From 5c7e1f81aa7cfaa947a82c2f402f4ded237e8cf7 Mon Sep 17 00:00:00 2001
From: xiangning <xiangning@buildflow.local>
Date: Sun, 25 Oct 2026 16:13:50 +0800
Subject: [PATCH] fix(docker): add nginx.conf required by Dockerfile runtime
 stage

---
 apps/web-antdv-next/nginx.conf | 100 +++++++++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)
 create mode 100644 apps/web-antdv-next/nginx.conf

diff --git a/apps/web-antdv-next/nginx.conf b/apps/web-antdv-next/nginx.conf
new file mode 100644
index 0000000..0af5051
--- /dev/null
+++ b/apps/web-antdv-next/nginx.conf
@@ -0,0 +1,100 @@
+# BuildFlow Web (web-antdv-next) Nginx 运行配置
+# 仅 server 块，作为 conf.d/default.conf 覆盖 nginx 默认站点
+# - SPA history 路由回退 index.html
+# - /api 反代到后端 api（buildflow-api:5667，docker 内部 DNS）+ 请求头过滤防护
+# - /hubs SignalR WebSocket 反代
+# - 静态资源长缓存
+server {
+    listen       80;
+    listen  [::]:80;
+    server_name  _;
+
+    root   /usr/share/nginx/html;
+    index  index.html;
+
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_comp_level 6;
+    gzip_types text/plain text/css text/xml text/javascript
+               application/javascript application/json application/xml
+               application/rss+xml image/svg+xml font/woff font/woff2;
+
+    # ============ 反代后端 api：/api/* → buildflow-api:5667 ============
+    # 前端 .env.production 配 VITE_GLOB_API_URL=/api，请求 /api/xxx 经此反代到后端（同源，无跨域）
+    location /api/ {
+        proxy_pass http://buildflow-api:5667;
+
+        # --- 请求头过滤（核心安全防护）---
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # 清除客户端可能伪造的内部头，防头注入/SSRF（空值覆盖）
+        proxy_set_header X-Original-URI "";
+        proxy_set_header X-Original-URL "";
+        # JWT 透传（Authorization 由客户端携带）
+        proxy_set_header Authorization $http_authorization;
+
+        # --- 限制请求方法（只允许 RESTful 方法，防 TRACE/HEAD 等探测）---
+        limit_except GET POST PUT DELETE PATCH OPTIONS { deny all; }
+
+        # --- 请求体大小限制（防大 payload DoS；100MB 因文件上传）---
+        client_max_body_size 100m;
+
+        # --- 超时（防慢速攻击；read 300s 因 RAG 流式响应慢）---
+        proxy_connect_timeout 10s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 300s;
+
+        # --- SSE 流式支持（/api/.../stream 不缓冲）---
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_http_version 1.1;
+    }
+
+    # ============ SignalR WebSocket 反代：/hubs/* → buildflow-api:5667 ============
+    location /hubs/ {
+        proxy_pass http://buildflow-api:5667;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket 长连接超时
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+
+    # SPA history fallback + 安全响应头（nginx add_header 在 location 块有自己 add_header 时不继承 server，故放此处确保生效）
+    location / {
+        try_files $uri $uri/ /index.html;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+    }
+
+    # Vite 产物带 hash 文件名，可安全 immutable 长缓存
+    location /assets/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+        try_files $uri =404;
+    }
+
+    # index.html 不缓存，保证发布后立即生效
+    location = /index.html {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+    }
+
+}