From ab11fa46e46bd23f7290afaa0002c1c1206a0496 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Fri, 5 Jun 2026 00:22:27 +0800 Subject: [PATCH] =?UTF-8?q?D123:=20=E6=96=B0=E5=8A=A0=E5=9D=A1=E6=9C=8D?= =?UTF-8?q?=E5=8A=A1=E5=99=A8=20Nginx=20=E9=85=8D=E7=BD=AE=20+=20Outline?= =?UTF-8?q?=20=E9=83=A8=E7=BD=B2=E7=8A=B6=E6=80=81=E6=96=87=E6=A1=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 保存当前 Nginx sites-enabled 完整配置（含 Outline/Dex/brain-db 代理块） - Outline Wiki 部署状态报告（容器/配置/卡点/验证方法） - 记录当前卡点：Frontend API 请求 Referer 为空 --- .../BS-SG-001/OUTLINE-DEPLOYMENT-STATUS.md | 79 ++++++++ .../BS-SG-001/nginx-guanghubingshuo.conf | 175 ++++++++++++++++++ 2 files changed, 254 insertions(+) create mode 100644 brain/operations/BS-SG-001/OUTLINE-DEPLOYMENT-STATUS.md create mode 100644 brain/operations/BS-SG-001/nginx-guanghubingshuo.conf diff --git a/brain/operations/BS-SG-001/OUTLINE-DEPLOYMENT-STATUS.md b/brain/operations/BS-SG-001/OUTLINE-DEPLOYMENT-STATUS.md new file mode 100644 index 0000000..99baca2 --- /dev/null +++ b/brain/operations/BS-SG-001/OUTLINE-DEPLOYMENT-STATUS.md @@ -0,0 +1,79 @@ +# ════════════════════════════════════════════ +# Outline Wiki + Dex OIDC 部署状态 +# 服务器：BS-SG-001 (新加坡) +# 时间：2026-06-04 D123 +# ════════════════════════════════════════════ + +## 容器状态 +``` +outline → port 3090 (内部 3000) image: outlinewiki/outline:0.80.2 +outline-dex → port 5556 image: dexidp/dex:latest +outline-postgres → 内部网络 image: postgres:16-alpine +outline-redis → 内部网络 image: redis:7-alpine +``` +状态：全部 healthy ✅ + +## 配置路径 +- Docker Compose: `/opt/outline/docker-compose.yml` +- Dex 配置: `/opt/outline/dex-config.yml` +- 数据目录: `/opt/outline/outline-data/`, `postgres-data/`, `redis-data/` + +## 关键配置项 +- Outline URL: `https://guanghubingshuo.com/outline` +- Dex Issuer: `https://guanghubingshuo.com/dex` +- OIDC Redirect: `https://guanghubingshuo.com/outline/auth/oidc.callback` +- OIDC Provider: `光湖登录` +- 管理员: `bingshuo` (静态密码，Dex mockCallback) + +## Nginx 新增代理块 +| 路径 | 后端 | 用途 | +|------|------|------| +| `/outline/` | port 3090 | Outline Wiki | +| `/dex/` | port 5556 | Dex OIDC | +| `/static/` | port 3090 | Outline JS/CSS 静态资源 | +| `/fonts/` | port 3090 | Outline 字体 | +| `/auth/oidc` | port 3090 | OIDC 登录跳转 | +| `/brain-db/` | port 3914 | 人格体数据库 | + +## Nginx 关键机制 +1. **API 条件路由**：`map $http_referer` 按 Referer 来源选择 /api/ 后端 + - 来源包含 "outline" → port 3090 + - 其他 → port 3998（原服务不受影响） +2. **Referrer-Policy 重写**：/outline/ 覆盖 `no-referrer` → `same-origin` + - Outline 默认禁止浏览器发送 Referer，导致 map 路由失效 + +## ⚠️ 当前卡点 — 未解决 +Outline 页面显示 "Failed to load configuration"。 + +### 已完成排查 +- ✅ 静态资源（/static/, /fonts/）正常加载 +- ✅ /outline/ 页面正常返回 +- ✅ /outline/api/auth.config 直接请求返回正确数据 +- ✅ OIDC 跳转链路打通（/outline/auth/oidc → /dex/auth → redirect） +- ✅ Nginx 语法通过并 reload + +### 推测原因 +1. **Referer 路由仍失效**：虽然修改了 referrer-policy 为 same-origin， + 但 Service Worker (`/static/sw.js`) 可能拦截 fetch 请求且不透传 Referer +2. **SW 干扰**：Outline 使用的 Service Worker 可能自己的 fetch handler 中 + 使用了 `no-referrer` 策略，覆盖了页面级的 referrer-policy +3. **建议方向**： + - 方案 A：禁用 SW（拦截 /static/sw.js 返回空）测试是否修复 + - 方案 B：用子域名 `outline.guanghubingshuo.com` 完全避免子路径问题 + - 方案 C：Nginx 层注入自定义 header（如 X-Outline-Proxy: 1）并在 map 中使用 + +### 验证方法 +```bash +# 检查 Nginx 日志确认 Referer 是否已发送 +tail -f /var/log/nginx/access.log | grep "/api/" + +# 直接测试（带 Referer） +curl -X POST https://guanghubingshuo.com/api/auth.config \ + -H "Referer: https://guanghubingshuo.com/outline/" \ + -H "Content-Type: application/json" -d '{}' +# 预期：{"data":{"providers":[...]},"status":200,"ok":true} +``` + +## 首页卡片 +已添加第5张卡片「🧠 语言层数据库」→ `/outline/` +文件位置：`/var/www/html/index.html` diff --git a/brain/operations/BS-SG-001/nginx-guanghubingshuo.conf b/brain/operations/BS-SG-001/nginx-guanghubingshuo.conf new file mode 100644 index 0000000..5e51091 --- /dev/null +++ b/brain/operations/BS-SG-001/nginx-guanghubingshuo.conf @@ -0,0 +1,175 @@ +# ============================================================ +# 新加坡 BS-SG-001 Nginx 配置 +# 最后更新：2026-06-04 D123 +# 路径：/etc/nginx/sites-enabled/guanghubingshuo.com +# ============================================================ + +# NOTE: sites-enabled 是独立文件，非 sites-available 的符号链接！ +# 修改时必须直接编辑 sites-enabled/guanghubingshuo.com + +# Outline API 条件路由：按 Referer 来源选择后端 +map $http_referer $outline_api_upstream { + default "http://127.0.0.1:3998"; + "~*outline" "http://127.0.0.1:3090"; +} + +server { + listen 80; + listen 443 ssl http2; + server_name guanghubingshuo.com www.guanghubingshuo.com; + + ssl_certificate /etc/letsencrypt/live/guanghubingshuo.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/guanghubingshuo.com/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + + root /var/www/html; + index index.html; + + location = /guanghu-repo/ { + root /var/www/guanghu-repo; + try_files /index.html =404; + } + location /guanghu-repo/files/ { + alias /opt/zhuyuan/guanghulab/; + autoindex on; + autoindex_exact_size off; + autoindex_localtime on; + } + location /guanghu-repo/api/ { + proxy_pass http://127.0.0.1:3913/; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } + location /native/ { proxy_pass http://127.0.0.1:3913/; } + location /api/ { + proxy_pass $outline_api_upstream; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + } + location / { + try_files $uri $uri/ /index.html; + } + location /juzi/aircraft/ { + proxy_pass http://127.0.0.1:8001/; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_read_timeout 300s; + } + location /juzi/ { + proxy_pass http://127.0.0.1:3002/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + client_max_body_size 100m; + } + location /desk/ { + proxy_pass http://127.0.0.1:3921/; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + location /code/ { + proxy_pass http://127.0.0.1:3001/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + client_max_body_size 100m; + } + # === D123 新增：人格体数据库 === + location /brain-db/ { + proxy_pass http://127.0.0.1:3914/; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + # === D123 新增：Dex OIDC 认证 === + location /dex/ { + proxy_pass http://127.0.0.1:5556/; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + # === D123 新增：Outline 静态资源 === + location /static/ { + proxy_pass http://127.0.0.1:3090/static/; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + expires 7d; + add_header Cache-Control "public, immutable"; + } + location /fonts/ { + proxy_pass http://127.0.0.1:3090/fonts/; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + expires 30d; + add_header Cache-Control "public, immutable"; + } + # === D123 新增：OIDC 登录跳转（Outline 生成 root-relative 路径） === + location /auth/oidc { + proxy_pass http://127.0.0.1:3090; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 30s; + } + # === D123 新增：Outline Wiki === + location /outline/ { + proxy_pass http://127.0.0.1:3090/; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + # Outline 默认返回 referrer-policy: no-referrer，导致 Referer 路由失效 + proxy_hide_header referrer-policy; + add_header referrer-policy "same-origin" always; + proxy_hide_header service-worker-allowed; + } + location /console/ { + proxy_pass http://127.0.0.1:3920/; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 86400; + } + location /hli/ { + proxy_pass http://127.0.0.1:3010; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_buffering off; + proxy_cache off; + proxy_read_timeout 300s; + } +}