wecom_it_smart_desk/deploy-server/nginx/nginx-split.conf

# =============================================================================
# 企微IT智能服务台 — Nginx 配置（多服务拆分版）
# =============================================================================
# 路由策略：
#   - /api/core/*      → core-svc:8001
#   - /api/conversations/*, /api/messages/*, /api/h5/*, /ws/* → conversation-svc:8002
#   - /api/agents/*    → agent-svc:8003
#   - /api/ai/*       → ai-svc:8004
#   - /api/admin/*    → admin-svc:8005
#   - /*.html, /itdesk/*, /itagent/*, /itadmin/*, /itportal/* → 静态文件
# =============================================================================

worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # 日志格式
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    # 性能优化
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    client_max_body_size 50m;

    # Gzip 压缩
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml;

    # ----------------------------------------------------------------------
    # 上游服务定义（拆分版）
    # ----------------------------------------------------------------------
    # 单体后端服务（所有 API 都走 backend:8000）
    upstream core_backend {
        server backend:8000 max_fails=3 fail_timeout=30s;
        keepalive 32;
    }

    upstream conversation_backend {
        server backend:8000 max_fails=3 fail_timeout=30s;
        keepalive 64;
    }

    upstream agent_backend {
        server backend:8000 max_fails=3 fail_timeout=30s;
        keepalive 32;
    }

    upstream ai_backend {
        server backend:8000 max_fails=3 fail_timeout=30s;
        keepalive 32;
    }

    upstream admin_backend {
        server backend:8000 max_fails=3 fail_timeout=30s;
        keepalive 32;
    }

    # ----------------------------------------------------------------------
    # 静态文件服务（H5用户端）
    # ----------------------------------------------------------------------
    server {
        listen 80;
        server_name itsupport.servyou.com.cn;

        # HTTP → HTTPS 跳转
        return 301 https://$server_name$request_uri;
    }

    server {
        listen 443 ssl http2;
        server_name itsupport.servyou.com.cn;

        # SSL 证书
        ssl_certificate /etc/nginx/ssl/servyou.com.cn.pem;
        ssl_certificate_key /etc/nginx/ssl/servyou.com.cn.key;
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_session_tickets off;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
        ssl_prefer_server_ciphers off;

        # ------------------------------------------------------------------
        # 健康检查端点（不经过代理）
        # ------------------------------------------------------------------
        location = /itdesk/health {
            access_log off;
            return 200 "OK";
            add_header Content-Type text/plain;
        }

        # ------------------------------------------------------------------
        # API 路由分发（根据路径选择上游服务）
        # ------------------------------------------------------------------

        # Core 服务：认证、员工、角色（包括 auth_qrcode 扫码登录）
        location ~ ^/api/(auth|employees|roles|mfa|auth_qrcode) {
            proxy_pass http://core_backend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 30s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
            proxy_buffering off;
            proxy_set_header Connection "";
        }

        # AI 服务：Dify 调用、Wingman
        location ~ ^/api/(ai|wingman|dify) {
            proxy_pass http://ai_backend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 60s;
            proxy_send_timeout 60s;
            proxy_read_timeout 90s;  # AI 响应可能较慢
            proxy_buffering off;
            proxy_set_header Connection "";
        }

        # Admin 服务：管理后台 API
        location ~ ^/api/admin {
            proxy_pass http://admin_backend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 30s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
            proxy_buffering off;
            proxy_set_header Connection "";
        }

        # Agent 服务：坐席 API
        location ~ ^/api/agents {
            proxy_pass http://agent_backend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 30s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
            proxy_buffering off;
            proxy_set_header Connection "";
        }

        # Conversation 服务：会话、消息、H5 API
        location ~ ^/api/(conversations|messages|h5|quick-replies) {
            proxy_pass http://conversation_backend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 30s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
            proxy_buffering off;
            proxy_set_header Connection "";
        }

        # WebSocket 服务（会话服务）
        location /ws/ {
            proxy_pass http://conversation_backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 7d;
            proxy_send_timeout 7d;
            proxy_read_timeout 7d;
            proxy_buffering off;
        }

        # 通用 API 路由（兜底）
        # 注意：proxy_pass 末尾加斜杠会自动 strip /api 前缀
        # 例如: /api/auth_qrcode/create -> /auth_qrcode/create
        location /api/ {
            proxy_pass http://conversation_backend/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 30s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
            proxy_buffering off;
            proxy_set_header Connection "";
        }

        # ------------------------------------------------------------------
        # 静态文件服务
        # ------------------------------------------------------------------

        # H5 用户端
        location /itdesk/ {
            alias /usr/share/nginx/html/itdesk/;
            try_files $uri $uri/ /itdesk/index.html;
            add_header Cache-Control "public, max-age=31536000, immutable";
        }

        # 坐席端
        location /itagent/ {
            alias /usr/share/nginx/html/itagent/;
            try_files $uri $uri/ /itagent/index.html;
            add_header Cache-Control "public, max-age=31536000, immutable";
        }

        # 管理后台
        location /itadmin/ {
            alias /usr/share/nginx/html/itadmin/;
            try_files $uri $uri/ /itadmin/index.html;
            add_header Cache-Control "public, max-age=31536000, immutable";
        }
        # ⚠️ /itportal/ 静态前端块已移除 (2026-08-03 fix) - portal 源码 + dist 已不存在

        # 根路径重定向到 Portal
        location = / {
            return 302 /itdesk/;
        }

        # 默认处理
        location / {
            return 404;
        }
    }
}