- edge: 容器化 nginx 接管 80/443,逐字移植现网 vhost(blog/jiu/marzban/pay)+ stream SNI 分流 - singbox: Hysteria2(host 网络,UDP 443) - certbot: DNS-01(Cloudflare)续期,容器化 - xray: REALITY 仅 profile newnode(本台沿用 Marzban) - deploy.sh 幂等且切换感知;cutover.sh 一次性停宿主 nginx 切容器(可秒级回滚) - 弃用方案A 的 host nginx-apply/sudoers/root-setup - 部署目录改 ~/pangolin(免 root);CI 注入 CF_API_TOKEN EC2 实测:edge nginx -t 通过(真实证书)、compose 校验通过 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
wangjia
@@ -0,0 +1,37 @@
|
||||
server {
|
||||
server_name blog.51yanmei.com;
|
||||
|
||||
# Blog (Next.js + Payload CMS)
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:3000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $http_cf_connecting_ip;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection 'upgrade';
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
}
|
||||
|
||||
# Umami stats — proxied under /stats/
|
||||
location /stats/ {
|
||||
proxy_pass http://127.0.0.1:3001/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $http_cf_connecting_ip;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
}
|
||||
|
||||
listen 127.0.0.1:8444 ssl;
|
||||
ssl_certificate /etc/letsencrypt/live/blog.51yanmei.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/blog.51yanmei.com/privkey.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name blog.51yanmei.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
@@ -0,0 +1,73 @@
|
||||
server {
|
||||
listen 127.0.0.1:8445 ssl;
|
||||
server_name jiu.51yanmei.com;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/jiu.51yanmei.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/jiu.51yanmei.com/privkey.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
|
||||
client_max_body_size 20m;
|
||||
|
||||
# 商品图片静态文件
|
||||
location ^~ /images/ {
|
||||
alias /opt/jiu/images/;
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
|
||||
# 文件导入接口（超时更长）
|
||||
location ~ ^/api/v1/import/ {
|
||||
proxy_pass http://127.0.0.1:8080;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_read_timeout 300s;
|
||||
}
|
||||
|
||||
# API 反向代理
|
||||
location ~ ^/(api|health|version) {
|
||||
proxy_pass http://127.0.0.1:8080;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_read_timeout 30s;
|
||||
}
|
||||
|
||||
# Flutter 管理端（仅 /app/ 前缀，不污染根路径）
|
||||
location /app/ {
|
||||
alias /opt/jiu/web/;
|
||||
index index.html;
|
||||
try_files $uri $uri/ /app/index.html;
|
||||
}
|
||||
|
||||
# index.html 不缓存，确保每次发版后浏览器加载最新版
|
||||
location = /app/index.html {
|
||||
alias /opt/jiu/web/index.html;
|
||||
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
||||
add_header Pragma "no-cache";
|
||||
expires 0;
|
||||
}
|
||||
|
||||
# 公开商品详情页（扫码跳转）→ 交给 Flutter Web 路由处理
|
||||
location ~ ^/product/ {
|
||||
root /opt/jiu/web;
|
||||
try_files $uri /app/index.html;
|
||||
}
|
||||
|
||||
# 扫码页（/scan/<id> → scan.html，JS 从 URL 读取 id）
|
||||
location /scan/ {
|
||||
root /opt/jiu/marketing;
|
||||
try_files /scan.html =404;
|
||||
}
|
||||
|
||||
# 营销站点兜底（根路径及所有其他路径）
|
||||
location / {
|
||||
root /opt/jiu/marketing;
|
||||
try_files $uri $uri.html $uri/index.html /index.html;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name jiu.51yanmei.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
server {
|
||||
server_name vpn.51yanmei.com;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8899;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $http_cf_connecting_ip;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
}
|
||||
|
||||
listen 127.0.0.1:8443 ssl;
|
||||
ssl_certificate /etc/letsencrypt/live/vpn.51yanmei.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/vpn.51yanmei.com/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
}
|
||||
server {
|
||||
if ($host = vpn.51yanmei.com) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
listen 80;
|
||||
server_name vpn.51yanmei.com;
|
||||
return 404;
|
||||
}
|
||||
@@ -0,0 +1,4 @@
|
||||
# pangolin 自有路由占位。
|
||||
# 本台(EC2)REALITY 仍由 Marzban 提供(stream.conf 里 default/cloudflare → 10443),
|
||||
# 故此处暂空。将来退役 Marzban / 接入 pangolin-xray 时,在 stream.conf 增加
|
||||
# www.apple.com 127.0.0.1:11443; 并启用 pangolin-xray 容器即可。
|
||||
@@ -0,0 +1,16 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name pay.51yanmei.com;
|
||||
|
||||
root /var/www/pay;
|
||||
index index.html;
|
||||
|
||||
location = /health {
|
||||
default_type application/json;
|
||||
return 200 "{\"ok\":true}";
|
||||
}
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
# pangolin-edge 主配置(容器内 /etc/nginx/nginx.conf)。
|
||||
# 官方 nginx 镜像已内置 stream 模块,无需 load_module。
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
error_log /var/log/nginx/error.log notice;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
keepalive_timeout 65;
|
||||
types_hash_max_size 4096;
|
||||
|
||||
# 默认站:未匹配域名的 80 兜底
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
server_name _;
|
||||
root /usr/share/nginx/html;
|
||||
error_page 404 /404.html;
|
||||
error_page 500 502 503 504 /50x.html;
|
||||
}
|
||||
|
||||
# 业务 vhost(blog / jiu / marzban面板 / pay)—— 逐字移植现网
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
}
|
||||
|
||||
# 443/TCP SNI 分流
|
||||
include /etc/nginx/stream.conf;
|
||||
@@ -0,0 +1,20 @@
|
||||
# 443/TCP SNI 分流(ssl_preread)—— 逐字沿用现网,后端地址不变。
|
||||
# host 网络下容器内的 127.0.0.1 即宿主 loopback,可直达各后端。
|
||||
stream {
|
||||
map $ssl_preread_server_name $backend {
|
||||
www.cloudflare.com 127.0.0.1:10443; # Marzban REALITY(线上代理)
|
||||
vpn.51yanmei.com 127.0.0.1:8443; # Marzban 面板(本 nginx http)
|
||||
blog.51yanmei.com 127.0.0.1:8444; # 博客(本 nginx http)
|
||||
jiu.51yanmei.com 127.0.0.1:8445; # jiu(本 nginx http)
|
||||
default 127.0.0.1:10443; # 兜底 → Marzban REALITY
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443;
|
||||
listen [::]:443;
|
||||
proxy_pass $backend;
|
||||
ssl_preread on;
|
||||
proxy_connect_timeout 10s;
|
||||
proxy_timeout 3600s;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user