LoveChengke
c7f215a09c
- 增加课件上传、班级可见范围、设备补收与传输进度 - 整合自定义灵动岛编辑器和相关客户端交互 - 同步三端契约、数据库迁移、部署配置与隔离回归 - 按源码统一文档与官网说明，移除过时任务书和审查记录 - 保持产品版本为 1.4.0
121 lines
4.4 KiB
Nginx Configuration File
121 lines
4.4 KiB
Nginx Configuration File
# ---------------------------------------------------------------------------
|
||
# 班级小助手 · Nginx 反向代理样例（HTTPS + WebSocket）
|
||
#
|
||
# 作用：把 https://class.example.com 反向代理到本机 4000 端口的服务端，
|
||
# 同时处理 WebSocket 升级、真实 IP 透传、静态资源缓存与安全响应头。
|
||
#
|
||
# 使用：
|
||
# 1) 把本文件放到 /etc/nginx/conf.d/classhelper.conf（或 sites-available 并做软链）
|
||
# 2) 修改 server_name 与证书路径
|
||
# 3) nginx -t && systemctl reload nginx
|
||
# 4) 服务端 .env 中设置 TRUST_PROXY=1（否则限流按代理 IP 统计）
|
||
# 以及 CORS_ORIGIN=https://class.example.com
|
||
# ---------------------------------------------------------------------------
|
||
|
||
# 上游：本机运行的服务端（Windows 安装包 / Docker / 手动启动均适用）
|
||
upstream classhelper_backend {
|
||
server 127.0.0.1:4000;
|
||
keepalive 32;
|
||
}
|
||
|
||
# HTTP -> HTTPS 跳转
|
||
server {
|
||
listen 80;
|
||
listen [::]:80;
|
||
server_name class.example.com;
|
||
|
||
# Let's Encrypt 校验目录（如使用 certbot --webroot）
|
||
location /.well-known/acme-challenge/ {
|
||
root /var/www/certbot;
|
||
}
|
||
|
||
location / {
|
||
return 301 https://$host$request_uri;
|
||
}
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl;
|
||
listen [::]:443 ssl;
|
||
http2 on;
|
||
server_name class.example.com;
|
||
|
||
# ---------------------------------------------------------------- 证书
|
||
ssl_certificate /etc/nginx/certs/class.example.com.crt;
|
||
ssl_certificate_key /etc/nginx/certs/class.example.com.key;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||
ssl_session_cache shared:SSL:10m;
|
||
ssl_session_timeout 1d;
|
||
|
||
# ---------------------------------------------------------------- 基础
|
||
client_max_body_size 8m;
|
||
charset utf-8;
|
||
access_log /var/log/nginx/classhelper.access.log;
|
||
error_log /var/log/nginx/classhelper.error.log warn;
|
||
|
||
# 安全响应头（应用层已用 helmet 设置，这里作为兜底）
|
||
add_header X-Content-Type-Options nosniff always;
|
||
add_header X-Frame-Options SAMEORIGIN always;
|
||
add_header Referrer-Policy no-referrer always;
|
||
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
|
||
|
||
# gzip（静态资源与接口响应）
|
||
gzip on;
|
||
gzip_comp_level 5;
|
||
gzip_min_length 1024;
|
||
gzip_types text/plain text/css application/json application/javascript application/manifest+json image/svg+xml;
|
||
|
||
# ---------------------------------------------------------------- WebSocket（Socket.IO）
|
||
location /socket.io/ {
|
||
proxy_pass http://classhelper_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_read_timeout 3600s;
|
||
proxy_send_timeout 3600s;
|
||
proxy_buffering off;
|
||
}
|
||
|
||
# ---------------------------------------------------------------- 静态资源（带哈希，长缓存）
|
||
location /assets/ {
|
||
proxy_pass http://classhelper_backend;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
expires 1y;
|
||
add_header Cache-Control "public, immutable";
|
||
access_log off;
|
||
}
|
||
|
||
# ---------------------------------------------------------------- 接口与页面
|
||
# 课件流式上传（其余接口继续沿用 8 MB 限制）
|
||
location /api/courseware/ {
|
||
client_max_body_size 512m;
|
||
proxy_pass http://classhelper_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_request_buffering off;
|
||
proxy_buffering off;
|
||
proxy_read_timeout 1800s;
|
||
proxy_send_timeout 1800s;
|
||
}
|
||
|
||
location / {
|
||
proxy_pass http://classhelper_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header Connection "";
|
||
proxy_read_timeout 120s;
|
||
proxy_connect_timeout 10s;
|
||
}
|
||
}
|