PMon Dev
49dacb57a6
Design System Guard / guard (push) Failing after 9m13s
合并 088c9b3（移除 nginx 容器、常驻 5→4）到 main。三路合并零文本冲突，但 088c9b3 漏改了引用被重命名文件的地方，故在本合并提交里一并适配：
1) tests/phase3b-static-guard.js:265 的断言原本读 deploy/nginx.conf，该文件已 rename 成 deploy/nginx.host.conf.example；不改会让 read() 返回空串、断言必然 FAIL，而该护栏被 run-guards.sh / Gitea Actions 收录。新模板 108-109 行确有 location ^~ /admin/ 与 proxy_pass，换名后断言成立。
2) deploy/nginx.ssl.conf.example 的使用说明仍写 cp nginx.conf 与 docker compose up -d nginx（两者都已不存在），改为时代注记，点明本文件只是 HTTPS 片段、缺 /admin/ /setup /relay 段、不可整份照抄（纯注释，不改配置行为）。
验证：bash tests/run-guards.sh → 6 套件 PASS 5 / FAIL 0 / SKIPPED 1（axe 可选未启用）；phase3b 94/0、dockerfile-coverage 60/0、schema 116/0、Dart 674 全通过，整体退出码 0。
88 lines
2.8 KiB
Plaintext
88 lines
2.8 KiB
Plaintext
# InkWatch 接入层 · 生产 HTTPS 配置片段（宿主反代）
|
|
#
|
|
# ⚠️ 时代注记（2026-11-08）：四容器编排已移除自带的 nginx 容器，接入层改由
|
|
# 宿主（1Panel / OpenResty）承担，仓库里不再有 deploy/nginx.conf。
|
|
# 配置入口以 deploy/nginx.host.conf.example 为准；本文件只补 HTTPS/证书相关段，
|
|
# 缺 /admin/、/setup、/relay/ 等 location，需与宿主模板合并使用，不要整份照抄。
|
|
#
|
|
# 使用方法：
|
|
# 1) 将证书放到宿主 nginx 可读的目录（本文件按 /etc/nginx/certs/ 引用）：
|
|
# fullchain.pem / privkey.pem
|
|
# 2) 备份宿主站点配置，把本片段并入，再校验并重载：
|
|
# nginx -t && nginx -s reload
|
|
#
|
|
# 证书目录已被 .gitignore 排除，切勿把私钥提交入库。
|
|
|
|
upstream inkwatch_gateway {
|
|
server 127.0.0.1:3000 max_fails=2 fail_timeout=10s;
|
|
keepalive 64;
|
|
}
|
|
|
|
upstream inkwatch_business {
|
|
server 127.0.0.1:4000 max_fails=2 fail_timeout=10s;
|
|
keepalive 16;
|
|
}
|
|
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
# 80：仅保留探活，其余 301 跳转 HTTPS
|
|
server {
|
|
listen 80 default_server;
|
|
server_name _;
|
|
location = /healthz { return 200 'ok'; add_header Content-Type text/plain; }
|
|
location / { return 301 https://$host$request_uri; }
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name _;
|
|
|
|
ssl_certificate /etc/nginx/certs/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/privkey.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers HIGH:!aNULL:!MD5;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 1h;
|
|
|
|
location = /healthz {
|
|
proxy_pass http://inkwatch_gateway/health;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
# Socket.io 长连接
|
|
location /socket.io/ {
|
|
proxy_pass http://inkwatch_gateway;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
proxy_read_timeout 600s;
|
|
proxy_send_timeout 600s;
|
|
proxy_connect_timeout 10s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
# 业务 REST 接口
|
|
location /api/ {
|
|
proxy_pass http://inkwatch_business;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
client_max_body_size 256k;
|
|
}
|
|
|
|
location /health {
|
|
proxy_pass http://inkwatch_gateway/health;
|
|
}
|
|
}
|