116 lines
5.1 KiB
Plaintext
116 lines
5.1 KiB
Plaintext
# ════════════════════════════════════════════════════════════════
|
|
# 光湖灯塔 · Nginx 反代
|
|
# Sovereign: TCS-0002∞ · 国作登字-2026-A-00037559
|
|
# 守护: 铸渊 · ICE-GL-ZY001
|
|
#
|
|
# 端口分配:
|
|
# 80 → http (备案前临时入口, 备案后只重定向到 443)
|
|
# 443 → https (灯塔门户 + Gitea + 总控台 API)
|
|
# 3000 → Gitea (内部, 仅 127.0.0.1 监听, 由本配置反代)
|
|
#
|
|
# 子路径分配:
|
|
# / → 灯塔门户 (公告 / 论坛 / 广播, 占位)
|
|
# /git/ → Gitea Web UI
|
|
# /api/v1/ → Gitea API
|
|
# /api/lighthouse/ → 灯塔总控台 API (操作系统总控, 旁挂)
|
|
# /__switch/ → channel-switcher (复用既有标准插座)
|
|
# ════════════════════════════════════════════════════════════════
|
|
|
|
upstream gitea_upstream {
|
|
server 127.0.0.1:3000;
|
|
keepalive 16;
|
|
}
|
|
|
|
# 灯塔总控台占位 (PM2 进程 lighthouse-console 后续接入)
|
|
upstream lighthouse_console {
|
|
server 127.0.0.1:3100;
|
|
keepalive 8;
|
|
}
|
|
|
|
server {
|
|
listen 80 default_server;
|
|
listen [::]:80 default_server;
|
|
server_name _;
|
|
|
|
# 备案前临时直接服务, 备案后请改为 301 redirect 到 https
|
|
client_max_body_size 200m;
|
|
|
|
access_log /data/logs/nginx/lighthouse-access.log;
|
|
error_log /data/logs/nginx/lighthouse-error.log;
|
|
|
|
# ── 灯塔门户根路径 (静态 + SSE) ──────────────────────────
|
|
location = / {
|
|
return 200 '光湖灯塔 · HoloLake Lighthouse · 国作登字-2026-A-00037559\n灯塔门户构建中...\nGitea: /git/\n';
|
|
add_header Content-Type "text/plain; charset=utf-8";
|
|
}
|
|
|
|
# ── Gitea Web UI ─────────────────────────────────────────
|
|
location /git/ {
|
|
proxy_pass http://gitea_upstream/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_read_timeout 300s;
|
|
proxy_request_buffering off;
|
|
client_max_body_size 500m;
|
|
}
|
|
|
|
# ── Gitea API (供 GitHub Actions 兼容工具调用) ──────────
|
|
location /api/v1/ {
|
|
proxy_pass http://gitea_upstream/api/v1/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_read_timeout 300s;
|
|
}
|
|
|
|
# ── 灯塔总控台 API 占位 ─────────────────────────────────
|
|
location /api/lighthouse/ {
|
|
proxy_pass http://lighthouse_console/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_read_timeout 300s;
|
|
# 总控台未启动时返回 503 而不是 502
|
|
error_page 502 = @lighthouse_pending;
|
|
}
|
|
|
|
location @lighthouse_pending {
|
|
return 503 '灯塔总控台尚未启动 (lighthouse-console PM2 进程未运行)\n';
|
|
add_header Content-Type "text/plain; charset=utf-8";
|
|
}
|
|
|
|
# ── 健康检查 ─────────────────────────────────────────────
|
|
location = /health {
|
|
return 200 'lighthouse-cn ok\n';
|
|
add_header Content-Type "text/plain; charset=utf-8";
|
|
}
|
|
|
|
# ── ACME challenge (certbot 用) ──────────────────────────
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/html;
|
|
}
|
|
}
|
|
|
|
# ════════════════════════════════════════════════════════════════
|
|
# 备案后启用 HTTPS 时, 反注释以下 server 块, 并把 80 server 改成 301
|
|
# ════════════════════════════════════════════════════════════════
|
|
# server {
|
|
# listen 443 ssl http2;
|
|
# server_name __DOMAIN__;
|
|
#
|
|
# ssl_certificate /etc/letsencrypt/live/__DOMAIN__/fullchain.pem;
|
|
# ssl_certificate_key /etc/letsencrypt/live/__DOMAIN__/privkey.pem;
|
|
# ssl_protocols TLSv1.2 TLSv1.3;
|
|
# ssl_ciphers HIGH:!aNULL:!MD5;
|
|
# ssl_prefer_server_ciphers on;
|
|
#
|
|
# # ... 其余 location 与 80 server 块完全相同
|
|
# }
|