yidongliang
/
gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

save

This commit is contained in:
yidl 2025-07-02 00:55:40 +08:00
parent fd646c9785
commit 80a1063d7d
1 changed files with 37 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
nginx.conf.gateway
View File

@ -47,6 +47,41 @@ http {
# ======================
# 1. IdentityServer4 专用端口 (8001)
# ======================
server {
listen 443 ssl;
server_name 106.52.199.114;
ssl_certificate /etc/nginx/certs/gateway.crt;
ssl_certificate_key /etc/nginx/certs/gateway.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_verify_client off; # ↓ 允许自签名证书
ssl_verify_depth 0;
location /connect/ {
# 关键 1: 移除路径中的 /auth/ 前缀
proxy_pass https://sys_api/connect/; # 末尾的 / 确保路径替换
proxy_ssl_server_name on;
proxy_ssl_session_reuse off;
proxy_ssl_verify off;
# 关键 2: 覆盖 Host 头，模拟 Vite 的 changeOrigin=true
proxy_set_header Host $proxy_host; # 设置为目标地址的 Host
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host:$server_port;
proxy_set_header Authorization $http_authorization; # 传递 Authorization 头
# 其他标准代理头
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# 关键 4: 重写后端返回的 Location 头（解决重定向端口丢失）
proxy_redirect https://sys_api:19902/ http://$host:$server_port/auth/;
proxy_redirect https://sys_api/ http://$host:$server_port/auth/;
}
}
server {
listen 8001 ssl;
server_name 106.52.199.114;
@ -59,12 +94,7 @@ http {
ssl_session_timeout 10m;
ssl_verify_client off; # ↓ 允许自签名证书
ssl_verify_depth 0;
# 统一代理头（确保IdentityServer获取真实客户端信息）
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# 单独处理发现文档，确保issuer正确
# 单独处理发现文档，确保issuer正确
location = /.well-known/openid-configuration {
proxy_pass https://sys_api/.well-known/openid-configuration;
@ -75,6 +105,7 @@ http {
sub_filter 'https://sys-api:19902' 'https://$host:8001';
sub_filter 'https://sys_api' 'https://$host:8001';
}
# 所有IdentityServer路由（无需/auth前缀）
location / {
proxy_pass https://sys_api;