gaoxiaopei
/
nginx-proxy-ai
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat: nginx 全局性能优化（gzip/timeout/buffer/SSL/缓存） 

- nginx.conf: 添加 gzip 压缩、SSL session cache、sendfile/tcp_nopush/tcp_nodelay
- nginx.conf: 设置反代全局默认参数（timeout 3s/30s/30s, buffer 16k×8）
- nginx.conf: 添加客户端超时和 keepalive 配置
- nginx.conf: 添加 worker_connections 1024
- conf.d/*.conf: www-ai/issue-ai/assets-ai 补全 _next/static 缓存（expires 1y）
- conf.d/*.conf: cloud-ai/token-ai 切换到 resolver 变量模式
- conf.d/*.conf: sso-ai 修正证书路径 + proxy_ssl_verify off
- conf.d/monitor-ai.conf: 新增监控站点反向代理配置
- nginx-local.conf: 同步本地测试配置的优化参数
This commit is contained in:
gitadmin 2026-07-09 15:52:14 +08:00
parent 3804c3390f
commit 620d26a60d
8 changed files with 125 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
conf.d/assets-ai.conf
View File

@ -5,10 +5,18 @@ server {
ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
location /_next/static/ {
proxy_pass http://assets-ai:3000;
proxy_set_header Host $host;
expires 1y;
add_header Cache-Control "public, immutable";
}
location / {
proxy_pass http://assets-ai:3000;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}

8
conf.d/cloud-ai.conf
View File

@ -2,11 +2,13 @@ server {
listen 443 ssl;
server_name cloud.tlyq.ai;
ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
location / {
proxy_pass http://cloud-ai;
resolver 127.0.0.11 valid=30s;
set $upstream cloud-ai;
proxy_pass http://$upstream;
proxy_set_header Host $host;
}
}

11
conf.d/issue-ai.conf
View File

@ -5,10 +5,19 @@ server {
ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
location /_next/static/ {
proxy_pass http://issue-ai:3000;
proxy_set_header Host $host;
expires 1y;
add_header Cache-Control "public, immutable";
}
location / {
proxy_pass http://issue-ai:3000;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
add_header Cache-Control "no-cache, no-store, must-revalidate";
}
}

28
conf.d/monitor-ai.conf Normal file
View File

@ -0,0 +1,28 @@
server {
listen 443 ssl;
server_name monitor.tlyq.ai;
ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
location /_next/static/ {
resolver 127.0.0.11 valid=30s;
set $upstream monitor-ai:3000;
proxy_pass http://$upstream;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto https;
expires 1y;
add_header Cache-Control "public, immutable";
}
location / {
resolver 127.0.0.11 valid=30s;
set $upstream monitor-ai:3000;
proxy_pass http://$upstream;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto https;
add_header Cache-Control "no-cache, no-store, must-revalidate";
}
}

9
conf.d/sso-ai.conf
View File

@ -2,11 +2,14 @@ server {
listen 443 ssl;
server_name sso.tlyq.ai;
ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
ssl_certificate /etc/letsencrypt/live/www.tlyq.ai-0001/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai-0001/privkey.pem;
location / {
proxy_pass http://authelia:9091;
resolver 127.0.0.11 valid=30s;
set $upstream authelia:9091;
proxy_pass https://$upstream;
proxy_ssl_verify off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

8
conf.d/token-ai.conf
View File

@ -2,11 +2,13 @@ server {
listen 443 ssl;
server_name token.tlyq.ai;
ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
location / {
proxy_pass http://token-ai;
resolver 127.0.0.11 valid=30s;
set $upstream token-ai;
proxy_pass http://$upstream;
proxy_set_header Host $host;
}
}

10
conf.d/www-ai.conf
View File

@ -5,10 +5,20 @@ server {
ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
location /_next/static/ {
resolver 127.0.0.11 valid=30s;
set $upstream www-ai;
proxy_pass http://$upstream;
proxy_set_header Host $host;
expires 1y;
add_header Cache-Control "public, immutable";
}
location / {
resolver 127.0.0.11 valid=30s;
set $upstream www-ai;
proxy_pass http://$upstream;
proxy_set_header Host $host;
add_header Cache-Control "no-cache, no-store, must-revalidate";
}
}

52
nginx.conf
View File

@ -1,6 +1,56 @@
events {}
events {
worker_connections 1024;
}
http {
# --- 基础 IO 优化 ---
sendfile on;
tcp_nopush on;
tcp_nodelay on;
# --- Keepalive ---
keepalive_timeout 65;
keepalive_requests 1000;
# --- 客户端超时（防慢连接拖死 worker）---
client_max_body_size 16m;
client_body_buffer_size 128k;
client_header_buffer_size 1k;
large_client_header_buffers 4 8k;
client_body_timeout 30s;
client_header_timeout 30s;
send_timeout 30s;
# --- 反代默认参数（各 conf.d 可按需覆盖）---
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Connection "";
proxy_connect_timeout 3s;
proxy_send_timeout 30s;
proxy_read_timeout 30s;
proxy_buffer_size 16k;
proxy_buffers 8 16k;
proxy_busy_buffers_size 32k;
# --- Gzip 压缩 ---
gzip on;
gzip_min_length 1k;
gzip_comp_level 5;
gzip_types text/plain text/css application/json application/javascript application/xml image/svg+xml;
gzip_proxied any;
gzip_vary on;
# --- SSL 会话缓存 ---
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets on;
# --- 关闭版本号 ---
server_tokens off;
include /etc/nginx/conf.d/*.conf;
# 所有 HTTP 自动跳 HTTPS