fix: proxy admin via A public host, ClusterIP port 80 refused [deploy]

Dockerfile

@@ -1,11 +1,9 @@
 # CI 中先 pnpm build 产出 dist/；运行时由 nginx 托管，并把 admin/embed/api 反代到 A 站
 FROM nginx:1.27-alpine
 
-# 集群内 A 站 Service（port 80 -> container 3000）
-ENV A_UPSTREAM=http://project57-svc.ns-project57.svc.cluster.local:80
-ENV A_PUBLIC=https://project57.website-build.org
+# 走 A 站公网（集群内 project57-svc:80 当前 Connection refused）
+ENV A_UPSTREAM=https://project57.website-build.org
 
-# 不走 templates/envsubst，避免把 nginx 的 $host/$uri 清空
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY docker-entrypoint.d/40-a-upstream.sh /docker-entrypoint.d/40-a-upstream.sh
 RUN sed -i 's/\r$//' /docker-entrypoint.d/40-a-upstream.sh \

README.md

@@ -15,10 +15,10 @@ B 站会反代 A 站的前台与后台：
 - 前台：`/embed`、`/images`、`/api/contact`
 - 后台：`/admin`、`/_next`、`/api/*`（登录 cookie 留在 B 域名）
 
-默认上游为集群内 Service：
+默认上游走 A 站公网（集群内 `project57-svc:80` 当前会 Connection refused）：
 
 ```
-A_UPSTREAM=http://project57-svc.ns-project57.svc.cluster.local:80
+A_UPSTREAM=https://project57.website-build.org
 ```
 
 后台入口：`https://project57-x.website-build.org/admin/login`

docker-entrypoint.d/40-a-upstream.sh

@@ -2,11 +2,14 @@
 set -eu
 
 CONF=/etc/nginx/conf.d/default.conf
-# 集群内真实 Service：project57-svc:80（不是 project57-deploy:3000）
-A_UPSTREAM="${A_UPSTREAM:-http://project57-svc.ns-project57.svc.cluster.local:80}"
+# 集群内 ClusterIP:80 会 Connection refused，改走已验证可通的 A 站公网
+A_UPSTREAM="${A_UPSTREAM:-https://project57.website-build.org}"
 A_UPSTREAM="${A_UPSTREAM%/}"
-A_PUBLIC="${A_PUBLIC:-https://project57.website-build.org}"
-A_PUBLIC="${A_PUBLIC%/}"
+
+A_HOST="$(printf '%s' "${A_UPSTREAM}" | sed -E 's|^[a-zA-Z][a-zA-Z0-9+.-]*://||; s|[:/].*$||')"
+if [ -z "${A_HOST}" ]; then
+  A_HOST=project57.website-build.org
+fi
 
 NS="$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf || true)"
 if [ -z "${NS}" ]; then
@@ -16,8 +19,8 @@ fi
 sed -i \
   -e "s|__RESOLVER__|${NS}|g" \
   -e "s|__A_UPSTREAM__|${A_UPSTREAM}|g" \
-  -e "s|__A_PUBLIC__|${A_PUBLIC}|g" \
+  -e "s|__A_HOST__|${A_HOST}|g" \
   "${CONF}"
 
-echo "nginx upstream: ${A_UPSTREAM} (resolver ${NS}, public ${A_PUBLIC})"
+echo "nginx upstream: ${A_UPSTREAM} (Host ${A_HOST}, resolver ${NS})"
 nginx -t

nginx.conf

@@ -4,30 +4,28 @@ server {
   root /usr/share/nginx/html;
   index index.html;
 
-  # 入口脚本写入集群 DNS；变量 proxy_pass 必须配合 resolver
   resolver __RESOLVER__ valid=10s ipv6=off;
 
-  # B 站自身探针，不转发
   location = /api/health {
     default_type text/plain;
     add_header Content-Type text/plain;
     return 200 "ok";
   }
 
-  # Admin + Next 静态资源 + 其余 API（含 /api/admin、/api/contact、Server Actions）
   location /admin {
     set $a_upstream __A_UPSTREAM__;
     proxy_pass $a_upstream$request_uri;
     proxy_http_version 1.1;
     proxy_ssl_server_name on;
-    proxy_set_header Host $host;
+    proxy_set_header Host __A_HOST__;
     proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header Cookie $http_cookie;
     proxy_pass_header Set-Cookie;
-    proxy_redirect __A_PUBLIC__/ /;
+    proxy_redirect https://__A_HOST__/ /;
+    proxy_redirect http://__A_HOST__/ /;
   }
 
   location /_next/ {
@@ -35,11 +33,12 @@ server {
     proxy_pass $a_upstream$request_uri;
     proxy_http_version 1.1;
     proxy_ssl_server_name on;
-    proxy_set_header Host $host;
+    proxy_set_header Host __A_HOST__;
     proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header Cookie $http_cookie;
   }
 
   location /api/ {
@@ -47,23 +46,23 @@ server {
     proxy_pass $a_upstream$request_uri;
     proxy_http_version 1.1;
     proxy_ssl_server_name on;
-    proxy_set_header Host $host;
+    proxy_set_header Host __A_HOST__;
     proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header Cookie $http_cookie;
     proxy_pass_header Set-Cookie;
+    proxy_redirect https://__A_HOST__/ /;
+    proxy_redirect http://__A_HOST__/ /;
   }
 
-  # 前台 embed 资源
   location /embed/ {
     set $a_upstream __A_UPSTREAM__;
     proxy_pass $a_upstream$request_uri;
     proxy_http_version 1.1;
     proxy_ssl_server_name on;
-    proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header Host __A_HOST__;
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Real-IP $remote_addr;
@@ -74,8 +73,7 @@ server {
     proxy_pass $a_upstream$request_uri;
     proxy_http_version 1.1;
     proxy_ssl_server_name on;
-    proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header Host __A_HOST__;
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Real-IP $remote_addr;