From ac105a8c0ba9d566af8ac6d57e85d8c10721ea2a Mon Sep 17 00:00:00 2001 From: hailin Date: Fri, 9 Jan 2026 08:24:28 -0800 Subject: [PATCH] =?UTF-8?q?fix:=20nginx=E9=85=8D=E7=BD=AE=E6=94=AF?= =?UTF-8?q?=E6=8C=81=E5=8A=A8=E6=80=81=E8=A7=A3=E6=9E=90=EF=BC=8C=E8=A7=A3?= =?UTF-8?q?=E5=86=B3=E5=90=8E=E7=AB=AF=E6=9C=8D=E5=8A=A1=E4=B8=8D=E5=8F=AF?= =?UTF-8?q?=E7=94=A8=E6=97=B6=E5=90=AF=E5=8A=A8=E5=A4=B1=E8=B4=A5=E9=97=AE?= =?UTF-8?q?=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 移除静态upstream定义，改用Docker DNS resolver动态解析 - 移除Docker nginx的SSL配置（系统nginx已处理SSL） - 使用set变量方式引用后端服务，避免启动时DNS解析失败 Co-Authored-By: Claude Opus 4.5 --- nginx/conf.d/default.conf | 63 +++++++-------------------------------- nginx/nginx.conf | 13 ++------ 2 files changed, 14 insertions(+), 62 deletions(-) diff --git a/nginx/conf.d/default.conf b/nginx/conf.d/default.conf index 3788b6a..cc976cd 100644 --- a/nginx/conf.d/default.conf +++ b/nginx/conf.d/default.conf @@ -1,7 +1,8 @@ #=============================================================================== -# iConsulting Nginx 配置 +# iConsulting Docker Nginx 配置 # -# 域名: iconsulting.szaiai.com +# 注意: 此 Nginx 运行在 Docker 容器内，监听 80 端口 +# 系统 Nginx 负责 SSL 终止，然后反向代理到此处 # # 路由规则: # / -> web-client (用户前端) @@ -11,55 +12,9 @@ # #=============================================================================== -# HTTP -> HTTPS 重定向 server { listen 80; - server_name iconsulting.szaiai.com; - - # Let's Encrypt 验证路径 - location /.well-known/acme-challenge/ { - root /var/www/certbot; - } - - # 健康检查端点 (不重定向) - location /health { - access_log off; - return 200 'OK'; - add_header Content-Type text/plain; - } - - # 其他请求重定向到 HTTPS - location / { - return 301 https://$host$request_uri; - } -} - -# HTTPS 主服务 -server { - listen 443 ssl http2; - server_name iconsulting.szaiai.com; - - # SSL 证书配置 - ssl_certificate /etc/nginx/ssl/fullchain.pem; - ssl_certificate_key /etc/nginx/ssl/privkey.pem; - - # SSL 优化配置 - ssl_session_timeout 1d; - ssl_session_cache shared:SSL:50m; - ssl_session_tickets off; - - # 现代 SSL 配置 - ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; - ssl_prefer_server_ciphers off; - - # HSTS (启用后浏览器会强制使用 HTTPS) - add_header Strict-Transport-Security "max-age=63072000" always; - - # 安全头 - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-Content-Type-Options "nosniff" always; - add_header X-XSS-Protection "1; mode=block" always; + server_name _; # 健康检查端点 location /health { @@ -96,7 +51,9 @@ server { # API 请求代理到 Kong location /api/ { - proxy_pass http://kong_upstream/; + # 使用变量实现动态解析，避免启动时服务不可用导致失败 + set $kong_upstream kong:8000; + proxy_pass http://$kong_upstream/; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; @@ -116,7 +73,8 @@ server { # WebSocket 代理 location /ws/ { - proxy_pass http://websocket_upstream/; + set $ws_upstream conversation-service:3004; + proxy_pass http://$ws_upstream/; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; @@ -133,7 +91,8 @@ server { # Socket.IO 专用路径 location /socket.io/ { - proxy_pass http://websocket_upstream/socket.io/; + set $ws_upstream conversation-service:3004; + proxy_pass http://$ws_upstream/socket.io/; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; diff --git a/nginx/nginx.conf b/nginx/nginx.conf index ee23ea3..2af4f12 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -36,16 +36,9 @@ http { # 请求大小限制 client_max_body_size 50M; - # 上游服务定义 - upstream kong_upstream { - server kong:8000; - keepalive 32; - } - - upstream websocket_upstream { - server conversation-service:3004; - keepalive 32; - } + # Docker DNS 解析器 (允许动态解析服务名) + resolver 127.0.0.11 valid=10s ipv6=off; + resolver_timeout 5s; include /etc/nginx/conf.d/*.conf; }