Simon
266 lines
9.3 KiB
Plaintext
266 lines
9.3 KiB
Plaintext
# =============================================================================
|
||
# 企微IT智能服务台 — Nginx 配置（多服务拆分版）
|
||
# =============================================================================
|
||
# 路由策略：
|
||
# - /api/core/* → core-svc:8001
|
||
# - /api/conversations/*, /api/messages/*, /api/h5/*, /ws/* → conversation-svc:8002
|
||
# - /api/agents/* → agent-svc:8003
|
||
# - /api/ai/* → ai-svc:8004
|
||
# - /api/admin/* → admin-svc:8005
|
||
# - /*.html, /itdesk/*, /itagent/*, /itadmin/*, /itportal/* → 静态文件
|
||
# =============================================================================
|
||
|
||
worker_processes auto;
|
||
error_log /var/log/nginx/error.log warn;
|
||
pid /var/run/nginx.pid;
|
||
|
||
events {
|
||
worker_connections 1024;
|
||
use epoll;
|
||
multi_accept on;
|
||
}
|
||
|
||
http {
|
||
include /etc/nginx/mime.types;
|
||
default_type application/octet-stream;
|
||
|
||
# 日志格式
|
||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||
'$status $body_bytes_sent "$http_referer" '
|
||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||
|
||
access_log /var/log/nginx/access.log main;
|
||
|
||
# 性能优化
|
||
sendfile on;
|
||
tcp_nopush on;
|
||
tcp_nodelay on;
|
||
keepalive_timeout 65;
|
||
types_hash_max_size 2048;
|
||
client_max_body_size 50m;
|
||
|
||
# Gzip 压缩
|
||
gzip on;
|
||
gzip_vary on;
|
||
gzip_min_length 1024;
|
||
gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml;
|
||
|
||
# ----------------------------------------------------------------------
|
||
# 上游服务定义（拆分版）
|
||
# ----------------------------------------------------------------------
|
||
# 单体后端服务（所有 API 都走 backend:8000）
|
||
upstream core_backend {
|
||
server backend:8000 max_fails=3 fail_timeout=30s;
|
||
keepalive 32;
|
||
}
|
||
|
||
upstream conversation_backend {
|
||
server backend:8000 max_fails=3 fail_timeout=30s;
|
||
keepalive 64;
|
||
}
|
||
|
||
upstream agent_backend {
|
||
server backend:8000 max_fails=3 fail_timeout=30s;
|
||
keepalive 32;
|
||
}
|
||
|
||
upstream ai_backend {
|
||
server backend:8000 max_fails=3 fail_timeout=30s;
|
||
keepalive 32;
|
||
}
|
||
|
||
upstream admin_backend {
|
||
server backend:8000 max_fails=3 fail_timeout=30s;
|
||
keepalive 32;
|
||
}
|
||
|
||
# ----------------------------------------------------------------------
|
||
# 静态文件服务（H5用户端）
|
||
# ----------------------------------------------------------------------
|
||
server {
|
||
listen 80;
|
||
server_name itsupport.servyou.com.cn;
|
||
|
||
# HTTP → HTTPS 跳转
|
||
return 301 https://$server_name$request_uri;
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl http2;
|
||
server_name itsupport.servyou.com.cn;
|
||
|
||
# SSL 证书
|
||
ssl_certificate /etc/nginx/ssl/servyou.com.cn.pem;
|
||
ssl_certificate_key /etc/nginx/ssl/servyou.com.cn.key;
|
||
ssl_session_timeout 1d;
|
||
ssl_session_cache shared:SSL:50m;
|
||
ssl_session_tickets off;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
|
||
ssl_prefer_server_ciphers off;
|
||
|
||
# ------------------------------------------------------------------
|
||
# 健康检查端点（不经过代理）
|
||
# ------------------------------------------------------------------
|
||
location = /itdesk/health {
|
||
access_log off;
|
||
return 200 "OK";
|
||
add_header Content-Type text/plain;
|
||
}
|
||
|
||
# ------------------------------------------------------------------
|
||
# API 路由分发（根据路径选择上游服务）
|
||
# ------------------------------------------------------------------
|
||
|
||
# Core 服务：认证、员工、角色
|
||
location ~ ^/api/(auth|employees|roles|mfa) {
|
||
proxy_pass http://core_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 30s;
|
||
proxy_send_timeout 30s;
|
||
proxy_read_timeout 30s;
|
||
proxy_buffering off;
|
||
proxy_set_header Connection "";
|
||
}
|
||
|
||
# AI 服务：Dify 调用、Wingman
|
||
location ~ ^/api/(ai|wingman|dify) {
|
||
proxy_pass http://ai_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 90s; # AI 响应可能较慢
|
||
proxy_buffering off;
|
||
proxy_set_header Connection "";
|
||
}
|
||
|
||
# Admin 服务：管理后台 API
|
||
location ~ ^/api/admin {
|
||
proxy_pass http://admin_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 30s;
|
||
proxy_send_timeout 30s;
|
||
proxy_read_timeout 30s;
|
||
proxy_buffering off;
|
||
proxy_set_header Connection "";
|
||
}
|
||
|
||
# Agent 服务：坐席 API
|
||
location ~ ^/api/agents {
|
||
proxy_pass http://agent_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 30s;
|
||
proxy_send_timeout 30s;
|
||
proxy_read_timeout 30s;
|
||
proxy_buffering off;
|
||
proxy_set_header Connection "";
|
||
}
|
||
|
||
# Conversation 服务：会话、消息、H5 API
|
||
location ~ ^/api/(conversations|messages|h5|quick-replies) {
|
||
proxy_pass http://conversation_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 30s;
|
||
proxy_send_timeout 30s;
|
||
proxy_read_timeout 30s;
|
||
proxy_buffering off;
|
||
proxy_set_header Connection "";
|
||
}
|
||
|
||
# WebSocket 服务（会话服务）
|
||
location /ws/ {
|
||
proxy_pass http://conversation_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 7d;
|
||
proxy_send_timeout 7d;
|
||
proxy_read_timeout 7d;
|
||
proxy_buffering off;
|
||
}
|
||
|
||
# 通用 API 路由（兜底）
|
||
# 注意：proxy_pass 末尾加斜杠会自动 strip /api 前缀
|
||
# 例如: /api/auth_qrcode/create -> /auth_qrcode/create
|
||
location /api/ {
|
||
proxy_pass http://conversation_backend/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 30s;
|
||
proxy_send_timeout 30s;
|
||
proxy_read_timeout 30s;
|
||
proxy_buffering off;
|
||
proxy_set_header Connection "";
|
||
}
|
||
|
||
# ------------------------------------------------------------------
|
||
# 静态文件服务
|
||
# ------------------------------------------------------------------
|
||
|
||
# H5 用户端
|
||
location /itdesk/ {
|
||
alias /usr/share/nginx/html/itdesk/;
|
||
try_files $uri $uri/ /itdesk/index.html;
|
||
add_header Cache-Control "public, max-age=31536000, immutable";
|
||
}
|
||
|
||
# 坐席端
|
||
location /itagent/ {
|
||
alias /usr/share/nginx/html/itagent/;
|
||
try_files $uri $uri/ /itagent/index.html;
|
||
add_header Cache-Control "public, max-age=31536000, immutable";
|
||
}
|
||
|
||
# 管理后台
|
||
location /itadmin/ {
|
||
alias /usr/share/nginx/html/itadmin/;
|
||
try_files $uri $uri/ /itadmin/index.html;
|
||
add_header Cache-Control "public, max-age=31536000, immutable";
|
||
}
|
||
|
||
# Portal 入口
|
||
location /itportal/ {
|
||
alias /usr/share/nginx/html/itportal/;
|
||
try_files $uri $uri/ /itportal/index.html;
|
||
add_header Cache-Control "public, max-age=31536000, immutable";
|
||
}
|
||
|
||
# 根路径重定向到 Portal
|
||
location = / {
|
||
return 302 /itportal/;
|
||
}
|
||
|
||
# 默认处理
|
||
location / {
|
||
return 404;
|
||
}
|
||
}
|
||
}
|