my-vault/01_Projects/Work/Government-Projects/Panyu-District/Panyu-Housing/maintanance.md

# 172.25.101.113:
## nacos
/data/nacos

```
bash deploy.sh
```


## redis
```
systemctl start redis
```

## harbor

```
cd /data/harbor
docker-compose start
```


## minio

```
docker start minio
```


```new password for admin
uiPah2iok,e;giew
```

## tomcat

```
cd /usr/local/apache-tomcat-8.5.69
./bin/startup.sh
```



# 172.25.101.39
## wyn
```
docker start wyn
```

## pyresb
```
cd /opt/apps
bash deploy.sh
```

## nginx
```
cd /usr/local/nginx
./sbin/nginx
```



# mysql
172.25.1.45

```
root/Gzzn!37622  
py_credit/Credit@gzzn2021  
pyresbs/pyresb123@Admin
```

```old root
Gzzn!37622
```

```
ALTER USER 'pyresbs'@'%' IDENTIFIED BY 'pyresbs2024@Admin';
```

```
pyresbs2024@Admin
```

```
ALTER USER 'root'@'%' IDENTIFIED BY 'Gzzn37622@2024';
```

```
SET PASSWORD FOR 'root'@'%' = 'Gzzn37622@2024';
SET PASSWORD FOR 'root'@'localhost' = 'Gzzn37622@2024';
```

```
FLUSH PRIVILEGES;
```

new root:
```
Gzzn37622@2024
```


```
ALTER USER 'py_credit'@'%' IDENTIFIED BY 'Credit@gzzn2024';
```


```
Credit@gzzn2024
```




Harbor 公开镜像仓库未授权访问 CVE-2022-46463

限制公开访问，进入“项目设置”→“配置管理”→“项目仓库”中的“公开”，取消勾选。




证书：

```bash
#!/bin/bash

# 配置变量
CERT_PATH="/etc/letsencrypt"
DATA_PATH="/var/lib/letsencrypt"
LOG_PATH="/var/log/certbot"
WEBROOT_PATH="/var/www/certbot"

# 颜色输出函数
print_info() {
    echo -e "\033[0;34m[INFO] $1\033[0m"
}

print_success() {
    echo -e "\033[0;32m[SUCCESS] $1\033[0m"
}

print_error() {
    echo -e "\033[0;31m[ERROR] $1\033[0m"
}

# 创建必要的目录
create_directories() {
    local dirs=(
        "$CERT_PATH"
        "$DATA_PATH"
        "$LOG_PATH"
        "$WEBROOT_PATH"
    )

    for dir in "${dirs[@]}"; do
        if [ ! -d "$dir" ]; then
            print_info "Creating directory: $dir"
            mkdir -p "$dir"
            if [ $? -eq 0 ]; then
                print_success "Created $dir successfully"
            else
                print_error "Failed to create $dir"
                return 1
            fi
        else
            print_info "Directory already exists: $dir"
        fi
    done
}

# 设置权限
set_permissions() {
    print_info "Setting directory permissions..."
    
    # 设置基本目录权限
    chmod 755 "$CERT_PATH" "$DATA_PATH" "$LOG_PATH" "$WEBROOT_PATH"
    
    # 如果证书目录已存在，设置证书文件权限
    if [ -d "$CERT_PATH/live" ]; then
        find "$CERT_PATH/live" -type d -exec chmod 755 {} \;
        find "$CERT_PATH/live" -type f -exec chmod 644 {} \;
        find "$CERT_PATH/live" -name "privkey.pem" -exec chmod 600 {} \;
    fi
    
    print_success "Permissions set successfully"
}

# 创建日志文件
create_logfile() {
    local logfile="$LOG_PATH/certbot.log"
    if [ ! -f "$logfile" ]; then
        print_info "Creating log file: $logfile"
        touch "$logfile"
        chmod 644 "$logfile"
        print_success "Created log file successfully"
    else
        print_info "Log file already exists: $logfile"
    fi
}

# 主函数
main() {
    print_info "Starting initialization..."
    
    # 检查是否为 root 用户
    if [ "$EUID" -ne 0 ]; then 
        print_error "Please run as root"
        exit 1
    fi
    
    # 执行初始化步骤
    create_directories || exit 1
    set_permissions || exit 1
    create_logfile || exit 1
    
    print_success "Initialization completed successfully"
}

# 执行主函数
main


```



```bash
#!/bin/bash

# 域名配置
DOMAIN="pyqys.panyu.gd.cn"
EMAIL="zhiqiang@windy.me"

# 路径配置
CERT_PATH="/etc/letsencrypt"
DATA_PATH="/var/lib/letsencrypt"
LOG_PATH="/var/log/certbot"
WEBROOT_PATH="/var/www/certbot"

# 颜色输出函数
print_info() {
    echo -e "\033[0;34m[INFO] $1\033[0m"
}

print_success() {
    echo -e "\033[0;32m[SUCCESS] $1\033[0m"
}

print_error() {
    echo -e "\033[0;31m[ERROR] $1\033[0m"
}

```


```bash
#!/bin/bash

# 配置
DOMAIN="httpyqys.panyu.gd.cn"
EMAIL="zhiqiang@windy.me"
CERT_PATH="/etc/letsencrypt"
DATA_PATH="/var/lib/letsencrypt"


# 申请证书
docker run -it --rm \
    -v "${CERT_PATH}:${CERT_PATH}" \
    -v "${DATA_PATH}:${DATA_PATH}" \
    certbot/certbot certonly \
    --manual \
    --preferred-challenges dns \
    --email "$EMAIL" \
    -d "$DOMAIN" \
    --agree-tos \
    --no-eff-email


```

renew

```bash

DOMAIN="httpyqys.panyu.gd.cn"
EMAIL="zhiqiang@windy.me"
CERT_PATH="/etc/letsencrypt"
DATA_PATH="/var/lib/letsencrypt"


# 申请证书
docker run -it --rm \
    -v "${CERT_PATH}:${CERT_PATH}" \
    -v "${DATA_PATH}:${DATA_PATH}" \
    certbot/certbot renew \
    --manual \
    --preferred-challenges dns \
    --email "$EMAIL" \
    -d "$DOMAIN" \
    --agree-tos \
    --no-eff-email
```


original:

```nginx.conf
worker_processes  2;

error_log /var/log/nginx/error.log error;

events {
    worker_connections  1024;
}
#stream {
#      server {
#          listen 443;
#          proxy_pass mysql_server;
#      }
#      upstream mysql_server{
#          server 172.16.0.2:3306;
#
#      }
#}

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  logs/access.log  main;

    sendfile        off;

    server_names_hash_bucket_size 128;
    client_max_body_size 100m;         #ÖҪÊÕ¸öýÆËϴ«Î¼þ´ó¡
    client_body_timeout   10;
    client_header_timeout 10;
    keepalive_timeout  65;
        send_timeout          10;
    keepalive_requests    10;
    #server {
    ##    listen       80;
    #    server_name  172.25.101.39 ;
    #    rewrite ^/$ http://${server_name}/portal/ ;
    #}
    server {
        listen       80;
        server_name pyqys.panyu.gd.cn localhost 127.0.0.1 _;
 #       deny 172.25.244.179;
 #       deny 172.25.200.115;
 #        allow all;
        #rewrite ^/$ https://${host}/portal/;
        rewrite ^(.*)$  https://$host$1 permanent;
    
        set $method $request_method;
        if ($http_X_HTTP_Method_Override ~* 'DELETE') {
                set $method DELETE;
        }
        proxy_method $method;
    
    #    if ( $remote_addr ~* "172\.25\.200\.115"){
    #        return 302 "https://www.baidu.com/";
    #    }

        #location ~ / {
        #    if ( $query_string ~* ^\/pcidss\/report.* ){
        #        return 400;
        #       }
        #}
        # if ($content_length = 0) {
       #     return 403;
       # }

        location /kaAV6VwL8o.txt {
            alias /usr/local/nginx/html/kaAV6VwL8o.txt;
        }
 
        location /gzznGIS {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/gzznGIS;
        }

        location /aPicture {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/aPicture;
        }
        location /portal/system/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/system/;
        }

        location =/pyresbLogin/config/ {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
        
        location =/pyresbLogin/user/unlock {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
        
        location =/pyresbLogin/user/ {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }

        location =/pyresbLogin/user/find/ {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }


        location /pyresbLogin/css {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
                
        location /pyresbLogin/img {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
                
        location /pyresbLogin/js {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
                
        location =/pyresbLogin/pyresbLogin/ {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
                
        location =/pyresbLogin/pyresbLogin/config/ {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
                
        location /portal/assets {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
                
        location /portal/css {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
                
        location /portal/fonts {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
                
        location /portal/img {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
             proxy_pass http://172.25.101.39:8081;
        }
                
        location /portal/js {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
                
        location =/report/ {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
        
        location /report {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
        location =/report/captcha/ {
            if ($request_method !~ ^(GET)$)
             {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }


        location /wyn/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/;
        }
        location /Account/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/Account/;
        }
        location /LicenseRegister {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/LicenseRegister;
        }
        location /api/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/api/;
        }
        location /dashboard {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/dashboard;
        }
        
        location /mobile {
            alias /usr/local/nginx/html/mobile;
            index index.html index.htm;
        }
        
        # mobile
        
        location /mobile/gzznGIS {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/gzznGIS/;
        }

        location /mobile/aPicture {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/aPicture/;
        }
        location /mobile/portal/system/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/system/;
        }

        location /mobile/pyresbLogin {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            rewrite ^/mobile/(.*) /$1 break;
            proxy_pass http://172.25.101.39:8081/pyresbLogin/;
        }
                
        location /mobile/report {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/report;
        }
                
        location /mobile/display {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/;
        }
                
        location /mobile/portal {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/portal/;
        }
        
        location /mobile/system {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/system/;
        }
        
        location /mobile/doc {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/doc/;
        }

        location /mobile/wyn/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/;
        }
        location /mobile/Account/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/Account/;
        }
        location /mobile/LicenseRegister {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/LicenseRegister/;
        }
        location /mobile/api/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/api/;
        }
        location /mobile/dashboard {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/dashboard/;
        }

        location /dmp-client {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;            proxy_pass http://172.25.101.113:8080/dmp-client;
        }

        location / {

            if ( $request_uri !~* ^/(Model|display|report|portal|pyresbLogin|system|doc|wyn|system|gzznGIS|dashboard|aPicture|mobile|ibls-s
erver) ){
                return 403;
               }

            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }
        #        location /nacos {
#            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#            proxy_set_header X-Real-IP $remote_addr;
#            proxy_set_header Host $host:$server_port;
#            proxy_pass http://172.25.101.113:8848/nacos;
#        }



        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }
    
    server {
        listen       443 ssl;
        #listen       [::]:443 ssl;
        #ssl          on;
        server_name  localhost pyqys.panyu.gd.cn 172.25.101.39 127.0.0.1 _;
#        deny 172.25.244.179;
#        deny 172.25.200.115;
#        allow all;
        rewrite ^/$ http://${host}/portal/;
        
        ssl_certificate "/opt/soft/ca/_.panyu.gd.cn/Nginx_Other_Server/_.panyu.gd.cn_chain.crt";
        ssl_certificate_key "/opt/soft/ca/_.panyu.gd.cn/_.panyu.gd.cn.key";
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_protocols TLSv1.2 TLSv1.3;
                
        set $method $request_method;
        if ($http_X_HTTP_Method_Override ~* 'DELETE') {
                set $method DELETE;
        }
        proxy_method $method;
    

        #location ~ / {
        #    if ( $query_string ~* ^\/pcidss\/report.* ){
        #        return 400;
        #       }
        #}

        #if ($request_method !~* GET|POST) {
        #    return 403;
         #}

        location /kaAV6VwL8o.txt {
            alias /usr/local/nginx/html/kaAV6VwL8o.txt;
        }
        
        #if ($content_length = 0) {
        #    return 403;
        #}

        location /gzznGIS {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/gzznGIS;
        }

        location /aPicture {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/aPicture;
        }
        location /portal/system/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/system/;
        }
        location =/pyresbLogin/user/ {
            if ($request_method !~ ^(GET)$)
            {
                return 403;
            }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }


        location /wyn/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/;
        }
        location /Account/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/Account/;
        }
        location /LicenseRegister {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/LicenseRegister;
        }
        location /api/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/api/;
        }
        location /dashboard {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/dashboard;
        }
        
        #location /mobile {
        #    alias /usr/local/nginx/html/mobile;
        #    index index.html index.htm;
        #}

        location /mobile {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8860/;
        }
        
        # mobile
        
        location /mobile/gzznGIS {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/gzznGIS/;
        }
        location /mobile/aPicture {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/aPicture/;
        }
        location /mobile/portal/system/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/system/;
        }

        location /mobile/pyresbLogin {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/pyresbLogin/;
        }

        location /mobile/login {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/pyresbLogin/;
        }
                
        location /mobile/report {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/report;
        }
         location /mobile/display {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/;
        }
                
        location /mobile/portal {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/portal/;
        }
                
        location /mobile/system {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/system/;
        }
        
        location /mobile/doc {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/doc/;
        }

        location /mobile/wyn/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/;
             }
        location /mobile/Account/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/Account/;
        }
        location /mobile/LicenseRegister {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/LicenseRegister/;
        }
        location /mobile/api/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:51980/api/;
        }
        location /mobile/dashboard {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081/display/dashboard/;
        }

        location /dmp-client {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_pass http://172.25.101.113:8080/dmp-client;
        }
        location / {

            if ( $request_uri !~* ^/(Model|display|report|portal|pyresbLogin|system|doc|wyn|system|gzznGIS|dashboard|aPicture|mobile|ibls-s
erver) ){
                return 403;
               }

            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://172.25.101.39:8081;
        }

#        location /nacos {
#            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#            proxy_set_header X-Real-IP $remote_addr;
#            proxy_set_header Host $host:$server_port;
#            proxy_pass http://172.25.101.113:8848/nacos;
#        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }
        
#    server {
#        listen      51980;
#        server_name  wyn;
#        allow all;
#        deny 172.25.244.179;
#        deny 172.25.200.115;

#        location /wyn {
#            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#            proxy_set_header X-Real-IP $remote_addr;
#            proxy_set_header Host $host:$server_port;
#            proxy_pass http://172.25.1.46:51980;
#        }


#       error_page   500 502 503 504  /50x.html;
#        location = /50x.html {
#            root   html;
#        }
#    }

}

#stream {

#    log_format basic '$remote_addr [$time_local] '
#                     '$protocol $status $bytes_sent $bytes_received '
#                     '$session_time';
#    access_log logs/stream-access.log basic buffer=32k;

#    server {
#        allow all;
#        deny 172.25.244.179;
#        deny 172.25.200.115;
#        listen 51980 ;
#        proxy_pass 172.25.1.46:51980;
#      }
#}
    
        
```



prod:
```nginx.conf

worker_processes  2;
error_log  /var/log/nginx/error.log  error;

events { worker_connections 1024; }

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;

    sendfile off;

    server_names_hash_bucket_size 128;
    client_max_body_size 100m;
    client_body_timeout   10;
    client_header_timeout 10;
    keepalive_timeout 65;
    send_timeout 10;
    keepalive_requests 10;

    # === 新增：网关 upstream，指向 swarm 服务名（内网 8080） ===
    upstream gw {
        server pyresb_pyresb-gateway:8080;
    }

    server {
        listen 80;
        server_name pyqys.panyu.gd.cn localhost 127.0.0.1 _;

        # 80 全量跳转到 https
        rewrite ^(.*)$ https://$host$1 permanent;

        set $method $request_method;
        if ($http_X_HTTP_Method_Override ~* 'DELETE') { set $method DELETE; }
        proxy_method $method;

        location /kaAV6VwL8o.txt { alias /usr/share/nginx/html/kaAV6VwL8o.txt; }

        # === 以下把 8081（宿主映射到后端 8080）全部改为网关 upstream ===
        location /gzznGIS         { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/gzznGIS; }
        location /aPicture        { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/aPicture; }
        location /portal/system/  { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; }

        location =/pyresbLogin/config/      { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
        location =/pyresbLogin/user/unlock  { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
        location =/pyresbLogin/user/        { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
        location =/pyresbLogin/user/find/   { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }

        location /pyresbLogin/css { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
        location /pyresbLogin/img { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
        location /pyresbLogin/js  { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }

        location =/pyresbLogin/pyresbLogin/         { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
        location =/pyresbLogin/pyresbLogin/config/  { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }

        location /portal/assets { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
        location /portal/css    { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
        location /portal/fonts  { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
        location /portal/img    { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
        location /portal/js     { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }

        location =/report/         { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
        location /report           { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
        location =/report/captcha/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }

        # 仍在物理网/其它端口的目标保持不变
        location /wyn/            { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; }
        location /Account/        { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; }
        location /LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister; }
        location /api/            { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; }
        location /dashboard       { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/dashboard; }

        location /mobile { alias /usr/share/nginx/html/mobile; index index.html index.htm; }
        location /mobile/gzznGIS     { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/gzznGIS/; }
        location /mobile/aPicture    { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/aPicture/; }
        location /mobile/portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; }
        location /mobile/pyresbLogin { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; rewrite ^/mobile/(.*) /$1 break; proxy_pass http://gw/pyresbLogin/; }
        location /mobile/report      { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/report; }
        location /mobile/display     { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/; }
        location /mobile/portal      { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/portal/; }
        location /mobile/system      { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; }
        location /mobile/doc         { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/doc/; }

        location /mobile/wyn/        { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; }
        location /mobile/Account/    { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; }
        location /mobile/LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister/; }
        location /mobile/api/        { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; }
        location /mobile/dashboard   { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/dashboard/; }

        location /dmp-client { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_pass http://172.25.101.113:8080/dmp-client; }

        location / {
            if ( $request_uri !~* ^/(Model|display|report|portal|pyresbLogin|system|doc|wyn|system|gzznGIS|dashboard|aPicture|mobile|ibls-server) ){ return 403; }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://gw;
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html { root /usr/share/nginx/html; }
    }

    server {
        listen 443 ssl;
        server_name localhost pyqys.panyu.gd.cn 172.25.101.39 127.0.0.1 _;

        rewrite ^/$ http://${host}/portal/;

        ssl_certificate     /etc/nginx/ssl/_.panyu.gd.cn_chain.crt;
        ssl_certificate_key /etc/nginx/ssl/_.panyu.gd.cn.key;
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout 10m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_protocols TLSv1.2 TLSv1.3;

        set $method $request_method;
        if ($http_X_HTTP_Method_Override ~* 'DELETE') { set $method DELETE; }
        proxy_method $method;

        location /kaAV6VwL8o.txt { alias /usr/share/nginx/html/kaAV6VwL8o.txt; }

        # 443 下同样改到 upstream gw
        location /gzznGIS        { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/gzznGIS; }
        location /aPicture       { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/aPicture; }
        location /portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; }

        location =/pyresbLogin/user/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }

        # 仍走物理网段的保留
        location /wyn/            { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; }
        location /Account/        { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; }
        location /LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister; }
        location /api/            { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; }
        location /dashboard       { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/dashboard; }

        location /mobile          { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8860/; }

        # 其余 mobile* 同上（gw 或物理网段，已在 80 里示范）
        location /mobile/gzznGIS     { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/gzznGIS/; }
        location /mobile/aPicture    { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/aPicture/; }
        location /mobile/portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; }
        location /mobile/pyresbLogin { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/pyresbLogin/; }
        location /mobile/login       { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/pyresbLogin/; }
        location /mobile/report      { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/report; }
        location /mobile/display     { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/; }
        location /mobile/portal      { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/portal/; }
        location /mobile/system      { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; }
        location /mobile/doc         { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/doc/; }
        location /mobile/wyn/        { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; }
        location /mobile/Account/    { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; }
        location /mobile/LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister/; }
        location /mobile/api/        { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; }
        location /mobile/dashboard   { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/dashboard/; }

        location /dmp-client { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_pass http://172.25.101.113:8080/dmp-client; }

        location / {
            if ( $request_uri !~* ^/(Model|display|report|portal|pyresbLogin|system|doc|wyn|system|gzznGIS|dashboard|aPicture|mobile|ibls-server) ){ return 403; }
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host:$server_port;
            proxy_pass http://gw;
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html { root /usr/share/nginx/html; }
    }
}


```


test:
```bash
docker run --rm -v "$PWD/nginx.conf:/etc/nginx/nginx.conf:ro" nginx -t
```


```stack.yml
version: "3.9"

configs:
  nginx_conf:
    file: ./nginx.conf
  kaAV6VwL8o:
    file: ./kaAV6VwL8o.txt

secrets:
  wildcard_panyu_chain_crt:
    file: /opt/soft/ca/_.panyu.gd.cn/Nginx_Other_Server/_.panyu.gd.cn_chain.crt
  wildcard_panyu_key:
    file: /opt/soft/ca/_.panyu.gd.cn/_.panyu.gd.cn.key

services:
  nginx:
    image: nginx
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.hostname == worker1
    environment:
      - TZ=Asia/Shanghai
    volumes:
      - ./logs:/var/log/nginx
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: ingress
      - target: 443
        published: 443
        protocol: tcp
        mode: ingress
    configs:
      - source: nginx_conf
        target: /etc/nginx/nginx.conf
        mode: 0444
      - source: kaAV6VwL8o
        target: /usr/share/nginx/html/kaAV6VwL8o.txt
        mode: 0444
    secrets:
      - source: wildcard_panyu_chain_crt
        target: /etc/nginx/ssl/_.panyu.gd.cn_chain.crt
        mode: 0400
      - source: wildcard_panyu_key
        target: /etc/nginx/ssl/_.panyu.gd.cn.key
        mode: 0400
    healthcheck:
      test: ["CMD", "nginx", "-t"]
      interval: 30s
      timeout: 5s
      retries: 3
    networks:
      - pyresb  # 关键：加入现有 overlay

networks:
  pyresb:
    external: true
    name: pyresb_pyresb

```