whm/web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(nginx): Podman 下弃用 127.0.0.11 resolver，启动前等待上游可达

Browse Source 
Made-with: Cursor
This commit is contained in:
whm
2026-03-21 23:57:36 +08:00
parent 89cd8f83bc
commit 5bfdd04f21
3 changed files with 47 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
nginx/yuheng.docker.conf
View File

@@ -1,7 +1,8 @@
# 供 docker-compose 中 nginx 使用：仅监听 443，反代到 api/web/admin；证书挂载到 /etc/ssl/yh_web/yuheng.yuxindazhineng.com/
#
# 使用 resolver + 变量形式的 proxy_pass：避免启动时同步解析 upstream 主机名失败
#（Docker/Podman 在 yh_nginx 刚起来时，内置 DNS 里可能还没有 web/admin/api，会报 host not found in upstream "web"）
# 使用静态 proxy_pass（依赖 Compose/Podman 内置 DNS）。容器启动顺序由 depends_on + docker-compose.yml
# 中 entrypoint 等待脚本保证：解析就绪后再启动 nginx，避免「host not found in upstream」。
# 勿配合 127.0.0.11 resolver + 变量 proxy_pass 用于 Podman：无该 DNS 时会导致长时间超时 → 502。
server {
listen 443 ssl;
@@ -10,9 +11,6 @@ server {
server_name yuheng.yuxindazhineng.com;
client_max_body_size 800m;
# Docker Compose 内置 DNS；若 Podman 下首包 502，可在此增加本网关 IP（podman network inspect 查看）
resolver 127.0.0.11 valid=10s ipv6=off;
ssl_certificate /etc/ssl/yh_web/yuheng.yuxindazhineng.com/fullchain.pem;
ssl_certificate_key /etc/ssl/yh_web/yuheng.yuxindazhineng.com/privkey.pem;
ssl_session_timeout 1d;
@@ -21,8 +19,7 @@ server {
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
location / {
set $upstream_web web;
proxy_pass http://$upstream_web:80;
proxy_pass http://web:80;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
@@ -31,8 +28,7 @@ server {
}
location /admin/ {
set $upstream_admin admin;
proxy_pass http://$upstream_admin:80/;
proxy_pass http://admin:80/;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
@@ -42,8 +38,7 @@ server {
# 不要用尾部斜杠，否则 /api/health 会变成 /health，而后端注册的是 /api/health
location /api/ {
set $upstream_api api;
proxy_pass http://$upstream_api:8088;
proxy_pass http://api:8088;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;