whm/web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(nginx): admin 用 upstream+proxy_pass 去前缀，替代变量/rewrite

Browse Source 
Made-with: Cursor
This commit is contained in:
whm
2026-03-23 19:43:47 +08:00
parent 78055dbe68
commit f5852bc04e
2 changed files with 30 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
nginx/yuheng.docker.conf.tpl
View File

@@ -1,5 +1,10 @@
# 由 scripts/nginx-entrypoint-wait-dns.sh 在启动时 sed 替换 @@NGINX_RESOLVER@@（来自容器 /etc/resolv.conf）
# 再写入 /etc/nginx/conf.d/default.conf。使用 resolver + 变量 proxy_pass，避免 Podman 下启动瞬间 host not found in upstream。
# 再写入 /etc/nginx/conf.d/default.conf。web/api 仍用变量 proxy_pass + resolver（Podman 下动态解析）。
# admin 使用 upstream + proxy_pass …/ 可正确去掉 /admin 前缀；勿用变量 proxy_pass，否则会把 /admin/assets/… 原样传到上游 → 白屏。
upstream yh_admin_upstream {
server admin:80;
}
server {
listen 443 ssl;
@@ -8,7 +13,6 @@ server {
server_name yuheng.yuxindazhineng.com;
client_max_body_size 800m;
# valid 过短会频繁重解析，宿主机 DNS 往往解析不了 compose 服务名 → 502；与 entrypoint 中优先 127.0.0.11 配合
resolver @@NGINX_RESOLVER@@ valid=300s ipv6=off;
ssl_certificate /etc/ssl/yh_web/yuheng.yuxindazhineng.com/fullchain.pem;
@@ -18,7 +22,6 @@ server {
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
# 验证文件在 443 上直接读挂载目录，不经 yh_web 反代（避免正则 alias 403、与内网路径不一致）
location ~ ^/[A-Za-z0-9._-]+\.(txt|html|xml)$ {
root /verify-root;
try_files $uri =404;
@@ -26,27 +29,9 @@ server {
add_header Cache-Control "no-store";
}
# 变量 proxy_pass 不会按普通规则去掉 location 前缀，会把完整 URI /admin/assets/... 传到上游 → 内层无法匹配 /assets/ → 全站 index.html 白屏
# 须先 rewrite 去掉 /admin，再反代（与 /api/ 不同：api 需要保留 /api 前缀）
location / {
set $upstream_web web;
proxy_pass http://$upstream_web:80;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /admin/ {
rewrite ^/admin/(.*)$ /$1 break;
set $upstream_admin admin;
proxy_pass http://$upstream_admin:80;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# 无尾斜杠会落到 location / → 误走 web
location = /admin {
return 301 /admin/;
}
location /api/ {
@@ -58,4 +43,24 @@ server {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# 尾斜杠形式：proxy_pass 带 / 会去掉 /admin 前缀，上游收到 /assets/…、/index.html 等
location /admin/ {
proxy_pass http://yh_admin_upstream/;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location / {
set $upstream_web web;
proxy_pass http://$upstream_web:80;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}