feat(#91): 生产环境部署方案 - 服务器初始化/Nginx HTTPS/compose生产覆盖/备份策略+文档

2026-08-11 07:06:42 +08:00
parent 0f382ce2d0
commit 8090a725cd
5 changed files with 217 additions and 0 deletions
@@ -0,0 +1,69 @@
+# 生产 Nginx：HTTPS + HTTP2 + HSTS + 限流 + WebSocket（Issue #91）
+user nginx;
+worker_processes auto;
+events { worker_connections 2048; }
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+    sendfile on;
+    gzip on;
+    server_tokens off;
+
+    limit_req_zone $binary_remote_addr zone=api:10m rate=20r/s;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+
+    # HTTP 强制跳转 HTTPS
+    server {
+        listen 80;
+        server_name wms.xayunmei.com;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name wms.xayunmei.com;
+
+        ssl_certificate     /etc/nginx/certs/wms.crt;
+        ssl_certificate_key /etc/nginx/certs/wms.key;
+        ssl_protocols       TLSv1.2 TLSv1.3;
+        ssl_ciphers         HIGH:!aNULL:!MD5;
+        ssl_session_cache   shared:SSL:10m;
+        ssl_session_timeout 1d;
+
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        add_header X-Frame-Options DENY always;
+        add_header X-Content-Type-Options nosniff always;
+        add_header Referrer-Policy no-referrer always;
+
+        client_max_body_size 50m;
+
+        location /api/ {
+            limit_req zone=api burst=40 nodelay;
+            proxy_pass http://127.0.0.1:8000;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto https;
+        }
+
+        location /ws/ {
+            proxy_pass http://127.0.0.1:8000;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_read_timeout 3600s;
+        }
+
+        location / {
+            proxy_pass http://127.0.0.1:8000;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+    }
+}