初始化，创建nginx 相关配置

2026-05-27 11:26:22 +08:00
commit bc4c3200d9
7 changed files with 290 additions and 0 deletions
@@ -0,0 +1,9 @@
+# IDE
+.idea/
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log
@@ -0,0 +1,38 @@
+# OfferPie 全局 Nginx 网关
+
+单机部署的全局反向代理服务，统一管理 HTTPS 入口。
+
+## 域名映射
+
+| 域名 | 端口 | 说明 |
+|------|------|------|
+| www.offerpai.com.cn | 10302 | OfferPie 前端 |
+| api.offerpai.com.cn | 10202 | OfferPie Java 后端 API |
+| ai.offerpai.com.cn | 10502 | OfferPie Python AI 服务 |
+
+未匹配的域名或 IP 访问返回 444（直接断开连接）。
+
+## 部署
+
+```bash
+docker-compose up -d --build
+```
+
+## 更新配置
+
+修改 `nginx.conf` 后重新构建：
+
+```bash
+docker-compose up -d --build
+```
+
+## 证书更新
+
+替换 `certificate/` 目录下的证书文件后重新构建。
+
+## 文件说明
+
+- `nginx.conf` - Nginx 主配置
+- `dockerfile` - 镜像构建文件
+- `docker-compose.yml` - 容器编排配置
+- `certificate/` - SSL 证书目录
@@ -0,0 +1,49 @@
+-----BEGIN CERTIFICATE-----
+MIIDnTCCAyKgAwIBAgISBVWuRhhOaiBkuQnFxKyCJDMFMAoGCCqGSM49BAMDMDIx
+CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
+NzAeFw0yNjA1MjIxMDI2MjRaFw0yNjA4MjAxMDI2MjNaMBoxGDAWBgNVBAMTD29m
+ZmVycGFpLmNvbS5jbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFf/rMowrqMf
+sD6s2QBnj3uT2CjxxjQkVnuKXGlV8QCQvLhCNiPqyVaXhwQRnW4/A4DDygQ0SjG
+7S3qKPBrCXCjggIuMIICKjAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYB
+BQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUMUW5y29bkHDb++PS0DfpFe/k
+ubYwHwYDVR0jBBgwFoAUrkie3IcdRKBv2qLlYHQEeMKcAIAwMgYIKwYBBQUHAQEE
+JjAkMCIGCCsGAQUFBzAChhZodHRwOi8vZTcuaS5sZW5jci5vcmcvMC0GA1UdEQQm
+MCSCESoub2ZmZXJwYWkuY29tLmNugg9vZmZlcnBhaS5jb20uY24wEwYDVR0gBAww
+CjAIBgZngQwBAgEwLAYDVR0fBCUwIzAhoB+gHYYbaHR0cDovL2U3LmMubGVuY3Iu
+b3JnLzYuY3JsMIIBDQYKKwYBBAHWeQIEAgSB/gSB+wD5AHYAwjF+V0UZo0Xufzje
+spBB68fCIVoiv3/Vta12mtkOUs0AAAGeT25fsAAABAMARzBFAiEA+wB1nILWmjta
+TYVKK0O3dy/XYw8yN9tAHU2m48ILxFgCIEhNQOZOSQcJckwuPUkAnz+3EwCo95d3
+8KR2hjCv7KkkAH8AqCbL4wrGNRJGUz/gZfFPGdluGQgTxB3ZbXkAsxI8VScAAAGe
+T25jRQAIAAAFAAwCz/kEAwBIMEYCIQDhvNquPNk6cnZru4zQeX9fd9JAqPbVk76l
+mLrC5QWiRAIhAMf1zNpuUAg9sz8Ft0szAbdmGwT7B7nBftIVyU2LseO6MAoGCCqG
+SM49BAMDA2kAMGYCMQC8wvsgPm4l+i1nGGfNph7QVnu1hc4giTqHco5dp+sLr9Qi
+E0Cm013ub291oy92sYECMQCMshoYY/LnubmjMxnkAIV9/WbhZ2FJCtWmKWSNdGnU
+l+l/l6tgc1a1iHB8E0lr31I=
+-----END CERTIFICATE-----
+
+-----BEGIN CERTIFICATE-----
+MIIEVzCCAj+gAwIBAgIRAKp18eYrjwoiCWbTi7/UuqEwDQYJKoZIhvcNAQELBQAw
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
+WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
+RW5jcnlwdDELMAkGA1UEAxMCRTcwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARB6AST
+CFh/vjcwDMCgQer+VtqEkz7JANurZxLP+U9TCeioL6sp5Z8VRvRbYk4P1INBmbef
+QHJFHCxcSjKmwtvGBWpl/9ra8HW0QDsUaJW2qOJqceJ0ZVFT3hbUHifBM/2jgfgw
+gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
+ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSuSJ7chx1EoG/aouVgdAR4
+wpwAgDAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
+BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
+Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAjx66fDdLk5ywFn3CzA1w1qfylHUD
+aEf0QZpXcJseddJGSfbUUOvbNR9N/QQ16K1lXl4VFyhmGXDT5Kdfcr0RvIIVrNxF
+h4lqHtRRCP6RBRstqbZ2zURgqakn/Xip0iaQL0IdfHBZr396FgknniRYFckKORPG
+yM3QKnd66gtMst8I5nkRQlAg/Jb+Gc3egIvuGKWboE1G89NTsN9LTDD3PLj0dUMr
+OIuqVjLB8pEC6yk9enrlrqjXQgkLEYhXzq7dLafv5Vkig6Gl0nuuqjqfp0Q1bi1o
+yVNAlXe6aUXw92CcghC9bNsKEO1+M52YY5+ofIXlS/SEQbvVYYBLZ5yeiglV6t3S
+M6H+vTG0aP9YHzLn/KVOHzGQfXDP7qM5tkf+7diZe7o2fw6O7IvN6fsQXEQQj8TJ
+UXJxv2/uJhcuy/tSDgXwHM8Uk34WNbRT7zGTGkQRX0gsbjAea/jYAoWv0ZvQRwpq
+Pe79D/i7Cep8qWnA+7AE/3B3S/3dEEYmc0lpe1366A/6GEgk3ktr9PEoQrLChs6I
+tu3wnNLB2euC8IKGLQFpGtOO/2/hiAKjyajaBP25w1jF0Wl8Bbqne3uZ2q1GyPFJ
+YRmT7/OXpmOH/FVLtwS+8ng1cAmpCujPwteJZNcDG0sF2n/sc0+SQf49fdyUK0ty
+VUwFj9tmWxyR/M=
+-----END CERTIFICATE-----
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIAj3lWeQ/L+GVhLzcfgJe6oak4e3L3y1sSowG5k3HGvUoAoGCCqGSM49
+AwEHoUQDQgAEV/+syjCuox/6wPqzZAGePe5PYKPHGNCRWe4pcaVXxAJC8uEI2I+r
+JVpeHBBGdbj8DgMPKBDRKMbtLeoo8GsJcA==
+-----END EC PRIVATE KEY-----
@@ -0,0 +1,24 @@
+services:
+  nginx:
+    build: .
+    container_name: global-nginx
+    restart: always
+    ports:
+      - "80:80"
+      - "443:443"
+
+    deploy:
+      resources:
+        limits:
+          cpus: '1'
+          memory: 512M
+        reservations:
+          cpus: '0.25'
+          memory: 128M
+    healthcheck:
+      test: ["CMD", "curl", "-f", "-o", "/dev/null", "-s", "-w", "%{http_code}", "http://localhost/"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
@@ -0,0 +1,15 @@
+FROM nginx:alpine
+
+# 删除默认配置
+RUN rm /etc/nginx/conf.d/default.conf
+
+# 复制自定义配置
+COPY nginx.conf /etc/nginx/nginx.conf
+
+# 复制 SSL 证书
+COPY certificate/ /etc/nginx/ssl/
+
+# 暴露端口
+EXPOSE 80 443
+
+CMD ["nginx", "-g", "daemon off;"]
@@ -0,0 +1,150 @@
+user nginx;
+worker_processes auto;
+error_log /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+    use epoll;
+    multi_accept on;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log /var/log/nginx/access.log main;
+
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+
+    # Gzip 压缩
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
+
+    # 请求体大小限制（支持大文件上传）
+    client_max_body_size 100m;
+
+    # 请求头缓冲区
+    client_header_buffer_size 128m;
+    large_client_header_buffers 4 128m;
+
+    # WebSocket 支持
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+
+    # SSL 通用配置
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+
+    # HTTP 重定向到 HTTPS
+    server {
+        listen 80;
+        server_name _;
+        return 301 https://$host$request_uri;
+    }
+
+    # 默认处理：未匹配的域名或 IP 访问返回 444
+    server {
+        listen 443 ssl default_server;
+        http2 on;
+        server_name _;
+
+        ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt;
+        ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key;
+
+        return 444;
+    }
+
+    # OfferPie 前端
+    # www.offerpai.com.cn → 10302
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name www.offerpai.com.cn;
+
+        ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt;
+        ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key;
+
+        location / {
+            proxy_pass http://172.17.0.1:10302;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            proxy_connect_timeout 300s;
+            proxy_send_timeout 300s;
+            proxy_read_timeout 300s;
+        }
+    }
+
+    # OfferPie Java 后端 API
+    # api.offerpai.com.cn → 10202
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name api.offerpai.com.cn;
+
+        ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt;
+        ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key;
+
+        location / {
+            proxy_pass http://172.17.0.1:10202;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            proxy_connect_timeout 300s;
+            proxy_send_timeout 300s;
+            proxy_read_timeout 300s;
+        }
+    }
+
+    # OfferPie Python AI 服务
+    # ai.offerpai.com.cn → 10502
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name ai.offerpai.com.cn;
+
+        ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt;
+        ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key;
+
+        location / {
+            proxy_pass http://172.17.0.1:10502;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # WebSocket + 流式输出支持
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+
+            proxy_buffering off;
+            proxy_cache off;
+
+            proxy_connect_timeout 300s;
+            proxy_send_timeout 300s;
+            proxy_read_timeout 300s;
+        }
+    }
+}