dootask/docker/nginx/default.conf
kuaifan 20c3fa91fb refactor(https): 协议识别下沉到 nginx,TrustProxies 只信 X-Forwarded-Proto
- nginx 经 APP_SCHEME 环境变量(envsubst 模板)统一控制 X-Forwarded-Proto
- TrustProxies 信任内网代理但仅采信 X-Forwarded-Proto,防 Host 注入
- 移除 WebApi 中间件的硬编码强制 https
- getSchemeAndHost 优先用当前请求 scheme/host,保留非请求上下文兜底
- cmd https 切换后改用 compose up -d 重建 nginx 容器使 envsubst 生效

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-06 01:52:38 +00:00

136 lines
4.0 KiB
Plaintext

map $host $app_scheme_raw {
default "${APP_SCHEME}";
}
map $app_scheme_raw $force_https {
"https" 1;
"on" 1;
"ssl" 1;
"1" 1;
"true" 1;
"yes" 1;
default 0;
}
map $http_upgrade $connection_upgrade {
default upgrade;
"" close;
}
map $http_host $this_host {
"" $host;
default $http_host;
}
map $http_x_forwarded_host $the_host {
"" $this_host;
default $http_x_forwarded_host;
}
map $http_x_forwarded_proto $auto_scheme {
"" $scheme;
default $http_x_forwarded_proto;
}
map $force_https $the_scheme {
1 https;
default $auto_scheme;
}
upstream service {
server php:20000 weight=5 max_fails=3 fail_timeout=30s;
keepalive 16;
}
server {
listen 80;
include /var/www/docker/nginx/site/*.conf;
root /var/www/public;
client_max_body_size 1024M;
autoindex off;
index index.html index.htm index.php;
charset utf-8;
add_header Access-Control-Expose-Headers "Date, Last-Modified, Age" always;
location / {
if ($uri ~* "^/uploads/.*\.(jpe?g|png|gif|webp)$") {
add_header Access-Control-Allow-Origin "http://localhost:22223" always;
add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
add_header Access-Control-Allow-Credentials "true" always;
}
try_files $uri @laravels;
}
location ~ \.well-known{
allow all;
}
location =/ws {
proxy_http_version 1.1;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Real-PORT $remote_port;
proxy_set_header X-Forwarded-Host $the_host;
proxy_set_header X-Forwarded-Proto $the_scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header Scheme $scheme;
proxy_set_header Server-Protocol $server_protocol;
proxy_set_header Server-Name $server_name;
proxy_set_header Server-Addr $server_addr;
proxy_set_header Server-Port $server_port;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
proxy_connect_timeout 3600s;
proxy_pass http://service;
}
location @laravels {
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Real-PORT $remote_port;
proxy_set_header X-Forwarded-Host $the_host;
proxy_set_header X-Forwarded-Proto $the_scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header Scheme $scheme;
proxy_set_header Server-Protocol $server_protocol;
proxy_set_header Server-Name $server_name;
proxy_set_header Server-Addr $server_addr;
proxy_set_header Server-Port $server_port;
proxy_pass http://service;
}
location /appstore/ {
proxy_http_version 1.1;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Real-PORT $remote_port;
proxy_set_header X-Forwarded-Host $the_host/appstore;
proxy_set_header X-Forwarded-Proto $the_scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header Scheme $scheme;
proxy_set_header Server-Protocol $server_protocol;
proxy_set_header Server-Name $server_name;
proxy_set_header Server-Addr $server_addr;
proxy_set_header Server-Port $server_port;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_pass http://appstore/;
}
include /var/www/docker/appstore/config/*/nginx.conf;
}
include /var/www/docker/nginx/conf.d/*.conf;