fix(nginx): 验证文件改用 root+try_files，443 层挂载 verify-root 直连避免 403

Made-with: Cursor
2026-03-23 09:20:25 +08:00
parent c6e5779b76
commit eb6923998f
5 changed files with 31 additions and 5 deletions
--- a/nginx/yuheng.docker.conf.tpl
+++ b/nginx/yuheng.docker.conf.tpl
@@ -17,6 +17,14 @@ server {
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

+    # 验证文件在 443 上直接读挂载目录，不经 yh_web 反代（避免正则 alias 403、与内网路径不一致）
+    location ~ ^/[A-Za-z0-9._-]+\.(txt|html|xml)$ {
+        root /verify-root;
+        try_files $uri =404;
+        default_type text/plain;
+        add_header Cache-Control "no-store";
+    }
+
    location / {
        set $upstream_web web;
        proxy_pass http://$upstream_web:80;