chore: 整理项目结构，清理归档文件，更新部署配置
This commit is contained in:
Simon
@@ -1,11 +1,11 @@
|
||||
# =============================================================================
|
||||
# 企微IT智能服务台 — Nginx 配置（NAS + Cloudflare Tunnel 版）
|
||||
# 企微IT智能服务台 — Nginx 配置（公司内网服务器版）
|
||||
# =============================================================================
|
||||
# 与标准 nginx.conf 的区别：
|
||||
# 1. 移除 / 根路径反代到 IT 数据查询平台（NAS 上没有此服务）
|
||||
# 2. 增加 Cloudflare 真实 IP 还原（CF-Connecting-IP）
|
||||
# 3. 增加 HSTS 和安全头（通过 Tunnel 时客户端是 HTTPS）
|
||||
# 4. 增加 /api/wecom/callback 路径用于企微消息回调
|
||||
# 适用场景：独立域名 itsupport.servyou.com.cn，公司内网 DNS 解析
|
||||
# 说明：
|
||||
# - 公司内网服务器部署，使用 itsupport.servyou.com.cn 域名
|
||||
# - 真实 IP 直接从 $remote_addr 获取
|
||||
# - 预留 HTTPS 配置注释（如公司有统一 SSL 终端）
|
||||
# =============================================================================
|
||||
|
||||
events {
|
||||
@@ -17,9 +17,9 @@ http {
|
||||
default_type application/octet-stream;
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 日志格式（增加 CF 真实 IP）
|
||||
# 日志格式
|
||||
# ------------------------------------------------------------------
|
||||
log_format main '$http_x_forwarded_for - $remote_user [$time_local] "$request" '
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent"';
|
||||
|
||||
@@ -46,6 +46,20 @@ http {
|
||||
application/javascript application/xml+rss
|
||||
application/json application/ld+json;
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 安全响应头
|
||||
# ------------------------------------------------------------------
|
||||
# 隐藏 nginx 版本号
|
||||
server_tokens off;
|
||||
|
||||
# 基础安全头（应用到所有响应）
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
||||
add_header X-Frame-Options "DENY" always;
|
||||
add_header X-XSS-Protection "0" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
|
||||
add_header Cross-Origin-Opener-Policy "same-origin" always;
|
||||
|
||||
# =================================================================
|
||||
# 上游服务定义（Docker 内部网络）
|
||||
# =================================================================
|
||||
@@ -54,24 +68,26 @@ http {
|
||||
}
|
||||
|
||||
# =================================================================
|
||||
# 主服务：监听 80 端口（Cloudflare Tunnel 终止 SSL，容器内走 HTTP）
|
||||
# HTTP 服务（监听 80 端口）
|
||||
# =================================================================
|
||||
# 如果公司有统一 SSL 终端（如 F5/Nginx 反代），此服务器只需监听 80
|
||||
# 如果需要本机 HTTPS，取消下方 server 块注释，并配置证书路径
|
||||
# =================================================================
|
||||
server {
|
||||
listen 80;
|
||||
server_name itdesk.amanzac.com;
|
||||
server_name itsupport.servyou.com.cn;
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 安全头（通过 Cloudflare Tunnel 时客户端是 HTTPS）
|
||||
# 安全头
|
||||
# ------------------------------------------------------------------
|
||||
# 告诉浏览器只通过 HTTPS 访问（通过 Cloudflare 的 HSTS 配置更佳）
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 健康检查端点（用于 Docker healthcheck）
|
||||
# 健康检查端点
|
||||
# ------------------------------------------------------------------
|
||||
location = /itdesk/health {
|
||||
location = /health {
|
||||
access_log off;
|
||||
return 200 "healthy\n";
|
||||
add_header Content-Type text/plain;
|
||||
@@ -95,17 +111,34 @@ http {
|
||||
try_files $uri /itagent/index.html;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 管理后台 — /itadmin/
|
||||
# ------------------------------------------------------------------
|
||||
location /itadmin/ {
|
||||
alias /usr/share/nginx/html/itadmin/;
|
||||
index index.html;
|
||||
try_files $uri /itadmin/index.html;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 统一入口 Portal — /itportal/
|
||||
# ------------------------------------------------------------------
|
||||
location /itportal/ {
|
||||
alias /usr/share/nginx/html/itportal/;
|
||||
index index.html;
|
||||
try_files $uri /itportal/index.html;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 后端 API — /api/
|
||||
# ------------------------------------------------------------------
|
||||
location /api/ {
|
||||
proxy_pass http://backend_api/;
|
||||
proxy_set_header Host $host;
|
||||
# Cloudflare 真实 IP 还原
|
||||
proxy_set_header X-Real-IP $http_cf_connecting_ip;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
# Cloudflare Tunnel 终止 SSL，告知后端原始协议是 HTTPS
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
# 内网直连，如前端有 SSL 终端则改为 https
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# 超时设置（AI 回复可能较慢）
|
||||
proxy_connect_timeout 60s;
|
||||
@@ -116,18 +149,26 @@ http {
|
||||
# ------------------------------------------------------------------
|
||||
# WebSocket — /ws/（坐席端实时通信）
|
||||
# ------------------------------------------------------------------
|
||||
# [MSG-P0-05] WS 超时配置调整为 1 小时
|
||||
location /ws/ {
|
||||
access_log off; # P0-#4: 关闭 WS 路径日志，避免 token 泄露
|
||||
proxy_pass http://backend_api;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $http_cf_connecting_ip;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_read_timeout 86400s; # WebSocket 长连接
|
||||
proxy_read_timeout 3600s; # 1小时，WS 长连接
|
||||
proxy_send_timeout 3600s; # 1小时，发送超时
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 企微回调 — /api/wecom/callback（接收企微消息推送）
|
||||
# ------------------------------------------------------------------
|
||||
# 企微验证回调 URL 时使用 GET，后续消息推送使用 POST
|
||||
# 此路径已包含在 /api/ 的代理规则中，无需单独配置
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 默认路径 — 重定向到 H5 员工端
|
||||
# ------------------------------------------------------------------
|
||||
@@ -135,4 +176,23 @@ http {
|
||||
return 302 /itdesk/;
|
||||
}
|
||||
}
|
||||
|
||||
# =================================================================
|
||||
# HTTPS 配置（按需启用）
|
||||
# =================================================================
|
||||
# 如果需要本机直接提供 HTTPS（不走公司统一 SSL 终端），
|
||||
# 取消下方注释并配置 SSL 证书路径
|
||||
#
|
||||
# server {
|
||||
# listen 443 ssl;
|
||||
# server_name itsupport.servyou.com.cn;
|
||||
#
|
||||
# ssl_certificate /etc/nginx/ssl/itsupport.servyou.com.cn.crt;
|
||||
# ssl_certificate_key /etc/nginx/ssl/itsupport.servyou.com.cn.key;
|
||||
# ssl_protocols TLSv1.2 TLSv1.3;
|
||||
# ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
#
|
||||
# # 其余 location 配置与上方 HTTP server 相同
|
||||
# ...
|
||||
# }
|
||||
}
|
||||
@@ -0,0 +1,82 @@
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
|
||||
upstream backend {
|
||||
server backend:8000;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
|
||||
location /api/ {
|
||||
rewrite ^/api/(.*) /$1 break;
|
||||
proxy_pass http://backend/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
location /h5/ {
|
||||
proxy_pass http://backend;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
location /ws/ {
|
||||
proxy_pass http://backend;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_read_timeout 86400s;
|
||||
}
|
||||
|
||||
location /itdesk/ {
|
||||
alias /usr/share/nginx/html/itdesk/;
|
||||
index index.html;
|
||||
try_files $uri /itdesk/index.html;
|
||||
}
|
||||
|
||||
location /itagent/ {
|
||||
alias /usr/share/nginx/html/itagent/;
|
||||
index index.html;
|
||||
try_files $uri /itagent/index.html;
|
||||
}
|
||||
|
||||
location /itadmin/ {
|
||||
alias /usr/share/nginx/html/itadmin/;
|
||||
index index.html;
|
||||
try_files $uri /itadmin/index.html;
|
||||
}
|
||||
|
||||
location /itportal/ {
|
||||
alias /usr/share/nginx/html/itportal/;
|
||||
index index.html;
|
||||
try_files $uri /itportal/index.html;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://10.80.0.130:8080;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
}
|
||||
}
|
||||
+116
-1
@@ -61,12 +61,116 @@ http {
|
||||
}
|
||||
|
||||
# =================================================================
|
||||
# 主服务：监听 80 端口
|
||||
# HTTPS 服务：监听 443 端口（SSL）
|
||||
# =================================================================
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
|
||||
# SSL 证书配置（临时禁用，等待证书路径修复）
|
||||
# ssl_certificate /etc/nginx/ssl/itsupport.servyou.com.cn.crt;
|
||||
# ssl_certificate_key /etc/nginx/ssl/itsupport.servyou.com.cn.key;
|
||||
# ssl_protocols TLSv1.2 TLSv1.3;
|
||||
# ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
|
||||
# ssl_prefer_server_ciphers off;
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# H5 员工端 — /itdesk/
|
||||
# ------------------------------------------------------------------
|
||||
location /itdesk/ {
|
||||
alias /usr/share/nginx/html/itdesk/;
|
||||
index index.html;
|
||||
try_files $uri /itdesk/index.html;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 坐席工作台 — /itagent/
|
||||
# ------------------------------------------------------------------
|
||||
location /itagent/ {
|
||||
alias /usr/share/nginx/html/itagent/;
|
||||
index index.html;
|
||||
try_files $uri /itagent/index.html;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 管理后台 — /itadmin/
|
||||
# ------------------------------------------------------------------
|
||||
location /itadmin/ {
|
||||
alias /usr/share/nginx/html/itadmin/;
|
||||
index index.html;
|
||||
try_files $uri /itadmin/index.html;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 统一入口 Portal — /itportal/
|
||||
# ------------------------------------------------------------------
|
||||
location /itportal/ {
|
||||
alias /usr/share/nginx/html/itportal/;
|
||||
index index.html;
|
||||
try_files $uri /itportal/index.html;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 后端 API — /api/
|
||||
# ------------------------------------------------------------------
|
||||
location /api/ {
|
||||
proxy_pass http://backend_api/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 300s;
|
||||
proxy_read_timeout 300s;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# H5 用户端 — /h5/
|
||||
# ------------------------------------------------------------------
|
||||
location /h5/ {
|
||||
proxy_pass http://backend_api/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# WebSocket — /ws/
|
||||
# ------------------------------------------------------------------
|
||||
location /ws/ {
|
||||
proxy_pass http://backend_api;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_read_timeout 86400s;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# IT 数据查询平台 — /（根路径，反代到远程主机）
|
||||
# ------------------------------------------------------------------
|
||||
location / {
|
||||
proxy_pass http://10.80.0.130:8080;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 30s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 60s;
|
||||
}
|
||||
}
|
||||
|
||||
# =================================================================
|
||||
# 备用：监听 80 端口（开发调试用）
|
||||
# =================================================================
|
||||
server {
|
||||
listen 80;
|
||||
server_name localhost;
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# 健康检查端点（用于 Docker healthcheck）
|
||||
# ------------------------------------------------------------------
|
||||
@@ -130,6 +234,17 @@ http {
|
||||
proxy_read_timeout 300s;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# H5 用户端 — /h5/
|
||||
# ------------------------------------------------------------------
|
||||
location /h5/ {
|
||||
proxy_pass http://backend_api/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# WebSocket — /ws/（坐席端实时通信）
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
Reference in New Issue
Block a user