init: ALiYunManager 基础设施项目 — nginx配置/docker-compose/部署文档

nginx/conf.d/dash.conf

@@ -0,0 +1,62 @@
+# ============================================
+# 运维监控面板 - dash.dxz99wyr.cn
+# ============================================
+
+# 上游定义
+upstream dashy_upstream {
+    server dashy:8080;
+}
+
+upstream netdata_upstream {
+    server netdata:19999;
+}
+
+upstream dash_status_upstream {
+    # dash-status 使用 host 网络模式，通过宿主机访问
+    server host.docker.internal:5000;
+}
+
+# Dashy 主面板
+server {
+    listen 80;
+    server_name dash.dxz99wyr.cn;
+
+    access_log /var/log/nginx/dash.access.log main;
+    error_log /var/log/nginx/dash.error.log warn;
+
+    # Dashy Web UI
+    location / {
+        proxy_pass http://dashy_upstream;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Netdata 监控面板
+    location /netdata/ {
+        proxy_pass http://netdata_upstream/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 86400s;
+        proxy_buffering off;
+    }
+
+    # Status API
+    location /api/ {
+        proxy_pass http://dash_status_upstream/api/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

nginx/conf.d/git.conf

@@ -0,0 +1,35 @@
+# ============================================
+# 私有 Git 仓库 - Gitea
+# 服务名: gitea
+# 由主 Nginx 反向代理，此文件可独立维护
+# ============================================
+
+server {
+    listen 80;
+    server_name git.dxz99wyr.cn;
+
+    # 日志
+    access_log /var/log/nginx/git.access.log main;
+    error_log /var/log/nginx/git.error.log warn;
+
+    # Gitea Web UI
+    location / {
+        proxy_pass http://gitea:3000;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # Gitea 需要的较大超时
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+
+        # 上传限制（Git push 通过 Web 可能较大）
+        client_max_body_size 512m;
+    }
+}

nginx/conf.d/miniapp-api.conf

@@ -0,0 +1,42 @@
+# ============================================
+# 小程序后台 - API 服务
+# 接入现有后端 quanyixiaozhushou-app (宿主机3000端口)
+# 由主 Nginx 反向代理，此文件可独立维护
+# ============================================
+
+server {
+    listen 80;
+    server_name api-miniapp.dxz99wyr.cn;
+
+    # 日志
+    access_log /var/log/nginx/miniapp-api.access.log main;
+    error_log /var/log/nginx/miniapp-api.error.log warn;
+
+    location / {
+        # 反向代理到宿主机的3000端口（quanyixiaozhushou-app后端）
+        proxy_pass http://host.docker.internal:3000;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket 支持
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+
+        # CORS 头部
+        add_header Access-Control-Allow-Origin * always;
+        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
+        add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+
+        if ($request_method = OPTIONS) {
+            return 204;
+        }
+    }
+}

nginx/conf.d/miniapp-web.conf

@@ -0,0 +1,36 @@
+# ============================================
+# 小程序网站 - 前端
+# 服务名: miniapp-web
+# 由主 Nginx 反向代理，此文件可独立维护
+# ============================================
+
+server {
+    listen 80;
+    server_name www.dxz99wyr.cn;
+
+    # 日志
+    access_log /var/log/nginx/miniapp-web.access.log main;
+    error_log /var/log/nginx/miniapp-web.error.log warn;
+
+    location / {
+        proxy_pass http://miniapp-web:80;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+    }
+
+    # 静态资源缓存
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        proxy_pass http://miniapp-web:80;
+        proxy_set_header Host $host;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+}

nginx/conf.d/port-based-example.conf

@@ -0,0 +1,64 @@
+# ============================================
+# 基于端口的反向代理配置示例（备选方案）
+# ============================================
+# 如果各个服务通过宿主机端口暴露（如 -p 8081:80），
+# 主 Nginx 可以通过 host.docker.internal 或宿主机 IP 访问
+# ============================================
+
+# 示例：假设各服务映射端口如下：
+# 简历网站:    8081
+# 小程序网站:   8082
+# 简历后台:    8083
+# 小程序后台:   8084
+
+# server {
+#     listen 80;
+#     server_name me.dxz99wyr.cn;
+#
+#     location / {
+#         proxy_pass http://host.docker.internal:8081;
+#         proxy_set_header Host $host;
+#         proxy_set_header X-Real-IP $remote_addr;
+#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#     }
+# }
+#
+# server {
+#     listen 80;
+#     server_name www.dxz99wyr.cn;
+#
+#     location / {
+#         proxy_pass http://host.docker.internal:8082;
+#         proxy_set_header Host $host;
+#         proxy_set_header X-Real-IP $remote_addr;
+#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#     }
+# }
+#
+# server {
+#     listen 80;
+#     server_name api-resume.dxz99wyr.cn;
+#
+#     location / {
+#         proxy_pass http://host.docker.internal:8083;
+#         proxy_set_header Host $host;
+#         proxy_set_header X-Real-IP $remote_addr;
+#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#     }
+# }
+#
+# server {
+#     listen 80;
+#     server_name api-miniapp.dxz99wyr.cn;
+#
+#     location / {
+#         proxy_pass http://host.docker.internal:8084;
+#         proxy_set_header Host $host;
+#         proxy_set_header X-Real-IP $remote_addr;
+#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#     }
+# }

nginx/conf.d/resume-api.conf

@@ -0,0 +1,43 @@
+# ============================================
+# 个人简历后台 - API 服务
+# 服务名: resume-api
+# 由主 Nginx 反向代理，此文件可独立维护
+# ============================================
+
+server {
+    listen 80;
+    server_name api-resume.dxz99wyr.cn;
+
+    # 日志
+    access_log /var/log/nginx/resume-api.access.log main;
+    error_log /var/log/nginx/resume-api.error.log warn;
+
+    # 允许跨域（API 服务通常需要）
+    location / {
+        proxy_pass http://resume-api:80;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket 支持（如需要）
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+
+        # CORS 头部
+        add_header Access-Control-Allow-Origin * always;
+        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
+        add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+
+        # 预检请求处理
+        if ($request_method = OPTIONS) {
+            return 204;
+        }
+    }
+}

nginx/conf.d/resume-web.conf

@@ -0,0 +1,36 @@
+# ============================================
+# 个人简历网站 - 前端
+# 服务名: resume-web
+# 由主 Nginx 反向代理，此文件可独立维护
+# ============================================
+
+server {
+    listen 80;
+    server_name me.dxz99wyr.cn;
+
+    # 日志
+    access_log /var/log/nginx/resume-web.access.log main;
+    error_log /var/log/nginx/resume-web.error.log warn;
+
+    location / {
+        proxy_pass http://resume-web:80;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+    }
+
+    # 静态资源缓存
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        proxy_pass http://resume-web:80;
+        proxy_set_header Host $host;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+}

nginx/conf.d/ssl-template.conf

@@ -0,0 +1,40 @@
+# ============================================
+# SSL/HTTPS 配置模板
+# ============================================
+# 申请证书后，将证书文件放入 nginx/ssl/ 目录
+# 然后为每个域名添加对应的 server 块
+# ============================================
+
+# 示例：me.dxz99wyr.cn 的 HTTPS 配置
+# server {
+#     listen 443 ssl http2;
+#     server_name me.dxz99wyr.cn;
+#
+#     ssl_certificate /etc/nginx/ssl/me.dxz99wyr.cn.crt;
+#     ssl_certificate_key /etc/nginx/ssl/me.dxz99wyr.cn.key;
+#
+#     ssl_protocols TLSv1.2 TLSv1.3;
+#     ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+#     ssl_prefer_server_ciphers off;
+#     ssl_session_cache shared:SSL:10m;
+#     ssl_session_timeout 1d;
+#
+#     access_log /var/log/nginx/resume-web.access.log main;
+#     error_log /var/log/nginx/resume-web.error.log warn;
+#
+#     location / {
+#         proxy_pass http://resume-web:80;
+#         proxy_http_version 1.1;
+#         proxy_set_header Host $host;
+#         proxy_set_header X-Real-IP $remote_addr;
+#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#     }
+# }
+#
+# # HTTP 自动跳转到 HTTPS
+# server {
+#     listen 80;
+#     server_name me.dxz99wyr.cn;
+#     return 301 https://$server_name$request_uri;
+# }

nginx/nginx.conf

@@ -0,0 +1,43 @@
+user nginx;
+worker_processes auto;
+error_log /var/log/nginx/error.log notice;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+    use epoll;
+    multi_accept on;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    # 日志格式
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for" '
+                    'upstream=$upstream_addr response_time=$upstream_response_time';
+
+    access_log /var/log/nginx/access.log main;
+
+    # 性能优化
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+
+    # Gzip 压缩
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
+
+    # 防止暴露版本号
+    server_tokens off;
+
+    # 引入各个服务的配置文件（每个服务独立管理）
+    include /etc/nginx/conf.d/*.conf;
+}