6814fa2a62
Add deployment traces for the JPpro proxy node, RackNerd origin hosts, catproxy boundary changes, local speed checks, and Sub2API rate-limit behavior. Keep remote secrets excluded while tracking sanitized nginx, compose, plan, and operational memory documents.
54 lines
1.8 KiB
Plaintext
54 lines
1.8 KiB
Plaintext
# 后端入口网关 nginx 模板，部署在 sub2api 所在服务器。
|
|
# 适合放到 Debian/Ubuntu 默认 nginx 的 /etc/nginx/conf.d/ 下；
|
|
# 该目录通常被包含在 http {} 作用域内，因此可以使用 map 指令。
|
|
# 目标：后端公网入口即使被扫到，也必须同时满足来源 IP 白名单和共享密钥。
|
|
# 真实 token 不写入模板产物；后端通过 root-only map 条目文件 include。
|
|
# 文件内容示例： "real-token" 1;
|
|
|
|
map $http_x_proxy_ng_token $proxy_ng_token_valid {
|
|
default 0;
|
|
include {{PROXY_NG_TOKEN_MAP_FILE}};
|
|
}
|
|
|
|
map $http_x_real_ip $proxy_ng_real_ip {
|
|
default $http_x_real_ip;
|
|
"" $remote_addr;
|
|
}
|
|
|
|
server {
|
|
listen 8443 ssl http2;
|
|
server_name {{BACKEND_GATEWAY_SERVER_NAME}};
|
|
|
|
ssl_certificate {{BACKEND_TLS_CERT_PATH}};
|
|
ssl_certificate_key {{BACKEND_TLS_KEY_PATH}};
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
|
|
# 目标机器上应同时配置系统防火墙或云安全组，只允许 proxy-ng 节点 IP 访问 8443。
|
|
allow {{PROXY_NG_NODE_IP_1}};
|
|
allow {{PROXY_NG_NODE_IP_2}};
|
|
deny all;
|
|
|
|
if ($proxy_ng_token_valid = 0) {
|
|
return 403;
|
|
}
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:8080;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $proxy_ng_real_ip;
|
|
proxy_set_header X-Forwarded-For $http_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
|
|
# 密钥只用于入口网关校验，不能继续传给 sub2api。
|
|
proxy_set_header X-Proxy-Ng-Token "";
|
|
proxy_set_header X-Proxy-Ng-Node $http_x_proxy_ng_node;
|
|
|
|
proxy_read_timeout 3600s;
|
|
proxy_send_timeout 3600s;
|
|
proxy_buffering off;
|
|
proxy_request_buffering off;
|
|
}
|
|
}
|