mirror of
https://github.com/kuaifan/dootask.git
synced 2026-06-16 20:32:23 +00:00
- nginx 经 APP_SCHEME 环境变量(envsubst 模板)统一控制 X-Forwarded-Proto - TrustProxies 信任内网代理但仅采信 X-Forwarded-Proto,防 Host 注入 - 移除 WebApi 中间件的硬编码强制 https - getSchemeAndHost 优先用当前请求 scheme/host,保留非请求上下文兜底 - cmd https 切换后改用 compose up -d 重建 nginx 容器使 envsubst 生效 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
136 lines
4.0 KiB
Plaintext
136 lines
4.0 KiB
Plaintext
map $host $app_scheme_raw {
|
|
default "${APP_SCHEME}";
|
|
}
|
|
|
|
map $app_scheme_raw $force_https {
|
|
"https" 1;
|
|
"on" 1;
|
|
"ssl" 1;
|
|
"1" 1;
|
|
"true" 1;
|
|
"yes" 1;
|
|
default 0;
|
|
}
|
|
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
"" close;
|
|
}
|
|
|
|
map $http_host $this_host {
|
|
"" $host;
|
|
default $http_host;
|
|
}
|
|
|
|
map $http_x_forwarded_host $the_host {
|
|
"" $this_host;
|
|
default $http_x_forwarded_host;
|
|
}
|
|
|
|
map $http_x_forwarded_proto $auto_scheme {
|
|
"" $scheme;
|
|
default $http_x_forwarded_proto;
|
|
}
|
|
|
|
map $force_https $the_scheme {
|
|
1 https;
|
|
default $auto_scheme;
|
|
}
|
|
|
|
upstream service {
|
|
server php:20000 weight=5 max_fails=3 fail_timeout=30s;
|
|
keepalive 16;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
|
|
include /var/www/docker/nginx/site/*.conf;
|
|
|
|
root /var/www/public;
|
|
|
|
client_max_body_size 1024M;
|
|
|
|
autoindex off;
|
|
index index.html index.htm index.php;
|
|
|
|
charset utf-8;
|
|
|
|
add_header Access-Control-Expose-Headers "Date, Last-Modified, Age" always;
|
|
|
|
location / {
|
|
if ($uri ~* "^/uploads/.*\.(jpe?g|png|gif|webp)$") {
|
|
add_header Access-Control-Allow-Origin "http://localhost:22223" always;
|
|
add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
|
|
add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
|
|
add_header Access-Control-Allow-Credentials "true" always;
|
|
}
|
|
|
|
try_files $uri @laravels;
|
|
}
|
|
|
|
location ~ \.well-known{
|
|
allow all;
|
|
}
|
|
|
|
location =/ws {
|
|
proxy_http_version 1.1;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Real-PORT $remote_port;
|
|
proxy_set_header X-Forwarded-Host $the_host;
|
|
proxy_set_header X-Forwarded-Proto $the_scheme;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header Scheme $scheme;
|
|
proxy_set_header Server-Protocol $server_protocol;
|
|
proxy_set_header Server-Name $server_name;
|
|
proxy_set_header Server-Addr $server_addr;
|
|
proxy_set_header Server-Port $server_port;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_read_timeout 3600s;
|
|
proxy_send_timeout 3600s;
|
|
proxy_connect_timeout 3600s;
|
|
proxy_pass http://service;
|
|
}
|
|
|
|
location @laravels {
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Real-PORT $remote_port;
|
|
proxy_set_header X-Forwarded-Host $the_host;
|
|
proxy_set_header X-Forwarded-Proto $the_scheme;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header Scheme $scheme;
|
|
proxy_set_header Server-Protocol $server_protocol;
|
|
proxy_set_header Server-Name $server_name;
|
|
proxy_set_header Server-Addr $server_addr;
|
|
proxy_set_header Server-Port $server_port;
|
|
proxy_pass http://service;
|
|
}
|
|
|
|
location /appstore/ {
|
|
proxy_http_version 1.1;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Real-PORT $remote_port;
|
|
proxy_set_header X-Forwarded-Host $the_host/appstore;
|
|
proxy_set_header X-Forwarded-Proto $the_scheme;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header Scheme $scheme;
|
|
proxy_set_header Server-Protocol $server_protocol;
|
|
proxy_set_header Server-Name $server_name;
|
|
proxy_set_header Server-Addr $server_addr;
|
|
proxy_set_header Server-Port $server_port;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_pass http://appstore/;
|
|
}
|
|
|
|
include /var/www/docker/appstore/config/*/nginx.conf;
|
|
}
|
|
|
|
include /var/www/docker/nginx/conf.d/*.conf;
|