From 1ffb91509c88653e8036cd5866213f90f0047d01 Mon Sep 17 00:00:00 2001 From: mengdaoshizhongxinyang Date: Tue, 6 Oct 2026 00:22:55 +0800 Subject: [PATCH] feat: proxy admin and Next assets via cluster service [deploy] --- Dockerfile | 6 ++- README.md | 15 ++++--- docker-entrypoint.d/40-a-upstream.sh | 16 +++---- nginx.conf | 64 +++++++++++++++++++++------- 4 files changed, 67 insertions(+), 34 deletions(-) diff --git a/Dockerfile b/Dockerfile index ce98731..cc6eb44 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,9 @@ -# CI 中先 pnpm build 产出 dist/；运行时由 nginx 托管，并把 /embed /images /api/contact 反代到 A 站 +# CI 中先 pnpm build 产出 dist/；运行时由 nginx 托管，并把 admin/embed/api 反代到 A 站 FROM nginx:1.27-alpine -ENV A_UPSTREAM=https://project57.website-build.org +# 集群内 A 站 Service（port 80 -> container 3000） +ENV A_UPSTREAM=http://project57-svc.ns-project57.svc.cluster.local:80 +ENV A_PUBLIC=https://project57.website-build.org # 不走 templates/envsubst，避免把 nginx 的 $host/$uri 清空 COPY nginx.conf /etc/nginx/conf.d/default.conf diff --git a/README.md b/README.md index 58bc797..95f0e1d 100644 --- a/README.md +++ b/README.md @@ -10,17 +10,18 @@ CI 对齐 project0：提交带 `[deploy]` 会构建镜像并部署。nginx 监 仓库 Secrets：`LFS_PAT`、`KUBECONFIG_BASE64`。 -K8s 可设置环境变量覆盖 A 站地址（默认走 A 站公网域名，反代会带正确 Host/SNI）： +B 站会反代 A 站的前台与后台： + +- 前台：`/embed`、`/images`、`/api/contact` +- 后台：`/admin`、`/_next`、`/api/*`（登录 cookie 留在 B 域名） + +默认上游为集群内 Service： ``` -A_UPSTREAM=https://project57.website-build.org +A_UPSTREAM=http://project57-svc.ns-project57.svc.cluster.local:80 ``` -若改回集群内 Service，例如： - -``` -A_UPSTREAM=http://project57-deploy.ns-project57.svc.cluster.local:3000 -``` +后台入口：`https://project57-x.website-build.org/admin/login` ## 本地运行 diff --git a/docker-entrypoint.d/40-a-upstream.sh b/docker-entrypoint.d/40-a-upstream.sh index 26ca182..d94d88e 100644 --- a/docker-entrypoint.d/40-a-upstream.sh +++ b/docker-entrypoint.d/40-a-upstream.sh @@ -2,15 +2,11 @@ set -eu CONF=/etc/nginx/conf.d/default.conf -# A 站已有公网域名时走公网更稳；也可设为集群内 http://service.ns.svc:port -A_UPSTREAM="${A_UPSTREAM:-https://project57.website-build.org}" +# 集群内真实 Service：project57-svc:80（不是 project57-deploy:3000） +A_UPSTREAM="${A_UPSTREAM:-http://project57-svc.ns-project57.svc.cluster.local:80}" A_UPSTREAM="${A_UPSTREAM%/}" - -# 从 URL 提取 Host，供反代 Host / SNI（Cloudflare/Ingress 依赖正确 Host） -A_HOST="$(printf '%s' "${A_UPSTREAM}" | sed -E 's|^[a-zA-Z][a-zA-Z0-9+.-]*://||; s|[:/].*$||')" -if [ -z "${A_HOST}" ]; then - A_HOST=project57.website-build.org -fi +A_PUBLIC="${A_PUBLIC:-https://project57.website-build.org}" +A_PUBLIC="${A_PUBLIC%/}" NS="$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf || true)" if [ -z "${NS}" ]; then @@ -20,8 +16,8 @@ fi sed -i \ -e "s|__RESOLVER__|${NS}|g" \ -e "s|__A_UPSTREAM__|${A_UPSTREAM}|g" \ - -e "s|__A_HOST__|${A_HOST}|g" \ + -e "s|__A_PUBLIC__|${A_PUBLIC}|g" \ "${CONF}" -echo "nginx upstream: ${A_UPSTREAM} (Host ${A_HOST}, resolver ${NS})" +echo "nginx upstream: ${A_UPSTREAM} (resolver ${NS}, public ${A_PUBLIC})" nginx -t diff --git a/nginx.conf b/nginx.conf index 0d61ea0..7c80868 100644 --- a/nginx.conf +++ b/nginx.conf @@ -7,21 +7,65 @@ server { # 入口脚本写入集群 DNS；变量 proxy_pass 必须配合 resolver resolver __RESOLVER__ valid=10s ipv6=off; + # B 站自身探针，不转发 location = /api/health { default_type text/plain; add_header Content-Type text/plain; return 200 "ok"; } - # 反代到 A 站（默认公网域名；也可改成集群内 Service） + # Admin + Next 静态资源 + 其余 API（含 /api/admin、/api/contact、Server Actions） + location /admin { + set $a_upstream __A_UPSTREAM__; + proxy_pass $a_upstream$request_uri; + proxy_http_version 1.1; + proxy_ssl_server_name on; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header Cookie $http_cookie; + proxy_pass_header Set-Cookie; + proxy_redirect __A_PUBLIC__/ /; + } + + location /_next/ { + set $a_upstream __A_UPSTREAM__; + proxy_pass $a_upstream$request_uri; + proxy_http_version 1.1; + proxy_ssl_server_name on; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Real-IP $remote_addr; + } + + location /api/ { + set $a_upstream __A_UPSTREAM__; + proxy_pass $a_upstream$request_uri; + proxy_http_version 1.1; + proxy_ssl_server_name on; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header Cookie $http_cookie; + proxy_pass_header Set-Cookie; + } + + # 前台 embed 资源 location /embed/ { set $a_upstream __A_UPSTREAM__; proxy_pass $a_upstream$request_uri; proxy_http_version 1.1; proxy_ssl_server_name on; - proxy_set_header Host __A_HOST__; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; } @@ -30,20 +74,10 @@ server { proxy_pass $a_upstream$request_uri; proxy_http_version 1.1; proxy_ssl_server_name on; - proxy_set_header Host __A_HOST__; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Real-IP $remote_addr; - } - - location = /api/contact { - set $a_upstream __A_UPSTREAM__; - proxy_pass $a_upstream$request_uri; - proxy_http_version 1.1; - proxy_ssl_server_name on; - proxy_set_header Host __A_HOST__; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Real-IP $remote_addr; }