guanghulab/brain/operations/BS-SG-001/nginx-guanghubingshuo.conf

# ============================================================
# 新加坡 BS-SG-001 Nginx 配置
# 最后更新：2026-06-04 D123
# 路径：/etc/nginx/sites-enabled/guanghubingshuo.com
# ============================================================

# NOTE: sites-enabled 是独立文件，非 sites-available 的符号链接！
# 修改时必须直接编辑 sites-enabled/guanghubingshuo.com

# Outline API 条件路由：按 Referer 来源选择后端
map $http_referer $outline_api_upstream {
    default "http://127.0.0.1:3998";
    "~*outline" "http://127.0.0.1:3090";
}

server {
    listen 80;
    listen 443 ssl http2;
    server_name guanghubingshuo.com www.guanghubingshuo.com;

    ssl_certificate /etc/letsencrypt/live/guanghubingshuo.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/guanghubingshuo.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    root /var/www/html;
    index index.html;

    location = /guanghu-repo/ {
        root /var/www/guanghu-repo;
        try_files /index.html =404;
    }
    location /guanghu-repo/files/ {
        alias /opt/zhuyuan/guanghulab/;
        autoindex on;
        autoindex_exact_size off;
        autoindex_localtime on;
    }
    location /guanghu-repo/api/ {
        proxy_pass http://127.0.0.1:3913/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
    location /native/ { proxy_pass http://127.0.0.1:3913/; }
    location /api/ {
        proxy_pass $outline_api_upstream;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
    location / {
        try_files $uri $uri/ /index.html;
    }
    location /juzi/aircraft/ {
        proxy_pass http://127.0.0.1:8001/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 300s;
    }
    location /juzi/ {
        proxy_pass http://127.0.0.1:3002/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        client_max_body_size 100m;
    }
    location /desk/ {
        proxy_pass http://127.0.0.1:3921/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    location /code/ {
        proxy_pass http://127.0.0.1:3001/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        client_max_body_size 100m;
    }
    # === D123 新增：人格体数据库 ===
    location /brain-db/ {
        proxy_pass http://127.0.0.1:3914/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    # === D123 新增：Dex OIDC 认证 ===
    location /dex/ {
        proxy_pass http://127.0.0.1:5556/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    # === D123 新增：Outline 静态资源 ===
    location /static/ {
        proxy_pass http://127.0.0.1:3090/static/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }
    location /fonts/ {
        proxy_pass http://127.0.0.1:3090/fonts/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }
    # === D123 新增：OIDC 登录跳转（Outline 生成 root-relative 路径） ===
    location /auth/oidc {
        proxy_pass http://127.0.0.1:3090;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 30s;
    }
    # === D123 新增：Outline Wiki ===
    location /outline/ {
        proxy_pass http://127.0.0.1:3090/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        # Outline 默认返回 referrer-policy: no-referrer，导致 Referer 路由失效
        proxy_hide_header referrer-policy;
        add_header referrer-policy "same-origin" always;
        proxy_hide_header service-worker-allowed;
    }
    location /console/ {
        proxy_pass http://127.0.0.1:3920/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400;
    }
    location /hli/ {
        proxy_pass http://127.0.0.1:3010;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 300s;
    }
    # === D140 新增：代码开发 IDE（code-server on :3920）===
    location /ide/ {
        proxy_pass http://127.0.0.1:3920/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 300s;
    }
    # === D142 新增：思源笔记 · 知识库（Docker :6806）===
    location /siyuan/ {
        proxy_pass http://127.0.0.1:6806/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400;
        proxy_send_timeout 300s;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}