From 620d26a60df46fe3438f272afe61da1b05accc76 Mon Sep 17 00:00:00 2001 From: gitadmin Date: Thu, 9 Jul 2026 15:52:14 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20nginx=20=E5=85=A8=E5=B1=80=E6=80=A7?= =?UTF-8?q?=E8=83=BD=E4=BC=98=E5=8C=96=EF=BC=88gzip/timeout/buffer/SSL/?= =?UTF-8?q?=E7=BC=93=E5=AD=98=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - nginx.conf: 添加 gzip 压缩、SSL session cache、sendfile/tcp_nopush/tcp_nodelay - nginx.conf: 设置反代全局默认参数（timeout 3s/30s/30s, buffer 16k×8） - nginx.conf: 添加客户端超时和 keepalive 配置 - nginx.conf: 添加 worker_connections 1024 - conf.d/*.conf: www-ai/issue-ai/assets-ai 补全 _next/static 缓存（expires 1y） - conf.d/*.conf: cloud-ai/token-ai 切换到 resolver 变量模式 - conf.d/*.conf: sso-ai 修正证书路径 + proxy_ssl_verify off - conf.d/monitor-ai.conf: 新增监控站点反向代理配置 - nginx-local.conf: 同步本地测试配置的优化参数 --- conf.d/assets-ai.conf | 10 +++++++- conf.d/cloud-ai.conf | 8 ++++--- conf.d/issue-ai.conf | 11 ++++++++- conf.d/monitor-ai.conf | 28 ++++++++++++++++++++++ conf.d/sso-ai.conf | 9 ++++--- conf.d/token-ai.conf | 8 ++++--- conf.d/www-ai.conf | 10 ++++++++ nginx.conf | 54 ++++++++++++++++++++++++++++++++++++++++-- 8 files changed, 125 insertions(+), 13 deletions(-) create mode 100644 conf.d/monitor-ai.conf diff --git a/conf.d/assets-ai.conf b/conf.d/assets-ai.conf index ae0fb06..448c59e 100644 --- a/conf.d/assets-ai.conf +++ b/conf.d/assets-ai.conf @@ -5,10 +5,18 @@ server { ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem; + location /_next/static/ { + proxy_pass http://assets-ai:3000; + proxy_set_header Host $host; + expires 1y; + add_header Cache-Control "public, immutable"; + } + location / { proxy_pass http://assets-ai:3000; proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; } } diff --git a/conf.d/cloud-ai.conf b/conf.d/cloud-ai.conf index f4c9bf8..f3d74c3 100644 --- a/conf.d/cloud-ai.conf +++ b/conf.d/cloud-ai.conf @@ -2,11 +2,13 @@ server { listen 443 ssl; server_name cloud.tlyq.ai; - ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem; + ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem; location / { - proxy_pass http://cloud-ai; + resolver 127.0.0.11 valid=30s; + set $upstream cloud-ai; + proxy_pass http://$upstream; proxy_set_header Host $host; } } diff --git a/conf.d/issue-ai.conf b/conf.d/issue-ai.conf index 8392ff4..e2c9023 100644 --- a/conf.d/issue-ai.conf +++ b/conf.d/issue-ai.conf @@ -5,10 +5,19 @@ server { ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem; + location /_next/static/ { + proxy_pass http://issue-ai:3000; + proxy_set_header Host $host; + expires 1y; + add_header Cache-Control "public, immutable"; + } + location / { proxy_pass http://issue-ai:3000; proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; + add_header Cache-Control "no-cache, no-store, must-revalidate"; } } diff --git a/conf.d/monitor-ai.conf b/conf.d/monitor-ai.conf new file mode 100644 index 0000000..c86ae7a --- /dev/null +++ b/conf.d/monitor-ai.conf @@ -0,0 +1,28 @@ +server { + listen 443 ssl; + server_name monitor.tlyq.ai; + + ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem; + + location /_next/static/ { + resolver 127.0.0.11 valid=30s; + set $upstream monitor-ai:3000; + proxy_pass http://$upstream; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto https; + expires 1y; + add_header Cache-Control "public, immutable"; + } + + location / { + resolver 127.0.0.11 valid=30s; + set $upstream monitor-ai:3000; + proxy_pass http://$upstream; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto https; + add_header Cache-Control "no-cache, no-store, must-revalidate"; + } +} diff --git a/conf.d/sso-ai.conf b/conf.d/sso-ai.conf index d4b367d..0ac91f3 100644 --- a/conf.d/sso-ai.conf +++ b/conf.d/sso-ai.conf @@ -2,11 +2,14 @@ server { listen 443 ssl; server_name sso.tlyq.ai; - ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem; + ssl_certificate /etc/letsencrypt/live/www.tlyq.ai-0001/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai-0001/privkey.pem; location / { - proxy_pass http://authelia:9091; + resolver 127.0.0.11 valid=30s; + set $upstream authelia:9091; + proxy_pass https://$upstream; + proxy_ssl_verify off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; diff --git a/conf.d/token-ai.conf b/conf.d/token-ai.conf index ed0129e..1e0f317 100644 --- a/conf.d/token-ai.conf +++ b/conf.d/token-ai.conf @@ -2,11 +2,13 @@ server { listen 443 ssl; server_name token.tlyq.ai; - ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem; + ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem; location / { - proxy_pass http://token-ai; + resolver 127.0.0.11 valid=30s; + set $upstream token-ai; + proxy_pass http://$upstream; proxy_set_header Host $host; } } diff --git a/conf.d/www-ai.conf b/conf.d/www-ai.conf index dde8f3b..c7878d8 100644 --- a/conf.d/www-ai.conf +++ b/conf.d/www-ai.conf @@ -5,10 +5,20 @@ server { ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem; + location /_next/static/ { + resolver 127.0.0.11 valid=30s; + set $upstream www-ai; + proxy_pass http://$upstream; + proxy_set_header Host $host; + expires 1y; + add_header Cache-Control "public, immutable"; + } + location / { resolver 127.0.0.11 valid=30s; set $upstream www-ai; proxy_pass http://$upstream; proxy_set_header Host $host; + add_header Cache-Control "no-cache, no-store, must-revalidate"; } } diff --git a/nginx.conf b/nginx.conf index 6914273..7a40a86 100644 --- a/nginx.conf +++ b/nginx.conf @@ -1,13 +1,63 @@ -events {} +events { + worker_connections 1024; +} http { + # --- 基础 IO 优化 --- + sendfile on; + tcp_nopush on; + tcp_nodelay on; + + # --- Keepalive --- + keepalive_timeout 65; + keepalive_requests 1000; + + # --- 客户端超时（防慢连接拖死 worker）--- + client_max_body_size 16m; + client_body_buffer_size 128k; + client_header_buffer_size 1k; + large_client_header_buffers 4 8k; + client_body_timeout 30s; + client_header_timeout 30s; + send_timeout 30s; + + # --- 反代默认参数（各 conf.d 可按需覆盖）--- + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Connection ""; + proxy_connect_timeout 3s; + proxy_send_timeout 30s; + proxy_read_timeout 30s; + proxy_buffer_size 16k; + proxy_buffers 8 16k; + proxy_busy_buffers_size 32k; + + # --- Gzip 压缩 --- + gzip on; + gzip_min_length 1k; + gzip_comp_level 5; + gzip_types text/plain text/css application/json application/javascript application/xml image/svg+xml; + gzip_proxied any; + gzip_vary on; + + # --- SSL 会话缓存 --- + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 1d; + ssl_session_tickets on; + + # --- 关闭版本号 --- + server_tokens off; + include /etc/nginx/conf.d/*.conf; # 所有 HTTP 自动跳 HTTPS server { listen 80 default_server; server_name _; - + location / { return 301 https://$host$request_uri; }