521 lines
16 KiB
Plaintext
521 lines
16 KiB
Plaintext
# shanxia2.0 一体化门户 - Nginx 完整生产配置
|
||
# 部署路径：/etc/nginx/conf.d/shanxia2.0.conf
|
||
#
|
||
# 访问地址：
|
||
# https://w.shanxiachem.com （门户 Web + /api + 兼容 /ruoyi）
|
||
# http://w.shanxiachem.com
|
||
# http://121.43.228.102:9911 （兼容原 IP 访问）
|
||
# https://res.shanxiachem.com/ruoyi/ （附件 / MinIO 专用域名，推荐）
|
||
#
|
||
# 附件（MinIO bucket=ruoyi）：
|
||
# https://res.shanxiachem.com/ruoyi/<object-key>
|
||
# https://w.shanxiachem.com/ruoyi/<object-key> （兼容，可逐步切到 res）
|
||
# → 反代到 http://127.0.0.1:9000/ruoyi/<object-key>
|
||
#
|
||
# 应用侧建议（切到 res 后）：
|
||
# 后端 MINIO_BASE_URL=https://res.shanxiachem.com/ruoyi
|
||
# 前端 VITE_MINIO_BASE_URL=https://res.shanxiachem.com/ruoyi
|
||
#
|
||
# 证书：
|
||
# w → /iflytek/shanxia2.0/w.shanxiachem.com_nginx_cert/
|
||
# res → /iflytek/shanxia2.0/27488117_res.shanxiachem.com_nginx/
|
||
#
|
||
# 生效：
|
||
# nginx -t && nginx -s reload
|
||
|
||
# =========================
|
||
# 1) HTTPS：w.shanxiachem.com:443
|
||
# =========================
|
||
server {
|
||
listen 443 ssl;
|
||
server_name w.shanxiachem.com;
|
||
|
||
ssl_certificate /iflytek/shanxia2.0/w.shanxiachem.com_nginx_cert/w.shanxiachem.com.pem;
|
||
ssl_certificate_key /iflytek/shanxia2.0/w.shanxiachem.com_nginx_cert/w.shanxiachem.com.key;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||
ssl_prefer_server_ciphers on;
|
||
ssl_session_cache shared:SSL:10m;
|
||
ssl_session_timeout 10m;
|
||
|
||
root /iflytek/shanxia2.0/web/dist;
|
||
index index.html index.htm;
|
||
|
||
client_max_body_size 50M;
|
||
|
||
# access_log /iflytek/soft/nginx/nginx120/logs/shanxia2.0-access.log main;
|
||
# error_log /iflytek/soft/nginx/nginx120/logs/shanxia2.0-error.log warn;
|
||
|
||
gzip on;
|
||
gzip_vary on;
|
||
gzip_min_length 1024;
|
||
gzip_comp_level 6;
|
||
gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml application/json application/x-font-ttf font/opentype image/svg+xml;
|
||
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
|
||
location ^~ /api/ {
|
||
proxy_pass http://127.0.0.1:9111;
|
||
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header X-Forwarded-Port $server_port;
|
||
|
||
proxy_set_header Authorization $http_authorization;
|
||
proxy_pass_header Authorization;
|
||
|
||
# 归档 ZIP 等导出需下载多附件，易超过 60s；与前端 planApi.export timeout 对齐
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 3600s;
|
||
proxy_read_timeout 3600s;
|
||
proxy_buffering off;
|
||
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods 'GET, POST, PUT, DELETE, OPTIONS, PATCH' always;
|
||
add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
|
||
|
||
if ($request_method = 'OPTIONS') {
|
||
return 204;
|
||
}
|
||
}
|
||
|
||
# MinIO（bucket=ruoyi）；兼容旧链接，推荐逐步切到 res.shanxiachem.com
|
||
location ^~ /ruoyi/ {
|
||
proxy_pass http://127.0.0.1:9000;
|
||
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 60s;
|
||
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods 'GET, HEAD, OPTIONS' always;
|
||
|
||
if ($request_method = 'OPTIONS') {
|
||
return 204;
|
||
}
|
||
}
|
||
|
||
location = /health {
|
||
proxy_pass http://127.0.0.1:9111/health;
|
||
proxy_set_header Host $host;
|
||
access_log off;
|
||
}
|
||
|
||
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2|ttf|eot)$ {
|
||
expires 1y;
|
||
add_header Cache-Control "public, immutable";
|
||
try_files $uri =404;
|
||
add_header Access-Control-Allow-Origin *;
|
||
}
|
||
|
||
location = /index.html {
|
||
expires -1;
|
||
add_header Cache-Control "no-store, no-cache, must-revalidate";
|
||
}
|
||
|
||
location ^~ /shanxia-static/ {
|
||
alias /iflytek/shanxia2.0/app/assets/;
|
||
autoindex off;
|
||
expires 30d;
|
||
add_header Cache-Control "public, max-age=2592000";
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods 'GET, HEAD, OPTIONS' always;
|
||
|
||
if ($request_method = 'OPTIONS') {
|
||
return 204;
|
||
}
|
||
}
|
||
|
||
location = /shanxia-static/health {
|
||
access_log off;
|
||
default_type text/plain;
|
||
return 200 "shanxia miniprogram static ok\n";
|
||
}
|
||
|
||
location ^~ /src/ {
|
||
root /iflytek/shanxia2.0/web/dist;
|
||
autoindex off;
|
||
expires 30d;
|
||
add_header Cache-Control "public, max-age=2592000";
|
||
add_header Access-Control-Allow-Origin * always;
|
||
try_files $uri =404;
|
||
}
|
||
|
||
location / {
|
||
try_files $uri $uri/ /index.html;
|
||
}
|
||
|
||
location /health-web {
|
||
access_log off;
|
||
default_type text/plain;
|
||
return 200 "shanxia2.0 web healthy\n";
|
||
}
|
||
|
||
location ~ /\. {
|
||
deny all;
|
||
access_log off;
|
||
log_not_found off;
|
||
}
|
||
|
||
error_page 404 /index.html;
|
||
error_page 500 502 503 504 /50x.html;
|
||
|
||
location = /50x.html {
|
||
root /iflytek/soft/nginx/nginx120/html;
|
||
internal;
|
||
}
|
||
}
|
||
|
||
# =========================
|
||
# 2) HTTP：w.shanxiachem.com:80（与 HTTPS 并存，不强制跳转）
|
||
# =========================
|
||
server {
|
||
listen 80;
|
||
server_name w.shanxiachem.com;
|
||
|
||
root /iflytek/shanxia2.0/web/dist;
|
||
index index.html index.htm;
|
||
|
||
client_max_body_size 50M;
|
||
|
||
gzip on;
|
||
gzip_vary on;
|
||
gzip_min_length 1024;
|
||
gzip_comp_level 6;
|
||
gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml application/json application/x-font-ttf font/opentype image/svg+xml;
|
||
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
|
||
location ^~ /api/ {
|
||
proxy_pass http://127.0.0.1:9111;
|
||
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header X-Forwarded-Port $server_port;
|
||
|
||
proxy_set_header Authorization $http_authorization;
|
||
proxy_pass_header Authorization;
|
||
|
||
# 归档 ZIP 等导出需下载多附件，易超过 60s；与前端 planApi.export timeout 对齐
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 3600s;
|
||
proxy_read_timeout 3600s;
|
||
proxy_buffering off;
|
||
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods 'GET, POST, PUT, DELETE, OPTIONS, PATCH' always;
|
||
add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
|
||
|
||
if ($request_method = 'OPTIONS') {
|
||
return 204;
|
||
}
|
||
}
|
||
|
||
location ^~ /ruoyi/ {
|
||
proxy_pass http://127.0.0.1:9000;
|
||
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 60s;
|
||
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods 'GET, HEAD, OPTIONS' always;
|
||
|
||
if ($request_method = 'OPTIONS') {
|
||
return 204;
|
||
}
|
||
}
|
||
|
||
location = /health {
|
||
proxy_pass http://127.0.0.1:9111/health;
|
||
proxy_set_header Host $host;
|
||
access_log off;
|
||
}
|
||
|
||
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2|ttf|eot)$ {
|
||
expires 1y;
|
||
add_header Cache-Control "public, immutable";
|
||
try_files $uri =404;
|
||
add_header Access-Control-Allow-Origin *;
|
||
}
|
||
|
||
location = /index.html {
|
||
expires -1;
|
||
add_header Cache-Control "no-store, no-cache, must-revalidate";
|
||
}
|
||
|
||
location ^~ /shanxia-static/ {
|
||
alias /iflytek/shanxia2.0/app/assets/;
|
||
autoindex off;
|
||
expires 30d;
|
||
add_header Cache-Control "public, max-age=2592000";
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods 'GET, HEAD, OPTIONS' always;
|
||
|
||
if ($request_method = 'OPTIONS') {
|
||
return 204;
|
||
}
|
||
}
|
||
|
||
location = /shanxia-static/health {
|
||
access_log off;
|
||
default_type text/plain;
|
||
return 200 "shanxia miniprogram static ok\n";
|
||
}
|
||
|
||
location ^~ /src/ {
|
||
root /iflytek/shanxia2.0/web/dist;
|
||
autoindex off;
|
||
expires 30d;
|
||
add_header Cache-Control "public, max-age=2592000";
|
||
add_header Access-Control-Allow-Origin * always;
|
||
try_files $uri =404;
|
||
}
|
||
|
||
location / {
|
||
try_files $uri $uri/ /index.html;
|
||
}
|
||
|
||
location /health-web {
|
||
access_log off;
|
||
default_type text/plain;
|
||
return 200 "shanxia2.0 web healthy\n";
|
||
}
|
||
|
||
location ~ /\. {
|
||
deny all;
|
||
access_log off;
|
||
log_not_found off;
|
||
}
|
||
|
||
error_page 404 /index.html;
|
||
error_page 500 502 503 504 /50x.html;
|
||
|
||
location = /50x.html {
|
||
root /iflytek/soft/nginx/nginx120/html;
|
||
internal;
|
||
}
|
||
}
|
||
|
||
# =========================
|
||
# 3) 兼容原 IP:9911 访问
|
||
# =========================
|
||
server {
|
||
listen 9911;
|
||
server_name 121.43.228.102 w.shanxiachem.com;
|
||
|
||
root /iflytek/shanxia2.0/web/dist;
|
||
index index.html index.htm;
|
||
|
||
client_max_body_size 50M;
|
||
|
||
gzip on;
|
||
gzip_vary on;
|
||
gzip_min_length 1024;
|
||
gzip_comp_level 6;
|
||
gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml application/json application/x-font-ttf font/opentype image/svg+xml;
|
||
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
|
||
location ^~ /api/ {
|
||
proxy_pass http://127.0.0.1:9111;
|
||
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header X-Forwarded-Port $server_port;
|
||
|
||
proxy_set_header Authorization $http_authorization;
|
||
proxy_pass_header Authorization;
|
||
|
||
# 归档 ZIP 等导出需下载多附件，易超过 60s；与前端 planApi.export timeout 对齐
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 3600s;
|
||
proxy_read_timeout 3600s;
|
||
proxy_buffering off;
|
||
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods 'GET, POST, PUT, DELETE, OPTIONS, PATCH' always;
|
||
add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
|
||
|
||
if ($request_method = 'OPTIONS') {
|
||
return 204;
|
||
}
|
||
}
|
||
|
||
location ^~ /ruoyi/ {
|
||
proxy_pass http://127.0.0.1:9000;
|
||
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 60s;
|
||
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods 'GET, HEAD, OPTIONS' always;
|
||
|
||
if ($request_method = 'OPTIONS') {
|
||
return 204;
|
||
}
|
||
}
|
||
|
||
location = /health {
|
||
proxy_pass http://127.0.0.1:9111/health;
|
||
proxy_set_header Host $host;
|
||
access_log off;
|
||
}
|
||
|
||
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2|ttf|eot)$ {
|
||
expires 1y;
|
||
add_header Cache-Control "public, immutable";
|
||
try_files $uri =404;
|
||
add_header Access-Control-Allow-Origin *;
|
||
}
|
||
|
||
location = /index.html {
|
||
expires -1;
|
||
add_header Cache-Control "no-store, no-cache, must-revalidate";
|
||
}
|
||
|
||
location ^~ /shanxia-static/ {
|
||
alias /iflytek/shanxia2.0/app/assets/;
|
||
autoindex off;
|
||
expires 30d;
|
||
add_header Cache-Control "public, max-age=2592000";
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods 'GET, HEAD, OPTIONS' always;
|
||
|
||
if ($request_method = 'OPTIONS') {
|
||
return 204;
|
||
}
|
||
}
|
||
|
||
location = /shanxia-static/health {
|
||
access_log off;
|
||
default_type text/plain;
|
||
return 200 "shanxia miniprogram static ok\n";
|
||
}
|
||
|
||
location ^~ /src/ {
|
||
root /iflytek/shanxia2.0/web/dist;
|
||
autoindex off;
|
||
expires 30d;
|
||
add_header Cache-Control "public, max-age=2592000";
|
||
add_header Access-Control-Allow-Origin * always;
|
||
try_files $uri =404;
|
||
}
|
||
|
||
location / {
|
||
try_files $uri $uri/ /index.html;
|
||
}
|
||
|
||
location /health-web {
|
||
access_log off;
|
||
default_type text/plain;
|
||
return 200 "shanxia2.0 web healthy\n";
|
||
}
|
||
|
||
location ~ /\. {
|
||
deny all;
|
||
access_log off;
|
||
log_not_found off;
|
||
}
|
||
|
||
error_page 404 /index.html;
|
||
error_page 500 502 503 504 /50x.html;
|
||
|
||
location = /50x.html {
|
||
root /iflytek/soft/nginx/nginx120/html;
|
||
internal;
|
||
}
|
||
}
|
||
|
||
# =========================
|
||
# 4) HTTPS：res.shanxiachem.com:443（附件 / MinIO 专用）
|
||
# =========================
|
||
server {
|
||
listen 443 ssl;
|
||
server_name res.shanxiachem.com;
|
||
|
||
ssl_certificate /iflytek/shanxia2.0/27488117_res.shanxiachem.com_nginx/res.shanxiachem.com.pem;
|
||
ssl_certificate_key /iflytek/shanxia2.0/27488117_res.shanxiachem.com_nginx/res.shanxiachem.com.key;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||
ssl_prefer_server_ciphers on;
|
||
ssl_session_cache shared:SSL:10m;
|
||
ssl_session_timeout 10m;
|
||
|
||
client_max_body_size 50M;
|
||
|
||
# access_log /iflytek/soft/nginx/nginx120/logs/res.shanxiachem.com-access.log main;
|
||
# error_log /iflytek/soft/nginx/nginx120/logs/res.shanxiachem.com-error.log warn;
|
||
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
|
||
location ^~ /ruoyi/ {
|
||
proxy_pass http://127.0.0.1:9000;
|
||
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 60s;
|
||
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods 'GET, HEAD, OPTIONS' always;
|
||
add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
|
||
|
||
if ($request_method = 'OPTIONS') {
|
||
return 204;
|
||
}
|
||
}
|
||
|
||
location = /health {
|
||
access_log off;
|
||
default_type text/plain;
|
||
return 200 "res.shanxiachem.com ok\n";
|
||
}
|
||
|
||
# 非附件路径 404，避免误当成门户站
|
||
location / {
|
||
return 404;
|
||
}
|
||
}
|
||
|
||
# =========================
|
||
# 5) HTTP：res.shanxiachem.com:80 → HTTPS
|
||
# =========================
|
||
server {
|
||
listen 80;
|
||
server_name res.shanxiachem.com;
|
||
return 301 https://$host$request_uri;
|
||
}
|