From bc4c3200d940079594628f8debd9388b76e81c52 Mon Sep 17 00:00:00 2001 From: zk Date: Wed, 27 May 2026 11:26:22 +0800 Subject: [PATCH] =?UTF-8?q?=E5=88=9D=E5=A7=8B=E5=8C=96=EF=BC=8C=E5=88=9B?= =?UTF-8?q?=E5=BB=BAnginx=20=E7=9B=B8=E5=85=B3=E9=85=8D=E7=BD=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitignore | 9 ++ README.md | 38 ++++++++ certificate/offerpai.com.cn.crt | 49 +++++++++++ certificate/offerpai.com.cn.key | 5 ++ docker-compose.yml | 24 +++++ dockerfile | 15 ++++ nginx.conf | 150 ++++++++++++++++++++++++++++++++ 7 files changed, 290 insertions(+) create mode 100644 .gitignore create mode 100644 README.md create mode 100644 certificate/offerpai.com.cn.crt create mode 100644 certificate/offerpai.com.cn.key create mode 100644 docker-compose.yml create mode 100644 dockerfile create mode 100644 nginx.conf diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..71beab4 --- /dev/null +++ b/.gitignore @@ -0,0 +1,9 @@ +# IDE +.idea/ + +# OS files +.DS_Store +Thumbs.db + +# Logs +*.log diff --git a/README.md b/README.md new file mode 100644 index 0000000..a6fcd87 --- /dev/null +++ b/README.md @@ -0,0 +1,38 @@ +# OfferPie 全局 Nginx 网关 + +单机部署的全局反向代理服务，统一管理 HTTPS 入口。 + +## 域名映射 + +| 域名 | 端口 | 说明 | +|------|------|------| +| www.offerpai.com.cn | 10302 | OfferPie 前端 | +| api.offerpai.com.cn | 10202 | OfferPie Java 后端 API | +| ai.offerpai.com.cn | 10502 | OfferPie Python AI 服务 | + +未匹配的域名或 IP 访问返回 444（直接断开连接）。 + +## 部署 + +```bash +docker-compose up -d --build +``` + +## 更新配置 + +修改 `nginx.conf` 后重新构建： + +```bash +docker-compose up -d --build +``` + +## 证书更新 + +替换 `certificate/` 目录下的证书文件后重新构建。 + +## 文件说明 + +- `nginx.conf` - Nginx 主配置 +- `dockerfile` - 镜像构建文件 +- `docker-compose.yml` - 容器编排配置 +- `certificate/` - SSL 证书目录 diff --git a/certificate/offerpai.com.cn.crt b/certificate/offerpai.com.cn.crt new file mode 100644 index 0000000..e348193 --- /dev/null +++ b/certificate/offerpai.com.cn.crt @@ -0,0 +1,49 @@ +-----BEGIN CERTIFICATE----- +MIIDnTCCAyKgAwIBAgISBVWuRhhOaiBkuQnFxKyCJDMFMAoGCCqGSM49BAMDMDIx +CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF +NzAeFw0yNjA1MjIxMDI2MjRaFw0yNjA4MjAxMDI2MjNaMBoxGDAWBgNVBAMTD29m +ZmVycGFpLmNvbS5jbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFf/rMowrqMf ++sD6s2QBnj3uT2CjxxjQkVnuKXGlV8QCQvLhCNiPqyVaXhwQRnW4/A4DDygQ0SjG +7S3qKPBrCXCjggIuMIICKjAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYB +BQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUMUW5y29bkHDb++PS0DfpFe/k +ubYwHwYDVR0jBBgwFoAUrkie3IcdRKBv2qLlYHQEeMKcAIAwMgYIKwYBBQUHAQEE +JjAkMCIGCCsGAQUFBzAChhZodHRwOi8vZTcuaS5sZW5jci5vcmcvMC0GA1UdEQQm +MCSCESoub2ZmZXJwYWkuY29tLmNugg9vZmZlcnBhaS5jb20uY24wEwYDVR0gBAww +CjAIBgZngQwBAgEwLAYDVR0fBCUwIzAhoB+gHYYbaHR0cDovL2U3LmMubGVuY3Iu +b3JnLzYuY3JsMIIBDQYKKwYBBAHWeQIEAgSB/gSB+wD5AHYAwjF+V0UZo0Xufzje +spBB68fCIVoiv3/Vta12mtkOUs0AAAGeT25fsAAABAMARzBFAiEA+wB1nILWmjta +TYVKK0O3dy/XYw8yN9tAHU2m48ILxFgCIEhNQOZOSQcJckwuPUkAnz+3EwCo95d3 +8KR2hjCv7KkkAH8AqCbL4wrGNRJGUz/gZfFPGdluGQgTxB3ZbXkAsxI8VScAAAGe +T25jRQAIAAAFAAwCz/kEAwBIMEYCIQDhvNquPNk6cnZru4zQeX9fd9JAqPbVk76l +mLrC5QWiRAIhAMf1zNpuUAg9sz8Ft0szAbdmGwT7B7nBftIVyU2LseO6MAoGCCqG +SM49BAMDA2kAMGYCMQC8wvsgPm4l+i1nGGfNph7QVnu1hc4giTqHco5dp+sLr9Qi +E0Cm013ub291oy92sYECMQCMshoYY/LnubmjMxnkAIV9/WbhZ2FJCtWmKWSNdGnU +l+l/l6tgc1a1iHB8E0lr31I= +-----END CERTIFICATE----- + +-----BEGIN CERTIFICATE----- +MIIEVzCCAj+gAwIBAgIRAKp18eYrjwoiCWbTi7/UuqEwDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw +WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg +RW5jcnlwdDELMAkGA1UEAxMCRTcwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARB6AST +CFh/vjcwDMCgQer+VtqEkz7JANurZxLP+U9TCeioL6sp5Z8VRvRbYk4P1INBmbef +QHJFHCxcSjKmwtvGBWpl/9ra8HW0QDsUaJW2qOJqceJ0ZVFT3hbUHifBM/2jgfgw +gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD +ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSuSJ7chx1EoG/aouVgdAR4 +wpwAgDAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB +AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g +BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu +Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAjx66fDdLk5ywFn3CzA1w1qfylHUD +aEf0QZpXcJseddJGSfbUUOvbNR9N/QQ16K1lXl4VFyhmGXDT5Kdfcr0RvIIVrNxF +h4lqHtRRCP6RBRstqbZ2zURgqakn/Xip0iaQL0IdfHBZr396FgknniRYFckKORPG +yM3QKnd66gtMst8I5nkRQlAg/Jb+Gc3egIvuGKWboE1G89NTsN9LTDD3PLj0dUMr +OIuqVjLB8pEC6yk9enrlrqjXQgkLEYhXzq7dLafv5Vkig6Gl0nuuqjqfp0Q1bi1o +yVNAlXe6aUXw92CcghC9bNsKEO1+M52YY5+ofIXlS/SEQbvVYYBLZ5yeiglV6t3S +M6H+vTG0aP9YHzLn/KVOHzGQfXDP7qM5tkf+7diZe7o2fw6O7IvN6fsQXEQQj8TJ +UXJxv2/uJhcuy/tSDgXwHM8Uk34WNbRT7zGTGkQRX0gsbjAea/jYAoWv0ZvQRwpq +Pe79D/i7Cep8qWnA+7AE/3B3S/3dEEYmc0lpe1366A/6GEgk3ktr9PEoQrLChs6I +tu3wnNLB2euC8IKGLQFpGtOO/2/hiAKjyajaBP25w1jF0Wl8Bbqne3uZ2q1GyPFJ +YRmT7/OXpmOH/FVLtwS+8ng1cAmpCujPwteJZNcDG0sF2n/sc0+SQf49fdyUK0ty ++VUwFj9tmWxyR/M= +-----END CERTIFICATE----- diff --git a/certificate/offerpai.com.cn.key b/certificate/offerpai.com.cn.key new file mode 100644 index 0000000..06d5019 --- /dev/null +++ b/certificate/offerpai.com.cn.key @@ -0,0 +1,5 @@ +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIAj3lWeQ/L+GVhLzcfgJe6oak4e3L3y1sSowG5k3HGvUoAoGCCqGSM49 +AwEHoUQDQgAEV/+syjCuox/6wPqzZAGePe5PYKPHGNCRWe4pcaVXxAJC8uEI2I+r +JVpeHBBGdbj8DgMPKBDRKMbtLeoo8GsJcA== +-----END EC PRIVATE KEY----- diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..384804b --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,24 @@ +services: + nginx: + build: . + container_name: global-nginx + restart: always + ports: + - "80:80" + - "443:443" + + deploy: + resources: + limits: + cpus: '1' + memory: 512M + reservations: + cpus: '0.25' + memory: 128M + healthcheck: + test: ["CMD", "curl", "-f", "-o", "/dev/null", "-s", "-w", "%{http_code}", "http://localhost/"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 10s + diff --git a/dockerfile b/dockerfile new file mode 100644 index 0000000..7e0e20a --- /dev/null +++ b/dockerfile @@ -0,0 +1,15 @@ +FROM nginx:alpine + +# 删除默认配置 +RUN rm /etc/nginx/conf.d/default.conf + +# 复制自定义配置 +COPY nginx.conf /etc/nginx/nginx.conf + +# 复制 SSL 证书 +COPY certificate/ /etc/nginx/ssl/ + +# 暴露端口 +EXPOSE 80 443 + +CMD ["nginx", "-g", "daemon off;"] diff --git a/nginx.conf b/nginx.conf new file mode 100644 index 0000000..8408f39 --- /dev/null +++ b/nginx.conf @@ -0,0 +1,150 @@ +user nginx; +worker_processes auto; +error_log /var/log/nginx/error.log warn; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; + use epoll; + multi_accept on; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 2048; + + # Gzip 压缩 + gzip on; + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml; + + # 请求体大小限制（支持大文件上传） + client_max_body_size 100m; + + # 请求头缓冲区 + client_header_buffer_size 128m; + large_client_header_buffers 4 128m; + + # WebSocket 支持 + map $http_upgrade $connection_upgrade { + default upgrade; + '' close; + } + + # SSL 通用配置 + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 1d; + + # HTTP 重定向到 HTTPS + server { + listen 80; + server_name _; + return 301 https://$host$request_uri; + } + + # 默认处理：未匹配的域名或 IP 访问返回 444 + server { + listen 443 ssl default_server; + http2 on; + server_name _; + + ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt; + ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key; + + return 444; + } + + # OfferPie 前端 + # www.offerpai.com.cn → 10302 + server { + listen 443 ssl; + http2 on; + server_name www.offerpai.com.cn; + + ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt; + ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key; + + location / { + proxy_pass http://172.17.0.1:10302; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_connect_timeout 300s; + proxy_send_timeout 300s; + proxy_read_timeout 300s; + } + } + + # OfferPie Java 后端 API + # api.offerpai.com.cn → 10202 + server { + listen 443 ssl; + http2 on; + server_name api.offerpai.com.cn; + + ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt; + ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key; + + location / { + proxy_pass http://172.17.0.1:10202; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_connect_timeout 300s; + proxy_send_timeout 300s; + proxy_read_timeout 300s; + } + } + + # OfferPie Python AI 服务 + # ai.offerpai.com.cn → 10502 + server { + listen 443 ssl; + http2 on; + server_name ai.offerpai.com.cn; + + ssl_certificate /etc/nginx/ssl/offerpai.com.cn.crt; + ssl_certificate_key /etc/nginx/ssl/offerpai.com.cn.key; + + location / { + proxy_pass http://172.17.0.1:10502; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + # WebSocket + 流式输出支持 + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + + proxy_buffering off; + proxy_cache off; + + proxy_connect_timeout 300s; + proxy_send_timeout 300s; + proxy_read_timeout 300s; + } + } +}