5c7e1f81aa
Some checks failed
CI / Check (windows-latest) (push) Has been cancelled
CI / Test (ubuntu-latest) (push) Has been cancelled
CI / Test (windows-latest) (push) Has been cancelled
CI / Lint (ubuntu-latest) (push) Has been cancelled
CI / Lint (windows-latest) (push) Has been cancelled
CI / Check (ubuntu-latest) (push) Has been cancelled
CI / CI OK (push) Has been cancelled
CodeQL / Analyze (javascript-typescript) (push) Has been cancelled
Release Drafter / update_release_draft (push) Has been cancelled
101 lines
4.1 KiB
Nginx Configuration File
101 lines
4.1 KiB
Nginx Configuration File
# BuildFlow Web (web-antdv-next) Nginx 运行配置
|
||
# 仅 server 块，作为 conf.d/default.conf 覆盖 nginx 默认站点
|
||
# - SPA history 路由回退 index.html
|
||
# - /api 反代到后端 api（buildflow-api:5667，docker 内部 DNS）+ 请求头过滤防护
|
||
# - /hubs SignalR WebSocket 反代
|
||
# - 静态资源长缓存
|
||
server {
|
||
listen 80;
|
||
listen [::]:80;
|
||
server_name _;
|
||
|
||
root /usr/share/nginx/html;
|
||
index index.html;
|
||
|
||
gzip on;
|
||
gzip_vary on;
|
||
gzip_min_length 1024;
|
||
gzip_comp_level 6;
|
||
gzip_types text/plain text/css text/xml text/javascript
|
||
application/javascript application/json application/xml
|
||
application/rss+xml image/svg+xml font/woff font/woff2;
|
||
|
||
# ============ 反代后端 api：/api/* → buildflow-api:5667 ============
|
||
# 前端 .env.production 配 VITE_GLOB_API_URL=/api，请求 /api/xxx 经此反代到后端（同源，无跨域）
|
||
location /api/ {
|
||
proxy_pass http://buildflow-api:5667;
|
||
|
||
# --- 请求头过滤（核心安全防护）---
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
# 清除客户端可能伪造的内部头，防头注入/SSRF（空值覆盖）
|
||
proxy_set_header X-Original-URI "";
|
||
proxy_set_header X-Original-URL "";
|
||
# JWT 透传（Authorization 由客户端携带）
|
||
proxy_set_header Authorization $http_authorization;
|
||
|
||
# --- 限制请求方法（只允许 RESTful 方法，防 TRACE/HEAD 等探测）---
|
||
limit_except GET POST PUT DELETE PATCH OPTIONS { deny all; }
|
||
|
||
# --- 请求体大小限制（防大 payload DoS；100MB 因文件上传）---
|
||
client_max_body_size 100m;
|
||
|
||
# --- 超时（防慢速攻击；read 300s 因 RAG 流式响应慢）---
|
||
proxy_connect_timeout 10s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 300s;
|
||
|
||
# --- SSE 流式支持（/api/.../stream 不缓冲）---
|
||
proxy_buffering off;
|
||
proxy_cache off;
|
||
proxy_http_version 1.1;
|
||
}
|
||
|
||
# ============ SignalR WebSocket 反代：/hubs/* → buildflow-api:5667 ============
|
||
location /hubs/ {
|
||
proxy_pass http://buildflow-api:5667;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
# WebSocket 长连接超时
|
||
proxy_read_timeout 300s;
|
||
proxy_send_timeout 300s;
|
||
}
|
||
|
||
# SPA history fallback + 安全响应头（nginx add_header 在 location 块有自己 add_header 时不继承 server，故放此处确保生效）
|
||
location / {
|
||
try_files $uri $uri/ /index.html;
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
||
}
|
||
|
||
# Vite 产物带 hash 文件名，可安全 immutable 长缓存
|
||
location /assets/ {
|
||
expires 1y;
|
||
add_header Cache-Control "public, immutable";
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
||
try_files $uri =404;
|
||
}
|
||
|
||
# index.html 不缓存，保证发布后立即生效
|
||
location = /index.html {
|
||
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
||
}
|
||
|
||
}
|