100 lines
3.9 KiB
Plaintext
100 lines
3.9 KiB
Plaintext
# Nginx 反向代理配置模板（test 环境）
|
||
#
|
||
# 用途：frontend-test.banlv-ai.com → http://localhost:3000 (Next.js)
|
||
#
|
||
# **关键**：转发 `Host` / `X-Forwarded-Host` / `X-Forwarded-Proto` 请求头
|
||
# —— NextAuth v4 靠这些**算**对 OAuth callback 的 `redirect_uri`
|
||
# —— **不**传的话 Next.js 看**到** `Host: localhost:3000`，
|
||
# `redirect_uri = http://localhost:3000/api/auth/callback/facebook`
|
||
# → Facebook 拒**绝**（**不**在白名单）→ 跳 error?error=OAuthSignin
|
||
#
|
||
# 部署步骤（**手**动，**不**会**自**动部署）：
|
||
# 1. cp scripts/deploy/nginx-frontend-test.conf.example /etc/nginx/sites-available/frontend-test.banlv-ai.com
|
||
# 2. ln -s /etc/nginx/sites-available/frontend-test.banlv-ai.com /etc/nginx/sites-enabled/
|
||
# 3. certbot --nginx -d frontend-test.banlv-ai.com # 如果**还**没**装** SSL
|
||
# 4. nginx -t && nginx -s reload
|
||
|
||
server {
|
||
listen 80;
|
||
listen [::]:80;
|
||
server_name frontend-test.banlv-ai.com;
|
||
|
||
# **强**制 HTTPS（**可**选 —— 如**果**已经**有** certbot，**让** certbot **自**动**加** 301）
|
||
# return 301 https://$host$request_uri;
|
||
|
||
# **可**选：acme-challenge 给 certbot 验证**用**
|
||
# location /.well-known/acme-challenge/ {
|
||
# root /var/www/html;
|
||
# }
|
||
|
||
location / {
|
||
proxy_pass http://localhost:3000;
|
||
proxy_http_version 1.1;
|
||
|
||
# **核心** —— 转发**公**网 host / protocol 给 Next.js
|
||
# NextAuth v4 **优**先**级**：
|
||
# 1. NEXTAUTH_URL env
|
||
# 2. Host 头（nginx **不**转发 = Next.js 看**到** localhost:3000）❌
|
||
# 3. X-Forwarded-Host 头 ← **这**行**关**键，**不**传就 GG
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header X-Forwarded-Host $host;
|
||
proxy_set_header X-Forwarded-Port $server_port;
|
||
|
||
# WebSocket 支持（Next.js HMR + 业务 WS）
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
|
||
# 超时
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 60s;
|
||
}
|
||
}
|
||
|
||
# HTTPS server block（certbot 会**自**动**生**成）
|
||
# 如**果** certbot **没**自**动**加，**手**动**复**制**下**面
|
||
server {
|
||
listen 443 ssl http2;
|
||
listen [::]:443 ssl http2;
|
||
server_name frontend-test.banlv-ai.com;
|
||
|
||
ssl_certificate /etc/letsencrypt/live/frontend-test.banlv-ai.com/fullchain.pem;
|
||
ssl_certificate_key /etc/letsencrypt/live/frontend-test.banlv-ai.com/privkey.pem;
|
||
|
||
# SSL 配置（**参**考 Mozilla Intermediate）
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
|
||
ssl_prefer_server_ciphers off;
|
||
ssl_session_cache shared:SSL:10m;
|
||
ssl_session_timeout 1d;
|
||
ssl_session_tickets off;
|
||
|
||
# HSTS
|
||
add_header Strict-Transport-Security "max-age=63072000" always;
|
||
add_header X-Frame-Options SAMEORIGIN;
|
||
add_header X-Content-Type-Options nosniff;
|
||
|
||
location / {
|
||
proxy_pass http://localhost:3000;
|
||
proxy_http_version 1.1;
|
||
|
||
# **核心** —— 转发**公**网 host / protocol（**与** HTTP block **同**）
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header X-Forwarded-Host $host;
|
||
proxy_set_header X-Forwarded-Port $server_port;
|
||
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 60s;
|
||
}
|
||
}
|