把 授权也业务分开
This commit is contained in:
parent
4b15df695e
commit
87b6e0b1ae
|
|
@ -4,8 +4,6 @@ pid /var/run/nginx.pid;
|
|||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
use epoll;
|
||||
multi_accept on;
|
||||
}
|
||||
|
||||
http {
|
||||
|
|
@ -18,8 +16,6 @@ http {
|
|||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
# Gzip 压缩1
|
||||
gzip on;
|
||||
|
|
@ -28,9 +24,6 @@ http {
|
|||
gzip_comp_level 6;
|
||||
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
|
||||
# --- 后端服务定义 (Upstreams) ---
|
||||
# 根据您的描述更新了端口号
|
||||
|
||||
# Sys 系统 API
|
||||
upstream sys_api {
|
||||
server sys-api:19902;
|
||||
|
|
@ -51,6 +44,45 @@ http {
|
|||
server lmg-ui:80;
|
||||
}
|
||||
|
||||
# ======================
|
||||
# 1. IdentityServer4 专用端口 (8001)
|
||||
# ======================
|
||||
server {
|
||||
listen 8001 ssl;
|
||||
server_name 106.52.199.114;
|
||||
ssl_certificate /etc/nginx/certs/gateway.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/gateway.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
# 统一代理头（确保IdentityServer获取真实客户端信息）
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
# 所有IdentityServer路由（无需/auth前缀）
|
||||
location / {
|
||||
proxy_pass https://sys_api;
|
||||
|
||||
# HTTPS后端配置
|
||||
proxy_ssl_server_name on;
|
||||
proxy_ssl_verify off;
|
||||
|
||||
# 关键：重写后端返回的Location头（防止重定向到内部端口）
|
||||
proxy_redirect https://sys-api:19902/ https://$host:8001/;
|
||||
}
|
||||
# 单独处理发现文档，确保issuer正确
|
||||
location = /.well-known/openid-configuration {
|
||||
proxy_pass https://sys_api/.well-known/openid-configuration;
|
||||
|
||||
# 动态修改返回的JSON中的URL
|
||||
proxy_set_header Accept-Encoding "";
|
||||
sub_filter_types application/json;
|
||||
sub_filter_once off;
|
||||
sub_filter '"issuer":"' '"issuer":"https://$host:8001"';
|
||||
sub_filter 'https://sys-api:19902' 'https://$host:8001';
|
||||
}
|
||||
}
|
||||
|
||||
# --- 统一网关服务 ---
|
||||
server {
|
||||
listen 8000 ssl; # 使用 http2 提升性能
|
||||
|
|
@ -73,92 +105,6 @@ http {
|
|||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
|
||||
# --- 路由规则 (Locations) ---
|
||||
# 1. 认证中心 (IdentityServer4) 路由 - 专门处理并移除 'auth' 前缀
|
||||
# 认证服务代理
|
||||
location /auth/ {
|
||||
# 关键 1: 移除路径中的 /auth/ 前缀
|
||||
proxy_pass https://sys_api/; # 末尾的 / 确保路径替换
|
||||
|
||||
proxy_ssl_server_name on;
|
||||
proxy_ssl_session_reuse off;
|
||||
proxy_ssl_verify off;
|
||||
# 关键 2: 覆盖 Host 头，模拟 Vite 的 changeOrigin=true
|
||||
proxy_set_header Host $proxy_host; # 设置为目标地址的 Host (192.168.1.100:19901)
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $host:$server_port;
|
||||
proxy_set_header Authorization $http_authorization; # 传递 Authorization 头
|
||||
# 其他标准代理头
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# 关键 4: 重写后端返回的 Location 头（解决重定向端口丢失）
|
||||
proxy_redirect https://sys-api:19902/ https://$host:$server_port/auth/;
|
||||
}
|
||||
|
||||
location /ids/ {
|
||||
# 关键 1: 移除路径中的 /auth/ 前缀
|
||||
proxy_pass https://sys_api/; # 末尾的 / 确保路径替换
|
||||
|
||||
proxy_ssl_server_name on;
|
||||
proxy_ssl_session_reuse off;
|
||||
proxy_ssl_verify off;
|
||||
# 关键 2: 覆盖 Host 头，模拟 Vite 的 changeOrigin=true
|
||||
proxy_set_header Host $proxy_host; # 设置为目标地址的 Host (192.168.1.100:19901)
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $host:$server_port;
|
||||
proxy_set_header Authorization $http_authorization; # 传递 Authorization 头
|
||||
# 其他标准代理头
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# 关键 4: 重写后端返回的 Location 头（解决重定向端口丢失）
|
||||
proxy_redirect https://sys-api:19902/ https://$host:$server_port/auth/;
|
||||
}
|
||||
|
||||
location /connect/ {
|
||||
# 关键 1: 移除路径中的 /auth/ 前缀
|
||||
proxy_pass https://sys_api/connect/; # 末尾的 / 确保路径替换
|
||||
|
||||
proxy_ssl_server_name on;
|
||||
proxy_ssl_session_reuse off;
|
||||
proxy_ssl_verify off;
|
||||
# 关键 2: 覆盖 Host 头，模拟 Vite 的 changeOrigin=true
|
||||
proxy_set_header Host $proxy_host; # 设置为目标地址的 Host (192.168.1.100:19901)
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $host:$server_port;
|
||||
proxy_set_header Authorization $http_authorization; # 传递 Authorization 头
|
||||
# 其他标准代理头
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_redirect https://sys-api:19902/connect/ https://$host:$server_port/connect/;
|
||||
|
||||
}
|
||||
location /Account/ {
|
||||
# 关键 1: 移除路径中的 /auth/ 前缀
|
||||
proxy_pass https://sys_api/Account/; # 末尾的 / 确保路径替换
|
||||
|
||||
proxy_ssl_server_name on;
|
||||
proxy_ssl_session_reuse off;
|
||||
proxy_ssl_verify off;
|
||||
# 关键 2: 覆盖 Host 头，模拟 Vite 的 changeOrigin=true
|
||||
proxy_set_header Host $proxy_host; # 设置为目标地址的 Host (192.168.1.100:19901)
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $host:$server_port;
|
||||
proxy_set_header Authorization $http_authorization; # 传递 Authorization 头
|
||||
# 其他标准代理头
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_redirect https://sys-api:19902/Account/ https://$host:$server_port/Account/;
|
||||
|
||||
}
|
||||
|
||||
# 2. Sys API 路由
|
||||
location /api/sys/ {
|
||||
proxy_pass https://sys_api/api/;
|
||||
|
|
@ -166,7 +112,6 @@ http {
|
|||
proxy_ssl_session_reuse off;
|
||||
proxy_ssl_verify off;
|
||||
proxy_set_header Authorization $http_authorization; # 传递 Authorization 头
|
||||
proxy_redirect http://sys-api:19903/ https://$host:$server_port/;
|
||||
}
|
||||
# 3. Lmg API 路由
|
||||
location /api/lmg/ {
|
||||
|
|
@ -175,7 +120,6 @@ http {
|
|||
proxy_ssl_session_reuse off;
|
||||
proxy_ssl_verify off;
|
||||
proxy_set_header Authorization $http_authorization; # 传递 Authorization 头
|
||||
proxy_redirect http://lmg-api:19903/ https://$host:$server_port/;
|
||||
}
|
||||
|
||||
# 4. Lmg UI 路由
|
||||
|
|
@ -183,26 +127,13 @@ http {
|
|||
location /lmg/ {
|
||||
# 将 /lmg/path -> http://lmg_ui/path
|
||||
proxy_pass http://lmg_ui/;
|
||||
proxy_redirect http://lmg_ui/ https://$host:$server_port/;
|
||||
}
|
||||
|
||||
# 6. OAuth 回调地址路由
|
||||
# 这个回调是给客户端(UI)的，这里我们假设它由 sys-ui 处理
|
||||
location = /Callback {
|
||||
# 将 /Callback -> http://sys_ui/Callback
|
||||
proxy_pass http://sys_ui;
|
||||
proxy_redirect http://sys_ui/ https://$host:$server_port/;
|
||||
proxy_redirect https://sys_ui/ https://$host:$server_port/;
|
||||
}
|
||||
# 5. Sys UI 和根路径路由
|
||||
# IMPORTANT: sys-ui 的前端路由基础路径(base path)需要配置为 /
|
||||
# 或者如果你想用 /sys/ 访问，则前端基础路径配 /sys/
|
||||
location / {
|
||||
# 根路径 / 直接访问 sys_ui
|
||||
# 将 /path -> http://sys_ui/path
|
||||
proxy_pass http://sys_ui;
|
||||
proxy_redirect http://sys_ui/ https://$host:$server_port/;
|
||||
proxy_redirect https://sys_ui/ https://$host:$server_port/;
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue