D123: 新加坡服务器 Nginx 配置 + Outline 部署状态文档
- 保存当前 Nginx sites-enabled 完整配置（含 Outline/Dex/brain-db 代理块） - Outline Wiki 部署状态报告（容器/配置/卡点/验证方法） - 记录当前卡点：Frontend API 请求 Referer 为空
This commit is contained in:
冰朔
parent
7aacb703d6
commit
ab11fa46e4
79
brain/operations/BS-SG-001/OUTLINE-DEPLOYMENT-STATUS.md
Normal file
79
brain/operations/BS-SG-001/OUTLINE-DEPLOYMENT-STATUS.md
Normal file
@ -0,0 +1,79 @@
|
||||
# ════════════════════════════════════════════
|
||||
# Outline Wiki + Dex OIDC 部署状态
|
||||
# 服务器：BS-SG-001 (新加坡)
|
||||
# 时间：2026-06-04 D123
|
||||
# ════════════════════════════════════════════
|
||||
|
||||
## 容器状态
|
||||
```
|
||||
outline → port 3090 (内部 3000) image: outlinewiki/outline:0.80.2
|
||||
outline-dex → port 5556 image: dexidp/dex:latest
|
||||
outline-postgres → 内部网络 image: postgres:16-alpine
|
||||
outline-redis → 内部网络 image: redis:7-alpine
|
||||
```
|
||||
状态：全部 healthy ✅
|
||||
|
||||
## 配置路径
|
||||
- Docker Compose: `/opt/outline/docker-compose.yml`
|
||||
- Dex 配置: `/opt/outline/dex-config.yml`
|
||||
- 数据目录: `/opt/outline/outline-data/`, `postgres-data/`, `redis-data/`
|
||||
|
||||
## 关键配置项
|
||||
- Outline URL: `https://guanghubingshuo.com/outline`
|
||||
- Dex Issuer: `https://guanghubingshuo.com/dex`
|
||||
- OIDC Redirect: `https://guanghubingshuo.com/outline/auth/oidc.callback`
|
||||
- OIDC Provider: `光湖登录`
|
||||
- 管理员: `bingshuo` (静态密码，Dex mockCallback)
|
||||
|
||||
## Nginx 新增代理块
|
||||
| 路径 | 后端 | 用途 |
|
||||
|------|------|------|
|
||||
| `/outline/` | port 3090 | Outline Wiki |
|
||||
| `/dex/` | port 5556 | Dex OIDC |
|
||||
| `/static/` | port 3090 | Outline JS/CSS 静态资源 |
|
||||
| `/fonts/` | port 3090 | Outline 字体 |
|
||||
| `/auth/oidc` | port 3090 | OIDC 登录跳转 |
|
||||
| `/brain-db/` | port 3914 | 人格体数据库 |
|
||||
|
||||
## Nginx 关键机制
|
||||
1. **API 条件路由**：`map $http_referer` 按 Referer 来源选择 /api/ 后端
|
||||
- 来源包含 "outline" → port 3090
|
||||
- 其他 → port 3998（原服务不受影响）
|
||||
2. **Referrer-Policy 重写**：/outline/ 覆盖 `no-referrer` → `same-origin`
|
||||
- Outline 默认禁止浏览器发送 Referer，导致 map 路由失效
|
||||
|
||||
## ⚠️ 当前卡点 — 未解决
|
||||
Outline 页面显示 "Failed to load configuration"。
|
||||
|
||||
### 已完成排查
|
||||
- ✅ 静态资源（/static/, /fonts/）正常加载
|
||||
- ✅ /outline/ 页面正常返回
|
||||
- ✅ /outline/api/auth.config 直接请求返回正确数据
|
||||
- ✅ OIDC 跳转链路打通（/outline/auth/oidc → /dex/auth → redirect）
|
||||
- ✅ Nginx 语法通过并 reload
|
||||
|
||||
### 推测原因
|
||||
1. **Referer 路由仍失效**：虽然修改了 referrer-policy 为 same-origin，
|
||||
但 Service Worker (`/static/sw.js`) 可能拦截 fetch 请求且不透传 Referer
|
||||
2. **SW 干扰**：Outline 使用的 Service Worker 可能自己的 fetch handler 中
|
||||
使用了 `no-referrer` 策略，覆盖了页面级的 referrer-policy
|
||||
3. **建议方向**：
|
||||
- 方案 A：禁用 SW（拦截 /static/sw.js 返回空）测试是否修复
|
||||
- 方案 B：用子域名 `outline.guanghubingshuo.com` 完全避免子路径问题
|
||||
- 方案 C：Nginx 层注入自定义 header（如 X-Outline-Proxy: 1）并在 map 中使用
|
||||
|
||||
### 验证方法
|
||||
```bash
|
||||
# 检查 Nginx 日志确认 Referer 是否已发送
|
||||
tail -f /var/log/nginx/access.log | grep "/api/"
|
||||
|
||||
# 直接测试（带 Referer）
|
||||
curl -X POST https://guanghubingshuo.com/api/auth.config \
|
||||
-H "Referer: https://guanghubingshuo.com/outline/" \
|
||||
-H "Content-Type: application/json" -d '{}'
|
||||
# 预期：{"data":{"providers":[...]},"status":200,"ok":true}
|
||||
```
|
||||
|
||||
## 首页卡片
|
||||
已添加第5张卡片「🧠 语言层数据库」→ `/outline/`
|
||||
文件位置：`/var/www/html/index.html`
|
||||
175
brain/operations/BS-SG-001/nginx-guanghubingshuo.conf
Normal file
175
brain/operations/BS-SG-001/nginx-guanghubingshuo.conf
Normal file
@ -0,0 +1,175 @@
|
||||
# ============================================================
|
||||
# 新加坡 BS-SG-001 Nginx 配置
|
||||
# 最后更新：2026-06-04 D123
|
||||
# 路径：/etc/nginx/sites-enabled/guanghubingshuo.com
|
||||
# ============================================================
|
||||
|
||||
# NOTE: sites-enabled 是独立文件，非 sites-available 的符号链接！
|
||||
# 修改时必须直接编辑 sites-enabled/guanghubingshuo.com
|
||||
|
||||
# Outline API 条件路由：按 Referer 来源选择后端
|
||||
map $http_referer $outline_api_upstream {
|
||||
default "http://127.0.0.1:3998";
|
||||
"~*outline" "http://127.0.0.1:3090";
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen 443 ssl http2;
|
||||
server_name guanghubingshuo.com www.guanghubingshuo.com;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/guanghubingshuo.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/guanghubingshuo.com/privkey.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
|
||||
root /var/www/html;
|
||||
index index.html;
|
||||
|
||||
location = /guanghu-repo/ {
|
||||
root /var/www/guanghu-repo;
|
||||
try_files /index.html =404;
|
||||
}
|
||||
location /guanghu-repo/files/ {
|
||||
alias /opt/zhuyuan/guanghulab/;
|
||||
autoindex on;
|
||||
autoindex_exact_size off;
|
||||
autoindex_localtime on;
|
||||
}
|
||||
location /guanghu-repo/api/ {
|
||||
proxy_pass http://127.0.0.1:3913/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
location /native/ { proxy_pass http://127.0.0.1:3913/; }
|
||||
location /api/ {
|
||||
proxy_pass $outline_api_upstream;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
}
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
location /juzi/aircraft/ {
|
||||
proxy_pass http://127.0.0.1:8001/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_read_timeout 300s;
|
||||
}
|
||||
location /juzi/ {
|
||||
proxy_pass http://127.0.0.1:3002/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
client_max_body_size 100m;
|
||||
}
|
||||
location /desk/ {
|
||||
proxy_pass http://127.0.0.1:3921/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
location /code/ {
|
||||
proxy_pass http://127.0.0.1:3001/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
client_max_body_size 100m;
|
||||
}
|
||||
# === D123 新增：人格体数据库 ===
|
||||
location /brain-db/ {
|
||||
proxy_pass http://127.0.0.1:3914/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
# === D123 新增：Dex OIDC 认证 ===
|
||||
location /dex/ {
|
||||
proxy_pass http://127.0.0.1:5556/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
# === D123 新增：Outline 静态资源 ===
|
||||
location /static/ {
|
||||
proxy_pass http://127.0.0.1:3090/static/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
expires 7d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
location /fonts/ {
|
||||
proxy_pass http://127.0.0.1:3090/fonts/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
# === D123 新增：OIDC 登录跳转（Outline 生成 root-relative 路径） ===
|
||||
location /auth/oidc {
|
||||
proxy_pass http://127.0.0.1:3090;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 30s;
|
||||
}
|
||||
# === D123 新增：Outline Wiki ===
|
||||
location /outline/ {
|
||||
proxy_pass http://127.0.0.1:3090/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
# Outline 默认返回 referrer-policy: no-referrer，导致 Referer 路由失效
|
||||
proxy_hide_header referrer-policy;
|
||||
add_header referrer-policy "same-origin" always;
|
||||
proxy_hide_header service-worker-allowed;
|
||||
}
|
||||
location /console/ {
|
||||
proxy_pass http://127.0.0.1:3920/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 86400;
|
||||
}
|
||||
location /hli/ {
|
||||
proxy_pass http://127.0.0.1:3010;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_buffering off;
|
||||
proxy_cache off;
|
||||
proxy_read_timeout 300s;
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user