From 57555a93946b048917259151551feed135f113d8 Mon Sep 17 00:00:00 2001 From: zk Date: Thu, 25 Jun 2026 15:29:39 +0800 Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E6=B5=8B=E8=AF=95=E7=8E=AF?= =?UTF-8?q?=E5=A2=83?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Dockerfile.test | 15 ++++ README.md | 50 ++++++++++++-- docker-compose.test.yml | 25 +++++++ nginx.test.conf | 150 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 234 insertions(+), 6 deletions(-) create mode 100644 Dockerfile.test create mode 100644 docker-compose.test.yml create mode 100644 nginx.test.conf diff --git a/Dockerfile.test b/Dockerfile.test new file mode 100644 index 0000000..04151e8 --- /dev/null +++ b/Dockerfile.test @@ -0,0 +1,15 @@ +FROM nginx:alpine + +# 删除默认配置 +RUN rm /etc/nginx/conf.d/default.conf + +# 复制测试环境配置 +COPY nginx.test.conf /etc/nginx/nginx.conf + +# 复制 SSL 证书（泛域名，与生产共用） +COPY certificate/ /etc/nginx/ssl/ + +# 暴露端口 +EXPOSE 80 443 + +CMD ["nginx", "-g", "daemon off;"] diff --git a/README.md b/README.md index 564955d..98a267b 100644 --- a/README.md +++ b/README.md @@ -2,16 +2,39 @@ 单机部署的全局反向代理服务，统一管理 HTTPS 入口。 +## 环境说明 + +生产与测试是**两台隔离的服务器**，各自部署一套网关。两套配置同仓库、同分支，按文件名区分，证书共用泛域名 `*.offerpai.com.cn`。 + +| 环境 | 配置文件 | 编排文件 | 容器名 | +|------|----------|----------|--------| +| 生产 | `nginx.conf` | `docker-compose.yml` | `global-nginx` | +| 测试 | `nginx.test.conf` | `docker-compose.test.yml` | `global-nginx-test` | + +两套配置除 `server_name`（域名）外完全一致，proxy_pass 都指向本机 `172.17.0.1:端口`，因此各自打到所在服务器的本地服务。 + ## 域名映射 +### 生产环境 + | 域名 | 端口 | 说明 | |------|------|------| | www.offerpai.com.cn | 10302 | OfferPie 前端 | | api.offerpai.com.cn | 10202 | OfferPie Java 后端 API | | ai.offerpai.com.cn | 10502 | OfferPie Python AI 服务 | +### 测试环境 + +| 域名 | 端口 | 说明 | +|------|------|------| +| test.offerpai.com.cn | 10302 | OfferPie 前端 | +| test-api.offerpai.com.cn | 10202 | OfferPie Java 后端 API | +| test-ai.offerpai.com.cn | 10502 | OfferPie Python AI 服务 | + 未匹配的域名或 IP 访问返回 444（直接断开连接）。 +> 注意：测试域名的 DNS 解析需在域名服务商处指向测试服务器 IP，此步骤不在本仓库管理范围内。 + ## 首次部署（Ubuntu 24） ### 1. 更新系统并安装 Docker @@ -69,27 +92,42 @@ git checkout master ### 7. 启动服务 +生产服务器： + ```bash docker compose up -d --build ``` +测试服务器： + +```bash +docker compose -f docker-compose.test.yml up -d --build +``` + ## 日常操作 ### 更新配置 -修改 `nginx.conf` 后重新构建： +修改对应环境的配置文件后重新构建： ```bash +# 生产：修改 nginx.conf 后 docker compose up -d --build + +# 测试：修改 nginx.test.conf 后 +docker compose -f docker-compose.test.yml up -d --build ``` ### 证书更新 -替换 `certificate/` 目录下的证书文件后重新构建。 +替换 `certificate/` 目录下的证书文件后重新构建（两套环境共用同一泛域名证书）。 ## 文件说明 -- `nginx.conf` - Nginx 主配置 -- `dockerfile` - 镜像构建文件 -- `docker-compose.yml` - 容器编排配置 -- `certificate/` - SSL 证书目录 +- `nginx.conf` - 生产环境 Nginx 主配置 +- `nginx.test.conf` - 测试环境 Nginx 主配置（仅域名不同） +- `dockerfile` - 生产镜像构建文件 +- `Dockerfile.test` - 测试镜像构建文件 +- `docker-compose.yml` - 生产容器编排配置 +- `docker-compose.test.yml` - 测试容器编排配置 +- `certificate/` - SSL 证书目录（泛域名，两套环境共用） diff --git a/docker-compose.test.yml b/docker-compose.test.yml new file mode 100644 index 0000000..40d7f36 --- /dev/null +++ b/docker-compose.test.yml @@ -0,0 +1,25 @@ +services: + nginx: + build: + context: . + dockerfile: Dockerfile.test + container_name: global-nginx-test + restart: always + ports: + - "80:80" + - "443:443" + + deploy: + resources: + limits: + cpus: '1' + memory: 512M + reservations: + cpus: '0.25' + memory: 128M + healthcheck: + test: ["CMD", "curl", "-f", "-o", "/dev/null", "-s", "-w", "%{http_code}", "http://localhost/"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 10s diff --git a/nginx.test.conf b/nginx.test.conf new file mode 100644 index 0000000..872b0fd --- /dev/null +++ b/nginx.test.conf @@ -0,0 +1,150 @@ +user nginx; +worker_processes auto; +error_log /var/log/nginx/error.log warn; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; + use epoll; + multi_accept on; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 2048; + + # Gzip 压缩 + gzip on; + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml; + + # 请求体大小限制（支持大文件上传） + client_max_body_size 100m; + + # 请求头缓冲区 + client_header_buffer_size 128m; + large_client_header_buffers 4 128m; + + # WebSocket 支持 + map $http_upgrade $connection_upgrade { + default upgrade; + '' close; + } + + # SSL 通用配置 + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 1d; + + # HTTP 重定向到 HTTPS + server { + listen 80; + server_name _; + return 301 https://$host$request_uri; + } + + # 默认处理：未匹配的域名或 IP 访问返回 444 + server { + listen 443 ssl default_server; + http2 on; + server_name _; + + ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt; + ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key; + + return 444; + } + + # OfferPie 前端（测试） + # test.offerpai.com.cn → 10302 + server { + listen 443 ssl; + http2 on; + server_name test.offerpai.com.cn; + + ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt; + ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key; + + location / { + proxy_pass http://172.17.0.1:10302; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_connect_timeout 300s; + proxy_send_timeout 300s; + proxy_read_timeout 300s; + } + } + + # OfferPie Java 后端 API（测试） + # test-api.offerpai.com.cn → 10202 + server { + listen 443 ssl; + http2 on; + server_name test-api.offerpai.com.cn; + + ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt; + ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key; + + location / { + proxy_pass http://172.17.0.1:10202; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_connect_timeout 300s; + proxy_send_timeout 300s; + proxy_read_timeout 300s; + } + } + + # OfferPie Python AI 服务（测试） + # test-ai.offerpai.com.cn → 10502 + server { + listen 443 ssl; + http2 on; + server_name test-ai.offerpai.com.cn; + + ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt; + ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key; + + location / { + proxy_pass http://172.17.0.1:10502; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + # WebSocket + 流式输出支持 + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + + proxy_buffering off; + proxy_cache off; + + proxy_connect_timeout 300s; + proxy_send_timeout 300s; + proxy_read_timeout 300s; + } + } +}