+ }
|
|
|
+
|
|
|
+ # API -> 测试后端（47.99.164.66:8112）
|
|
|
+ location ^~ /api/ {
|
|
|
+ proxy_pass http://47.99.164.66:8112;
|
|
|
+ proxy_http_version 1.1;
|
|
|
+ proxy_set_header Host $host;
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
+ proxy_connect_timeout 10s;
|
|
|
+ proxy_send_timeout 120s;
|
|
|
+ proxy_read_timeout 120s;
|
|
|
+ }
|
|
|
+
|
|
|
+ # MinIO 附件直链（bucket=zkxw；端口与后端 MINIO_ENDPOINT 映射一致，默认 20003）
|
|
|
+ location ^~ /minio/zkxw/ {
|
|
|
+ proxy_pass http://47.99.164.66:20003/zkxw/;
|
|
|
+ proxy_http_version 1.1;
|
|
|
+ proxy_set_header Host $http_host;
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
+ proxy_request_buffering off;
|
|
|
+ proxy_buffering off;
|
|
|
+ proxy_read_timeout 600s;
|
|
|
+ proxy_send_timeout 600s;
|
|
|
+ proxy_connect_timeout 10s;
|
|
|
+
|
|
|
+ add_header Access-Control-Allow-Origin * always;
|
|
|
+ add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
|
|
+ add_header Access-Control-Allow-Headers "DNT,User-Agent,Keep-Alive,Content-Type,Authorization,Range,If-Modified-Since,Cache-Control" always;
|
|
|
+
|
|
|
+ if ($request_method = OPTIONS) {
|
|
|
+ add_header Content-Length 0;
|
|
|
+ add_header Content-Type text/plain;
|
|
|
+ return 204;
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ # SPA 路由（放最后，避免吞掉 /health、/api 等）
|
|
|
+ location / {
|
|
|
+ try_files $uri $uri/ /index.html;
|
|
|
+ }
|
|
|
+
|
|
|
+ # 静态资源缓存
|
|
|
+ location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
|
|
+ expires 30d;
|
|
|
+ add_header Cache-Control "public, immutable" always;
|
|
|
+ add_header X-Content-Type-Options nosniff always;
|
|
|
+ access_log off;
|
|
|
+ }
|
|
|
+
|
|
|
+ # HTML 禁缓存，便于发版后立刻生效
|
|
|
+ location ~* \.html$ {
|
|
|
+ add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
|
|
+ add_header Pragma "no-cache" always;
|
|
|
+ add_header Expires "0" always;
|
|
|
+ }
|
|
|
+
|
|
|
+ # 禁止访问隐藏文件
|
|
|
+ location ~ /\. {
|
|
|
+ deny all;
|
|
|
+ access_log off;
|
|
|
+ log_not_found off;
|
|
|
+ }
|
|
|
+ }
|
|
|
+ # =========================
|
|
|
+ # SQXP Admin 静态服务（本机 3006）
|
|
|
+ # =========================
|
|
|
+ server {
|
|
|
+ listen 3006;
|
|
|
+ listen [::]:3006;
|
|
|
+ server_name 127.0.0.1 localhost 47.121.120.79;
|
|
|
+
|
|
|
+ root /root/sqxp-dist/dist;
|
|
|
+ index index.html;
|
|
|
+
|
|
|
+ access_log /var/log/nginx/sqxp_admin_3006_access.log;
|
|
|
+ error_log /var/log/nginx/sqxp_admin_3006_error.log;
|
|
|
+
|
|
|
+ # SPA 路由支持
|
|
|
+ location / {
|
|
|
+ try_files $uri $uri/ /index.html;
|
|
|
+ }
|
|
|
+
|
|
|
+ # 静态资源缓存
|
|
|
+ location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
|
|
+ expires 30d;
|
|
|
+ add_header Cache-Control "public, immutable" always;
|
|
|
+ add_header X-Content-Type-Options nosniff always;
|
|
|
+ access_log off;
|
|
|
+ }
|
|
|
+
|
|
|
+ # HTML 禁缓存，便于发版后立刻生效
|
|
|
+ location ~* \.html$ {
|
|
|
+ add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
|
|
+ add_header Pragma "no-cache" always;
|
|
|
+ add_header Expires "0" always;
|
|
|
+ }
|
|
|
+
|
|
|
+ # 禁止访问隐藏文件
|
|
|
+ location ~ /\. {
|
|
|
+ deny all;
|
|
|
+ access_log off;
|
|
|
+ log_not_found off;
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ # =========================
|
|
|
+ # 主站：https://www.chengyantek.cn
|
|
|
+ # =========================
|
|
|
+ server {
|
|
|
+ listen 443 ssl http2;
|
|
|
+ listen [::]:443 ssl http2;
|
|
|
+ server_name www.chengyantek.cn;
|
|
|
+
|
|
|
+ ssl_certificate "/root/cert/www.chengyantek.cn.pem";
|
|
|
+ ssl_certificate_key "/root/cert/www.chengyantek.cn.key";
|
|
|
+
|
|
|
+ ssl_session_cache shared:SSL:10m;
|
|
|
+ ssl_session_timeout 1h;
|
|
|
+ ssl_protocols TLSv1.2 TLSv1.3;
|
|
|
+ ssl_ciphers HIGH:!aNULL:!MD5;
|
|
|
+ ssl_prefer_server_ciphers on;
|
|
|
+
|
|
|
+ access_log /var/log/nginx/ahchengyan_access.log;
|
|
|
+ error_log /var/log/nginx/ahchengyan_error.log;
|
|
|
+
|
|
|
+ client_max_body_size 100M;
|
|
|
+
|
|
|
+ # =========================
|
|
|
+ # SQXP Admin 外部访问入口
|
|
|
+ # =========================
|
|
|
+ location ^~ /sqxp-admin/ {
|
|
|
+ proxy_pass http://127.0.0.1:3006/;
|
|
|
+ proxy_http_version 1.1;
|
|
|
+ proxy_set_header Host $host;
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
+ proxy_connect_timeout 10s;
|
|
|
+ proxy_send_timeout 60s;
|
|
|
+ proxy_read_timeout 60s;
|
|
|
+ }
|
|
|
+
|
|
|
+ # =========================
|
|
|
+ # SQXP API 同域代理 -> 47.99.164.66:8000/api
|
|
|
+ # 前端请求 /sqxp-api/web/... -> 后端 /api/web/...
|
|
|
+ # =========================
|
|
|
+ location ^~ /sqxp-api/ {
|
|
|
+ proxy_pass http://47.99.164.66:8000/api/;
|
|
|
+ proxy_http_version 1.1;
|
|
|
+ proxy_set_header Host $host;
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
+ proxy_connect_timeout 10s;
|
|
|
+ proxy_send_timeout 60s;
|
|
|
+ proxy_read_timeout 60s;
|
|
|
+ }
|
|
|
+
|
|
|
+ # 直接把 bucket 路径代理到 MinIO（bucket= sanqiang）
|
|
|
+ location ^~ /sanqiang/ {
|
|
|
+ proxy_pass http://127.0.0.1:20004/sanqiang/;
|
|
|
+ proxy_http_version 1.1;
|
|
|
+
|
|
|
+ proxy_set_header Host $http_host;
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ proxy_set_header X-Forwarded-Proto https;
|
|
|
+
|
|
|
+ proxy_request_buffering off;
|
|
|
+ proxy_buffering off;
|
|
|
+ proxy_read_timeout 600s;
|
|
|
+ proxy_send_timeout 600s;
|
|
|
+ proxy_connect_timeout 10s;
|
|
|
+ }
|
|
|
+
|
|
|
+ # ===== MinIO 直链访问（新增，推荐）=====
|
|
|
+ location ^~ /minio/ {
|
|
|
+ proxy_pass http://127.0.0.1:20004/;
|
|
|
+ proxy_http_version 1.1;
|
|
|
+
|
|
|
+ proxy_set_header Host $http_host;
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ proxy_set_header X-Forwarded-Proto https;
|
|
|
+
|
|
|
+ proxy_request_buffering off;
|
|
|
+ proxy_buffering off;
|
|
|
+ proxy_read_timeout 600s;
|
|
|
+ proxy_send_timeout 600s;
|
|
|
+ proxy_connect_timeout 10s;
|
|
|
+
|
|
|
+ add_header Access-Control-Allow-Origin * always;
|
|
|
+ add_header Access-Control-Allow-Methods "GET, PUT, POST, DELETE, HEAD, OPTIONS" always;
|
|
|
+ add_header Access-Control-Allow-Headers "Authorization,Content-Type,Content-Length,Content-MD5,Date,ETag,Range,X-Amz-Date,X-Amz-Conte
|
|
|
+nt-Sha256,X-Amz-Security-Token,X-Amz-User-Agent" always;
|
|
|
+ add_header Access-Control-Expose-Headers "ETag,Content-Length,Content-Range,Accept-Ranges,x-amz-request-id,x-amz-id-2" always;
|
|
|
+
|
|
|
+ if ($request_method = OPTIONS) {
|
|
|
+ add_header Content-Length 0;
|
|
|
+ add_header Content-Type text/plain;
|
|
|
+ return 204;
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ # ===== 小程序静态资源 =====
|
|
|
+ location ^~ /sqxp-static/ {
|
|
|
+ alias /root/sqxp/;
|
|
|
+ access_log off;
|
|
|
+
|
|
|
+ if ($request_method = OPTIONS) {
|
|
|
+ add_header Access-Control-Allow-Origin * always;
|
|
|
+ add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
|
|
+ add_header Access-Control-Allow-Headers "DNT,User-Agent,Keep-Alive,Content-Type,Authorization,Range,If-Modified-Since,Cache-Contr
|
|
|
+ol" always;
|
|
|
+ add_header Access-Control-Max-Age 86400 always;
|
|
|
+ add_header Content-Length 0;
|
|
|
+ add_header Content-Type text/plain;
|
|
|
+ return 204;
|
|
|
+ }
|
|
|
+
|
|
|
+ add_header Access-Control-Allow-Origin * always;
|
|
|
+ add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
|
|
+ add_header Access-Control-Allow-Headers "DNT,User-Agent,Keep-Alive,Content-Type,Authorization,Range,If-Modified-Since,Cache-Control"
|
|
|
+always;
|
|
|
+
|
|
|
+ expires 30d;
|
|
|
+ add_header Cache-Control "public";
|
|
|
+ add_header Vary "Accept-Encoding";
|
|
|
+
|
|
|
+ try_files $uri =404;
|
|
|
+ }
|
|
|
+
|
|
|
+ # favicon
|
|
|
+ location = /favicon.ico {
|
|
|
+ root /root/Lyrria/frontend/dist;
|
|
|
+ access_log off;
|
|
|
+ log_not_found off;
|
|
|
+ expires 1y;
|
|
|
+ add_header Cache-Control "public, immutable";
|
|
|
+ }
|
|
|
+
|
|
|
+ # robots
|
|
|
+ location = /robots.txt {
|
|
|
+ access_log off;
|
|
|
+ log_not_found off;
|
|
|
+ return 200 "User-agent: *\nDisallow:\n";
|
|
|
+ }
|
|
|
+
|
|
|
+ # WebSocket 代理
|
|
|
+ location /ws {
|
|
|
+ proxy_pass http://127.0.0.1:8766;
|
|
|
+ proxy_http_version 1.1;
|
|
|
+ proxy_set_header Upgrade $http_upgrade;
|
|
|
+ proxy_set_header Connection "upgrade";
|
|
|
+ proxy_set_header Host $host;
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
+ proxy_read_timeout 3600s;
|
|
|
+ proxy_send_timeout 3600s;
|
|
|
+ proxy_connect_timeout 10s;
|
|
|
+ }
|
|
|
+
|
|
|
+ # API 代理（Lyrria）
|
|
|
+ location ^~ /api/ {
|
|
|
+ proxy_pass http://127.0.0.1:8766$request_uri;
|
|
|
+ proxy_set_header Host $host;
|
|
|
+ proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
+ proxy_read_timeout 60s;
|
|
|
+ proxy_send_timeout 60s;
|
|
|
+ proxy_connect_timeout 10s;
|
|
|
+ }
|
|
|
+
|
|
|
+ # 主站静态资源缓存（Lyrria）
|
|
|
+ location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
|
|
+ root /root/Lyrria/frontend/dist;
|
|
|
+ expires 30d;
|
|
|
+ add_header Cache-Control "public, immutable" always;
|
|
|
+ add_header X-Content-Type-Options nosniff always;
|
|
|
+ }
|
|
|
+
|
|
|
+ # SPA 路由支持（Lyrria）
|
|
|
+ location / {
|
|
|
+ root /root/Lyrria/frontend/dist;
|
|
|
+ index index.html;
|
|
|
+ try_files $uri $uri/ /index.html;
|
|
|
+
|
|
|
+ add_header X-Frame-Options "SAMEORIGIN" always;
|
|
|
+ add_header X-Content-Type-Options "nosniff" always;
|
|
|
+ add_header X-XSS-Protection "1; mode=block" always;
|
|
|
+ }
|
|
|
+
|
|
|
+ # HTML 不缓存
|
|
|
+ location ~* \.html$ {
|
|
|
+ root /root/Lyrria/frontend/dist;
|
|
|
+ add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
|
|
+ add_header Pragma "no-cache" always;
|
|
|
+ add_header Expires "0" always;
|
|
|
+ try_files $uri =404;
|
|
|
+ }
|
|
|
+
|
|
|
+ # 禁止访问隐藏文件
|
|
|
+ location ~ /\. {
|
|
|
+ deny all;
|
|
|
+ access_log off;
|
|
|
+ log_not_found off;
|
|
|
+ }
|
|
|
+
|
|
|
+ location ~ ~$ {
|
|
|
+ deny all;
|
|
|
+ access_log off;
|
|
|
+ log_not_found off;
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ # 非www在443跳转到www
|
|
|
+ server {
|
|
|
+ listen 443 ssl http2;
|
|
|
+ listen [::]:443 ssl http2;
|
|
|
+ server_name chengyantek.cn;
|
|
|
+
|
|
|
+ ssl_certificate "/root/cert/www.chengyantek.cn.pem";
|
|
|
+ ssl_certificate_key "/root/cert/www.chengyantek.cn.key";
|
|
|
+
|
|
|
+ return 301 https://www.chengyantek.cn$request_uri;
|
|
|
+ }
|
|
|
+
|
|
|
+ # =========================
|
|
|
+ # 未来如果给 img.chengyantek.cn 单独申请好证书，再加这个 server
|
|
|
+ # =========================
|
|
|
+ # server {
|
|
|
+ # listen 443 ssl http2;
|
|
|
+ # listen [::]:443 ssl http2;
|
|
|
+ # server_name img.chengyantek.cn;
|
|
|
+ #
|
|
|
+ # ssl_certificate "/root/.acme.sh/img.chengyantek.cn_ecc/fullchain.cer";
|
|
|
+ # ssl_certificate_key "/root/.acme.sh/img.chengyantek.cn_ecc/img.chengyantek.cn.key";
|
|
|
+ #
|
|
|
+ # ssl_session_cache shared:SSL:10m;
|
|
|
+ # ssl_session_timeout 1h;
|
|
|
+ # ssl_protocols TLSv1.2 TLSv1.3;
|
|
|
+ # ssl_ciphers HIGH:!aNULL:!MD5;
|
|
|
+ # ssl_prefer_server_ciphers on;
|
|
|
+ #
|
|
|
+ # access_log /var/log/nginx/minio_img_access.log;
|
|
|
+ # error_log /var/log/nginx/minio_img_error.log;
|
|
|
+ #
|
|
|
+ # client_max_body_size 100M;
|
|
|
+ #
|
|
|
+ # location / {
|
|
|
+ # proxy_pass http://127.0.0.1:20004;
|
|
|
+ # proxy_http_version 1.1;
|
|
|
+ # proxy_set_header Host $http_host;
|
|
|
+ # proxy_set_header X-Real-IP $remote_addr;
|
|
|
+ # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
+ # proxy_set_header X-Forwarded-Proto https;
|
|
|
+ # proxy_request_buffering off;
|
|
|
+ # proxy_buffering off;
|
|
|
+ # proxy_read_timeout 600s;
|
|
|
+ # proxy_send_timeout 600s;
|
|
|
+ # proxy_connect_timeout 10s;
|
|
|
+ # }
|
|
|
+ # }
|
|
|
+}
|
