93 lines
3.2 KiB
Plaintext
93 lines
3.2 KiB
Plaintext
# 蓝绿切换的入口：唯一对外端口 80，容器常驻、发布时从不重建。
|
||
# 上游地址不写死，全部来自 active/ 下的 map（由 deploy.sh 生成 + nginx -s reload）。
|
||
# 该目录挂的是仓库外的 .deploy/nginx，所以发布时不会把 git 工作区改脏。
|
||
# 用变量做 proxy_pass，槽容器不存在时 nginx 依然能启动（按请求时才解析）。
|
||
|
||
# 切换点：map $host $api_up { default "backend_a:8090"; } ...
|
||
include /etc/nginx/active/*.conf;
|
||
|
||
# Docker 内置 DNS：服务名 -> 容器 IP
|
||
resolver 127.0.0.11 valid=10s ipv6=off;
|
||
resolver_timeout 3s;
|
||
|
||
server {
|
||
listen 80;
|
||
server_name _;
|
||
|
||
# SSG 内部接口：公网一律 404，绝不从外部出口
|
||
location ~ ^/api/(internal/ssg/|v1/ssg/) {
|
||
return 404;
|
||
}
|
||
|
||
# 后端 API：proxy_pass 不带 URI，原样透传 /api/... 前缀（带斜杠会把前缀剥掉导致全站 404）
|
||
location /api/ {
|
||
proxy_pass http://$api_up;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 3s;
|
||
proxy_read_timeout 60s;
|
||
}
|
||
|
||
# Astro 构建产物文件名带内容哈希，可长期缓存
|
||
location /_astro/ {
|
||
proxy_pass http://$web_up;
|
||
proxy_set_header Host $host;
|
||
expires 1y;
|
||
}
|
||
|
||
# Astro node server：SSR 详情页与静态资源
|
||
location / {
|
||
proxy_pass http://$web_up;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_read_timeout 60s;
|
||
}
|
||
|
||
# 部署脚本用来确认代理本身活着
|
||
location = /healthz {
|
||
access_log off;
|
||
return 200 "ok\n";
|
||
}
|
||
}
|
||
|
||
# 内部：web 容器的 SSR 取数走这里，永远指向当前活跃的后端槽
|
||
server {
|
||
listen 18090;
|
||
access_log off;
|
||
location / {
|
||
proxy_pass http://$api_up;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_read_timeout 60s;
|
||
}
|
||
}
|
||
|
||
# 内部：前端构建期取 SSG 数据（只绑宿主回环，前端镜像 build 时用 host 网络访问）
|
||
server {
|
||
listen 18091; # 容器内必须监听 0.0.0.0，否则 docker 端口发布到容器网卡时连不上；宿主机只发布到 127.0.0.1
|
||
access_log off;
|
||
location / {
|
||
proxy_pass http://$ssg_up;
|
||
proxy_set_header Host $host;
|
||
}
|
||
}
|
||
|
||
# 内部：管理后台（只绑宿主回环；远程访问用 SSH 隧道到 18092）
|
||
server {
|
||
listen 18092; # 同上：容器内回环监听会导致 docker 端口发布不可达（管理后台/爬虫入库走此口）
|
||
location / {
|
||
proxy_pass http://$admin_up;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
}
|
||
}
|