diff --git a/nginx.conf.gateway b/nginx.conf.gateway index 052def5..6880d09 100644 --- a/nginx.conf.gateway +++ b/nginx.conf.gateway @@ -47,41 +47,6 @@ http { # ====================== # 1. IdentityServer4 专用端口 (8001) # ====================== - server { - listen 443 ssl; - server_name 106.52.199.114; - ssl_certificate /etc/nginx/certs/gateway.crt; - ssl_certificate_key /etc/nginx/certs/gateway.key; - ssl_protocols TLSv1.2 TLSv1.3; - ssl_prefer_server_ciphers on; - ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 10m; - ssl_verify_client off; # ↓ 允许自签名证书 - ssl_verify_depth 0; - - location /connect/ { - # 关键 1: 移除路径中的 /auth/ 前缀 - proxy_pass https://sys_api/connect/; # 末尾的 / 确保路径替换 - - proxy_ssl_server_name on; - proxy_ssl_session_reuse off; - proxy_ssl_verify off; - # 关键 2: 覆盖 Host 头,模拟 Vite 的 changeOrigin=true - proxy_set_header Host $proxy_host; # 设置为目标地址的 Host - - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-Host $host:$server_port; - proxy_set_header Authorization $http_authorization; # 传递 Authorization 头 - # 其他标准代理头 - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - - # 关键 4: 重写后端返回的 Location 头(解决重定向端口丢失) - proxy_redirect https://sys_api:19902/ http://$host:$server_port/auth/; - proxy_redirect https://sys_api/ http://$host:$server_port/auth/; - } - } server { listen 8001 ssl; server_name 106.52.199.114; @@ -122,7 +87,7 @@ http { proxy_set_header X-Forwarded-Port $server_port; # 有些情况下需要 # 关键:重写后端返回的Location头(防止重定向到内部端口) - proxy_redirect https://sys-api:19902/ https://$host:8001/; + proxy_redirect https://sys-api https://$host:8001/; } }