105 lines
4.6 KiB
Plaintext
105 lines
4.6 KiB
Plaintext
# ═══════════════════════════════════════════════════════════
|
|
# Awen 域名反向代理配置 · 新加坡中转
|
|
# ═══════════════════════════════════════════════════════════
|
|
#
|
|
# 编号: ZY-SVR-NGX-AWEN
|
|
# 中转服务器: ZY-SVR-002 (43.134.16.246 · 新加坡)
|
|
# 后端服务器: ZY-SVR-AWEN (广州 · Awen实际服务)
|
|
# 守护: 铸渊 · ICE-GL-ZY001
|
|
# 版权: 国作登字-2026-A-00037559
|
|
#
|
|
# 架构:
|
|
# 用户浏览器 → Awen域名(DNS→新加坡IP)
|
|
# → ZY-SVR-002 Nginx(本配置·反向代理)
|
|
# → Awen广州服务器(实际服务)
|
|
#
|
|
# 域名未备案解决方案:
|
|
# 域名DNS A记录指向新加坡IP → 无需中国大陆ICP备案
|
|
# 新加坡Nginx将请求反向代理到广州后端
|
|
# 延迟约30-50ms · 对Web应用可接受
|
|
#
|
|
# 占位符由 deploy workflow 自动替换:
|
|
# AWEN_DOMAIN_PLACEHOLDER ← GitHub Secret: AWEN_DOMAIN
|
|
# AWEN_BACKEND_HOST_PLACEHOLDER ← GitHub Secret: AWEN_BACKEND_HOST
|
|
# AWEN_BACKEND_PORT_PLACEHOLDER ← GitHub Secret: AWEN_BACKEND_PORT
|
|
# ═══════════════════════════════════════════════════════════
|
|
|
|
# ─── Awen 域名 · 反向代理到广州后端 ───
|
|
server {
|
|
listen 80;
|
|
server_name AWEN_DOMAIN_PLACEHOLDER;
|
|
|
|
# ─── 安全头 ───
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header X-Server-Identity "ZY-SVR-002" always;
|
|
add_header X-Proxy-Mode "awen-reverse-proxy" always;
|
|
|
|
# ─── 请求体大小限制 (允许文件上传) ───
|
|
client_max_body_size 50m;
|
|
|
|
# ─── 主路由 · 反向代理到广州后端 ───
|
|
location / {
|
|
proxy_pass http://AWEN_BACKEND_HOST_PLACEHOLDER:AWEN_BACKEND_PORT_PLACEHOLDER;
|
|
proxy_http_version 1.1;
|
|
|
|
# ─── 请求头透传 ───
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
|
|
# ─── WebSocket 支持 ───
|
|
# 使用硬编码 "upgrade" 而非 map 变量，与 zhuyuan-sovereign.conf 保持一致
|
|
# 后端会忽略非 WebSocket 请求的 Connection: upgrade 头
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
# ─── 超时设置 (跨境延迟考虑 · 新加坡↔广州) ───
|
|
proxy_connect_timeout 15s;
|
|
proxy_read_timeout 120s;
|
|
proxy_send_timeout 60s;
|
|
|
|
# ─── 缓冲设置 ───
|
|
proxy_buffering on;
|
|
proxy_buffer_size 16k;
|
|
proxy_buffers 4 32k;
|
|
proxy_busy_buffers_size 64k;
|
|
|
|
# ─── 错误处理 · 后端不可达时返回友好页面 ───
|
|
proxy_intercept_errors on;
|
|
error_page 502 503 504 /awen_backend_unavailable.html;
|
|
}
|
|
|
|
# ─── 健康检查端点 (不记录日志 · 减少噪音) ───
|
|
location = /health {
|
|
proxy_pass http://AWEN_BACKEND_HOST_PLACEHOLDER:AWEN_BACKEND_PORT_PLACEHOLDER/health;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_connect_timeout 5s;
|
|
proxy_read_timeout 10s;
|
|
access_log off;
|
|
}
|
|
|
|
# ─── Let's Encrypt 证书验证路径 ───
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/certbot;
|
|
allow all;
|
|
}
|
|
|
|
# ─── 后端不可达时的友好错误页 ───
|
|
location = /awen_backend_unavailable.html {
|
|
internal;
|
|
default_type text/html;
|
|
return 502 '<!DOCTYPE html><html><head><meta charset="utf-8"><title>Service Temporarily Unavailable</title><style>body{font-family:sans-serif;text-align:center;padding:80px 20px;background:#f7f7f7}h1{color:#333}p{color:#666}</style></head><body><h1>503 Service Temporarily Unavailable</h1><p>The backend server is currently unreachable. Please try again later.</p><p style="font-size:12px;color:#999">Proxy: ZY-SVR-002 (Singapore) → Backend: Guangzhou</p></body></html>';
|
|
}
|
|
|
|
# ─── 访问日志 · 独立文件便于监控 ───
|
|
access_log /opt/zhuyuan/data/logs/nginx-awen-proxy.log;
|
|
error_log /opt/zhuyuan/data/logs/nginx-awen-proxy-error.log;
|
|
}
|
|
|