6814fa2a62
Add deployment traces for the JPpro proxy node, RackNerd origin hosts, catproxy boundary changes, local speed checks, and Sub2API rate-limit behavior. Keep remote secrets excluded while tracking sanitized nginx, compose, plan, and operational memory documents.
118 lines
4.0 KiB
Plaintext
118 lines
4.0 KiB
Plaintext
# proxy-ng 节点 nginx 模板。
|
||
# 部署时替换 {{DOMAIN}}、{{BACKEND_ORIGIN}}、{{BACKEND_ORIGIN_HOST}}、{{NODE_NAME}}、{{TLS_CERT_PATH}}、{{TLS_KEY_PATH}}。
|
||
# 真实 token 不写入模板产物；节点通过 root-only 文件 include，例如 /etc/nginx/proxy-ng/token.conf。
|
||
|
||
worker_processes auto;
|
||
pid /run/nginx.pid;
|
||
|
||
events {
|
||
worker_connections 1024;
|
||
multi_accept on;
|
||
}
|
||
|
||
http {
|
||
include /etc/nginx/mime.types;
|
||
default_type application/octet-stream;
|
||
|
||
sendfile on;
|
||
tcp_nopush on;
|
||
keepalive_timeout 30s;
|
||
keepalive_requests 100;
|
||
|
||
client_header_timeout 10s;
|
||
client_body_timeout 30s;
|
||
client_max_body_size 256m;
|
||
|
||
limit_conn_zone $binary_remote_addr zone=conn_per_ip:10m;
|
||
limit_req_zone $binary_remote_addr zone=req_per_ip:10m rate=30r/s;
|
||
limit_req_zone $binary_remote_addr zone=req_auth:10m rate=10r/m;
|
||
|
||
map $http_upgrade $connection_upgrade {
|
||
default upgrade;
|
||
"" close;
|
||
}
|
||
|
||
server {
|
||
listen 80;
|
||
server_name {{DOMAIN}};
|
||
return 301 https://$host$request_uri;
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl http2;
|
||
server_name {{DOMAIN}};
|
||
|
||
ssl_certificate {{TLS_CERT_PATH}};
|
||
ssl_certificate_key {{TLS_KEY_PATH}};
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_session_cache shared:SSL:20m;
|
||
ssl_session_timeout 10m;
|
||
|
||
include {{PROXY_NG_TOKEN_FILE}};
|
||
|
||
limit_conn conn_per_ip 20;
|
||
limit_req zone=req_per_ip burst=30 nodelay;
|
||
limit_req_status 429;
|
||
|
||
add_header X-Proxy-Ng-Node "{{NODE_NAME}}" always;
|
||
add_header X-Content-Type-Options nosniff always;
|
||
|
||
location = /health {
|
||
proxy_pass {{BACKEND_ORIGIN}}/health;
|
||
proxy_ssl_server_name on;
|
||
proxy_ssl_name {{BACKEND_ORIGIN_HOST}};
|
||
proxy_set_header Host {{BACKEND_ORIGIN_HOST}};
|
||
proxy_set_header X-Proxy-Ng-Token $proxy_ng_expected_token;
|
||
proxy_set_header X-Proxy-Ng-Node "{{NODE_NAME}}";
|
||
proxy_set_header X-Forwarded-Host $host;
|
||
proxy_set_header X-Forwarded-For $remote_addr;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_buffering off;
|
||
access_log off;
|
||
}
|
||
|
||
location ~ ^/api/v1/auth/(login|login/2fa|register|send-verify-code|forgot-password|reset-password) {
|
||
limit_conn conn_per_ip 5;
|
||
limit_req zone=req_auth burst=3 nodelay;
|
||
limit_req_status 429;
|
||
|
||
proxy_pass {{BACKEND_ORIGIN}};
|
||
proxy_ssl_server_name on;
|
||
proxy_ssl_name {{BACKEND_ORIGIN_HOST}};
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Connection "";
|
||
proxy_set_header Host {{BACKEND_ORIGIN_HOST}};
|
||
proxy_set_header X-Proxy-Ng-Token $proxy_ng_expected_token;
|
||
proxy_set_header X-Proxy-Ng-Node "{{NODE_NAME}}";
|
||
proxy_set_header X-Forwarded-Host $host;
|
||
proxy_set_header X-Forwarded-For $remote_addr;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_read_timeout 60s;
|
||
proxy_send_timeout 60s;
|
||
proxy_buffering off;
|
||
}
|
||
|
||
location / {
|
||
proxy_pass {{BACKEND_ORIGIN}};
|
||
proxy_ssl_server_name on;
|
||
proxy_ssl_name {{BACKEND_ORIGIN_HOST}};
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Connection "";
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Host {{BACKEND_ORIGIN_HOST}};
|
||
proxy_set_header X-Proxy-Ng-Token $proxy_ng_expected_token;
|
||
proxy_set_header X-Proxy-Ng-Node "{{NODE_NAME}}";
|
||
proxy_set_header X-Forwarded-Host $host;
|
||
proxy_set_header X-Forwarded-For $remote_addr;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_read_timeout 3600s;
|
||
proxy_send_timeout 3600s;
|
||
proxy_buffering off;
|
||
proxy_request_buffering off;
|
||
}
|
||
}
|
||
}
|