fix: proxy embed to A public host with correct Host/SNI [deploy]

nginx.conf

@@ -4,7 +4,7 @@ server {
   root /usr/share/nginx/html;
   index index.html;
 
-  # 由入口脚本写入：集群 DNS + A 站地址。用变量做 proxy_pass，启动时不解析上游，A 站暂不可达也不会让 nginx 起不来。
+  # 入口脚本写入集群 DNS；变量 proxy_pass 必须配合 resolver
   resolver __RESOLVER__ valid=10s ipv6=off;
 
   location = /api/health {
@@ -13,31 +13,38 @@ server {
     return 200 "ok";
   }
 
+  # 反代到 A 站（默认公网域名；也可改成集群内 Service）
   location /embed/ {
     set $a_upstream __A_UPSTREAM__;
-    proxy_pass $a_upstream;
+    proxy_pass $a_upstream$request_uri;
     proxy_http_version 1.1;
-    proxy_set_header Host $host;
+    proxy_ssl_server_name on;
+    proxy_set_header Host __A_HOST__;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Real-IP $remote_addr;
   }
 
   location /images/ {
     set $a_upstream __A_UPSTREAM__;
-    proxy_pass $a_upstream;
+    proxy_pass $a_upstream$request_uri;
     proxy_http_version 1.1;
-    proxy_set_header Host $host;
+    proxy_ssl_server_name on;
+    proxy_set_header Host __A_HOST__;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Real-IP $remote_addr;
   }
 
   location = /api/contact {
     set $a_upstream __A_UPSTREAM__;
-    proxy_pass $a_upstream;
+    proxy_pass $a_upstream$request_uri;
     proxy_http_version 1.1;
-    proxy_set_header Host $host;
+    proxy_ssl_server_name on;
+    proxy_set_header Host __A_HOST__;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Real-IP $remote_addr;
   }
 
   location / {