Blizzard
a6257d2fc4
- Dockerfile 四阶段：web/admin 前端构建 → go 静态编译(embed 双前端) → alpine 运行镜像(53MB, 非 root, Asia/Shanghai) - docker-compose.yml：132 部署用，暴露 8090，env_file 读本机 .env，带 healthcheck - .gitea/workflows/deploy.yml：push dev → runner 构建 → docker save|gzip → sshpass scp → 132 load+up → 健康检查 - deploy/nginx-site.sundynix.cn.conf：公网 nginx 反代（穿透回源 site.sundynix.cn） - .env.production.example + deploy/README.md：部署手册（secrets、127:3307 数据库、证书） - 已本地验证：镜像构建通过 + 容器冒烟(健康/用户端/管理端/logo/RSS/登录)全绿 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
66 lines
2.4 KiB
Plaintext
66 lines
2.4 KiB
Plaintext
# ───────────────────────────────────────────────────────────
|
||
# 公网服务器上的 nginx 配置
|
||
# site.sundynix.cn → 内网穿透隧道 → 192.168.100.132:8090 容器
|
||
#
|
||
# upstream 里的地址是「穿透隧道在公网服务器这一侧的入口」：
|
||
# frp 场景：frps 把 132:8090 映射到公网机 127.0.0.1:<某端口>
|
||
# nps 场景：同理，填映射后的本地端口
|
||
# 请把 127.0.0.1:8090 改成你穿透实际暴露的地址:端口。
|
||
# 放到 /etc/nginx/conf.d/site.sundynix.cn.conf，nginx -t && nginx -s reload
|
||
# ───────────────────────────────────────────────────────────
|
||
|
||
upstream sundynix_site {
|
||
server 127.0.0.1:8090; # ← 改成穿透隧道的本地入口
|
||
keepalive 16;
|
||
}
|
||
|
||
# HTTP：证书申请放行 + 其余跳 HTTPS
|
||
server {
|
||
listen 80;
|
||
listen [::]:80;
|
||
server_name site.sundynix.cn;
|
||
|
||
location /.well-known/acme-challenge/ {
|
||
root /var/www/certbot;
|
||
}
|
||
location / {
|
||
return 301 https://$host$request_uri;
|
||
}
|
||
}
|
||
|
||
# HTTPS：反代到穿透隧道
|
||
server {
|
||
listen 443 ssl;
|
||
listen [::]:443 ssl;
|
||
http2 on;
|
||
server_name site.sundynix.cn;
|
||
|
||
ssl_certificate /etc/letsencrypt/live/site.sundynix.cn/fullchain.pem;
|
||
ssl_certificate_key /etc/letsencrypt/live/site.sundynix.cn/privkey.pem;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||
ssl_session_cache shared:SSL:10m;
|
||
|
||
# 管理端 markdown 正文可能较大
|
||
client_max_body_size 10m;
|
||
|
||
# 静态资源带 hash，可长缓存（SPA 的 index.html 不缓存，由后端控制）
|
||
location /assets/ {
|
||
proxy_pass http://sundynix_site;
|
||
proxy_set_header Host $host;
|
||
expires 30d;
|
||
add_header Cache-Control "public, immutable";
|
||
}
|
||
|
||
location / {
|
||
proxy_pass http://sundynix_site;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header Connection "";
|
||
proxy_read_timeout 60s;
|
||
}
|
||
}
|