# 172.25.101.113: ## nacos /data/nacos ``` bash deploy.sh ``` ## redis ``` systemctl start redis ``` ## harbor ``` cd /data/harbor docker-compose start ``` ## minio ``` docker start minio ``` ```new password for admin uiPah2iok,e;giew ``` ## tomcat ``` cd /usr/local/apache-tomcat-8.5.69 ./bin/startup.sh ``` # 172.25.101.39 ## wyn ``` docker start wyn ``` ## pyresb ``` cd /opt/apps bash deploy.sh ``` ## nginx ``` cd /usr/local/nginx ./sbin/nginx ``` # mysql 172.25.1.45 ``` root/Gzzn!37622 py_credit/Credit@gzzn2021 pyresbs/pyresb123@Admin ``` ```old root Gzzn!37622 ``` ``` ALTER USER 'pyresbs'@'%' IDENTIFIED BY 'pyresbs2024@Admin'; ``` ``` pyresbs2024@Admin ``` ``` ALTER USER 'root'@'%' IDENTIFIED BY 'Gzzn37622@2024'; ``` ``` SET PASSWORD FOR 'root'@'%' = 'Gzzn37622@2024'; SET PASSWORD FOR 'root'@'localhost' = 'Gzzn37622@2024'; ``` ``` FLUSH PRIVILEGES; ``` new root: ``` Gzzn37622@2024 ``` ``` ALTER USER 'py_credit'@'%' IDENTIFIED BY 'Credit@gzzn2024'; ``` ``` Credit@gzzn2024 ``` Harbor 公开镜像仓库未授权访问 CVE-2022-46463 限制公开访问，进入“项目设置”→“配置管理”→“项目仓库”中的“公开”，取消勾选。 证书： ```bash #!/bin/bash # 配置变量 CERT_PATH="/etc/letsencrypt" DATA_PATH="/var/lib/letsencrypt" LOG_PATH="/var/log/certbot" WEBROOT_PATH="/var/www/certbot" # 颜色输出函数 print_info() { echo -e "\033[0;34m[INFO] $1\033[0m" } print_success() { echo -e "\033[0;32m[SUCCESS] $1\033[0m" } print_error() { echo -e "\033[0;31m[ERROR] $1\033[0m" } # 创建必要的目录 create_directories() { local dirs=( "$CERT_PATH" "$DATA_PATH" "$LOG_PATH" "$WEBROOT_PATH" ) for dir in "${dirs[@]}"; do if [ ! -d "$dir" ]; then print_info "Creating directory: $dir" mkdir -p "$dir" if [ $? -eq 0 ]; then print_success "Created $dir successfully" else print_error "Failed to create $dir" return 1 fi else print_info "Directory already exists: $dir" fi done } # 设置权限 set_permissions() { print_info "Setting directory permissions..." # 设置基本目录权限 chmod 755 "$CERT_PATH" "$DATA_PATH" "$LOG_PATH" "$WEBROOT_PATH" # 如果证书目录已存在，设置证书文件权限 if [ -d "$CERT_PATH/live" ]; then find "$CERT_PATH/live" -type d -exec chmod 755 {} \; find "$CERT_PATH/live" -type f -exec chmod 644 {} \; find "$CERT_PATH/live" -name "privkey.pem" -exec chmod 600 {} \; fi print_success "Permissions set successfully" } # 创建日志文件 create_logfile() { local logfile="$LOG_PATH/certbot.log" if [ ! -f "$logfile" ]; then print_info "Creating log file: $logfile" touch "$logfile" chmod 644 "$logfile" print_success "Created log file successfully" else print_info "Log file already exists: $logfile" fi } # 主函数 main() { print_info "Starting initialization..." # 检查是否为 root 用户 if [ "$EUID" -ne 0 ]; then print_error "Please run as root" exit 1 fi # 执行初始化步骤 create_directories || exit 1 set_permissions || exit 1 create_logfile || exit 1 print_success "Initialization completed successfully" } # 执行主函数 main ``` ```bash #!/bin/bash # 域名配置 DOMAIN="pyqys.panyu.gd.cn" EMAIL="zhiqiang@windy.me" # 路径配置 CERT_PATH="/etc/letsencrypt" DATA_PATH="/var/lib/letsencrypt" LOG_PATH="/var/log/certbot" WEBROOT_PATH="/var/www/certbot" # 颜色输出函数 print_info() { echo -e "\033[0;34m[INFO] $1\033[0m" } print_success() { echo -e "\033[0;32m[SUCCESS] $1\033[0m" } print_error() { echo -e "\033[0;31m[ERROR] $1\033[0m" } ``` ```bash #!/bin/bash # 配置 DOMAIN="httpyqys.panyu.gd.cn" EMAIL="zhiqiang@windy.me" CERT_PATH="/etc/letsencrypt" DATA_PATH="/var/lib/letsencrypt" # 申请证书 docker run -it --rm \ -v "${CERT_PATH}:${CERT_PATH}" \ -v "${DATA_PATH}:${DATA_PATH}" \ certbot/certbot certonly \ --manual \ --preferred-challenges dns \ --email "$EMAIL" \ -d "$DOMAIN" \ --agree-tos \ --no-eff-email ``` renew ```bash DOMAIN="httpyqys.panyu.gd.cn" EMAIL="zhiqiang@windy.me" CERT_PATH="/etc/letsencrypt" DATA_PATH="/var/lib/letsencrypt" # 申请证书 docker run -it --rm \ -v "${CERT_PATH}:${CERT_PATH}" \ -v "${DATA_PATH}:${DATA_PATH}" \ certbot/certbot renew \ --manual \ --preferred-challenges dns \ --email "$EMAIL" \ -d "$DOMAIN" \ --agree-tos \ --no-eff-email ``` original: ```nginx.conf worker_processes 2; error_log /var/log/nginx/error.log error; events { worker_connections 1024; } #stream { # server { # listen 443; # proxy_pass mysql_server; # } # upstream mysql_server{ # server 172.16.0.2:3306; # # } #} http { include mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log logs/access.log main; sendfile off; server_names_hash_bucket_size 128; client_max_body_size 100m; #ÖҪÊÕ¸öýÆËϴ«Î¼þ´ó¡ client_body_timeout 10; client_header_timeout 10; keepalive_timeout 65; send_timeout 10; keepalive_requests 10; #server { ## listen 80; # server_name 172.25.101.39 ; # rewrite ^/$ http://${server_name}/portal/ ; #} server { listen 80; server_name pyqys.panyu.gd.cn localhost 127.0.0.1 _; # deny 172.25.244.179; # deny 172.25.200.115; # allow all; #rewrite ^/$ https://${host}/portal/; rewrite ^(.*)$ https://$host$1 permanent; set $method $request_method; if ($http_X_HTTP_Method_Override ~* 'DELETE') { set $method DELETE; } proxy_method $method; # if ( $remote_addr ~* "172\.25\.200\.115"){ # return 302 "https://www.baidu.com/"; # } #location ~ / { # if ( $query_string ~* ^\/pcidss\/report.* ){ # return 400; # } #} # if ($content_length = 0) { # return 403; # } location /kaAV6VwL8o.txt { alias /usr/local/nginx/html/kaAV6VwL8o.txt; } location /gzznGIS { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/gzznGIS; } location /aPicture { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/aPicture; } location /portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/system/; } location =/pyresbLogin/config/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location =/pyresbLogin/user/unlock { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location =/pyresbLogin/user/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location =/pyresbLogin/user/find/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location /pyresbLogin/css { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location /pyresbLogin/img { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location /pyresbLogin/js { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location =/pyresbLogin/pyresbLogin/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location =/pyresbLogin/pyresbLogin/config/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location /portal/assets { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location /portal/css { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location /portal/fonts { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location /portal/img { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location /portal/js { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location =/report/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location /report { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location =/report/captcha/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location /wyn/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; } location /Account/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; } location /LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister; } location /api/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; } location /dashboard { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/dashboard; } location /mobile { alias /usr/local/nginx/html/mobile; index index.html index.htm; } # mobile location /mobile/gzznGIS { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/gzznGIS/; } location /mobile/aPicture { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/aPicture/; } location /mobile/portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/system/; } location /mobile/pyresbLogin { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; rewrite ^/mobile/(.*) /$1 break; proxy_pass http://172.25.101.39:8081/pyresbLogin/; } location /mobile/report { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/report; } location /mobile/display { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/; } location /mobile/portal { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/portal/; } location /mobile/system { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/system/; } location /mobile/doc { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/doc/; } location /mobile/wyn/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; } location /mobile/Account/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; } location /mobile/LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister/; } location /mobile/api/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; } location /mobile/dashboard { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/dashboard/; } location /dmp-client { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.113:8080/dmp-client; } location / { if ( $request_uri !~* ^/(Model|display|report|portal|pyresbLogin|system|doc|wyn|system|gzznGIS|dashboard|aPicture|mobile|ibls-s erver) ){ return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } # location /nacos { # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # proxy_set_header X-Real-IP $remote_addr; # proxy_set_header Host $host:$server_port; # proxy_pass http://172.25.101.113:8848/nacos; # } error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } server { listen 443 ssl; #listen [::]:443 ssl; #ssl on; server_name localhost pyqys.panyu.gd.cn 172.25.101.39 127.0.0.1 _; # deny 172.25.244.179; # deny 172.25.200.115; # allow all; rewrite ^/$ http://${host}/portal/; ssl_certificate "/opt/soft/ca/_.panyu.gd.cn/Nginx_Other_Server/_.panyu.gd.cn_chain.crt"; ssl_certificate_key "/opt/soft/ca/_.panyu.gd.cn/_.panyu.gd.cn.key"; ssl_session_cache shared:SSL:1m; ssl_session_timeout 10m; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; ssl_protocols TLSv1.2 TLSv1.3; set $method $request_method; if ($http_X_HTTP_Method_Override ~* 'DELETE') { set $method DELETE; } proxy_method $method; #location ~ / { # if ( $query_string ~* ^\/pcidss\/report.* ){ # return 400; # } #} #if ($request_method !~* GET|POST) { # return 403; #} location /kaAV6VwL8o.txt { alias /usr/local/nginx/html/kaAV6VwL8o.txt; } #if ($content_length = 0) { # return 403; #} location /gzznGIS { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/gzznGIS; } location /aPicture { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/aPicture; } location /portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/system/; } location =/pyresbLogin/user/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } location /wyn/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; } location /Account/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; } location /LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister; } location /api/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; } location /dashboard { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/dashboard; } #location /mobile { # alias /usr/local/nginx/html/mobile; # index index.html index.htm; #} location /mobile { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8860/; } # mobile location /mobile/gzznGIS { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/gzznGIS/; } location /mobile/aPicture { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/aPicture/; } location /mobile/portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/system/; } location /mobile/pyresbLogin { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/pyresbLogin/; } location /mobile/login { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/pyresbLogin/; } location /mobile/report { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/report; } location /mobile/display { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/; } location /mobile/portal { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/portal/; } location /mobile/system { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/system/; } location /mobile/doc { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/doc/; } location /mobile/wyn/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; } location /mobile/Account/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; } location /mobile/LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister/; } location /mobile/api/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; } location /mobile/dashboard { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081/display/dashboard/; } location /dmp-client { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_pass http://172.25.101.113:8080/dmp-client; } location / { if ( $request_uri !~* ^/(Model|display|report|portal|pyresbLogin|system|doc|wyn|system|gzznGIS|dashboard|aPicture|mobile|ibls-s erver) ){ return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8081; } # location /nacos { # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # proxy_set_header X-Real-IP $remote_addr; # proxy_set_header Host $host:$server_port; # proxy_pass http://172.25.101.113:8848/nacos; # } error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } # server { # listen 51980; # server_name wyn; # allow all; # deny 172.25.244.179; # deny 172.25.200.115; # location /wyn { # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # proxy_set_header X-Real-IP $remote_addr; # proxy_set_header Host $host:$server_port; # proxy_pass http://172.25.1.46:51980; # } # error_page 500 502 503 504 /50x.html; # location = /50x.html { # root html; # } # } } #stream { # log_format basic '$remote_addr [$time_local] ' # '$protocol $status $bytes_sent $bytes_received ' # '$session_time'; # access_log logs/stream-access.log basic buffer=32k; # server { # allow all; # deny 172.25.244.179; # deny 172.25.200.115; # listen 51980 ; # proxy_pass 172.25.1.46:51980; # } #} ``` prod: ```nginx.conf worker_processes 2; error_log /var/log/nginx/error.log error; events { worker_connections 1024; } http { include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; sendfile off; server_names_hash_bucket_size 128; client_max_body_size 100m; client_body_timeout 10; client_header_timeout 10; keepalive_timeout 65; send_timeout 10; keepalive_requests 10; # === 新增：网关 upstream，指向 swarm 服务名（内网 8080） === upstream gw { server pyresb_pyresb-gateway:8080; } server { listen 80; server_name pyqys.panyu.gd.cn localhost 127.0.0.1 _; # 80 全量跳转到 https rewrite ^(.*)$ https://$host$1 permanent; set $method $request_method; if ($http_X_HTTP_Method_Override ~* 'DELETE') { set $method DELETE; } proxy_method $method; location /kaAV6VwL8o.txt { alias /usr/share/nginx/html/kaAV6VwL8o.txt; } # === 以下把 8081（宿主映射到后端 8080）全部改为网关 upstream === location /gzznGIS { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/gzznGIS; } location /aPicture { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/aPicture; } location /portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; } location =/pyresbLogin/config/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location =/pyresbLogin/user/unlock { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location =/pyresbLogin/user/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location =/pyresbLogin/user/find/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location /pyresbLogin/css { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location /pyresbLogin/img { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location /pyresbLogin/js { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location =/pyresbLogin/pyresbLogin/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location =/pyresbLogin/pyresbLogin/config/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location /portal/assets { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location /portal/css { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location /portal/fonts { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location /portal/img { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location /portal/js { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location =/report/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location /report { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } location =/report/captcha/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } # 仍在物理网/其它端口的目标保持不变 location /wyn/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; } location /Account/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; } location /LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister; } location /api/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; } location /dashboard { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/dashboard; } location /mobile { alias /usr/share/nginx/html/mobile; index index.html index.htm; } location /mobile/gzznGIS { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/gzznGIS/; } location /mobile/aPicture { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/aPicture/; } location /mobile/portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; } location /mobile/pyresbLogin { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; rewrite ^/mobile/(.*) /$1 break; proxy_pass http://gw/pyresbLogin/; } location /mobile/report { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/report; } location /mobile/display { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/; } location /mobile/portal { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/portal/; } location /mobile/system { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; } location /mobile/doc { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/doc/; } location /mobile/wyn/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; } location /mobile/Account/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; } location /mobile/LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister/; } location /mobile/api/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; } location /mobile/dashboard { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/dashboard/; } location /dmp-client { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_pass http://172.25.101.113:8080/dmp-client; } location / { if ( $request_uri !~* ^/(Model|display|report|portal|pyresbLogin|system|doc|wyn|system|gzznGIS|dashboard|aPicture|mobile|ibls-server) ){ return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } } server { listen 443 ssl; server_name localhost pyqys.panyu.gd.cn 172.25.101.39 127.0.0.1 _; rewrite ^/$ http://${host}/portal/; ssl_certificate /etc/nginx/ssl/_.panyu.gd.cn_chain.crt; ssl_certificate_key /etc/nginx/ssl/_.panyu.gd.cn.key; ssl_session_cache shared:SSL:1m; ssl_session_timeout 10m; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; ssl_protocols TLSv1.2 TLSv1.3; set $method $request_method; if ($http_X_HTTP_Method_Override ~* 'DELETE') { set $method DELETE; } proxy_method $method; location /kaAV6VwL8o.txt { alias /usr/share/nginx/html/kaAV6VwL8o.txt; } # 443 下同样改到 upstream gw location /gzznGIS { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/gzznGIS; } location /aPicture { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/aPicture; } location /portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; } location =/pyresbLogin/user/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } # 仍走物理网段的保留 location /wyn/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; } location /Account/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; } location /LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister; } location /api/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; } location /dashboard { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/dashboard; } location /mobile { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8860/; } # 其余 mobile* 同上（gw 或物理网段，已在 80 里示范） location /mobile/gzznGIS { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/gzznGIS/; } location /mobile/aPicture { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/aPicture/; } location /mobile/portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; } location /mobile/pyresbLogin { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/pyresbLogin/; } location /mobile/login { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/pyresbLogin/; } location /mobile/report { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/report; } location /mobile/display { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/; } location /mobile/portal { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/portal/; } location /mobile/system { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; } location /mobile/doc { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/doc/; } location /mobile/wyn/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; } location /mobile/Account/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; } location /mobile/LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister/; } location /mobile/api/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; } location /mobile/dashboard { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/dashboard/; } location /dmp-client { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_pass http://172.25.101.113:8080/dmp-client; } location / { if ( $request_uri !~* ^/(Model|display|report|portal|pyresbLogin|system|doc|wyn|system|gzznGIS|dashboard|aPicture|mobile|ibls-server) ){ return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; } error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } } } ``` test: ```bash docker run --rm -v "$PWD/nginx.conf:/etc/nginx/nginx.conf:ro" nginx -t ``` ```stack.yml version: "3.9" configs: nginx_conf: file: ./nginx.conf kaAV6VwL8o: file: ./kaAV6VwL8o.txt secrets: wildcard_panyu_chain_crt: file: /opt/soft/ca/_.panyu.gd.cn/Nginx_Other_Server/_.panyu.gd.cn_chain.crt wildcard_panyu_key: file: /opt/soft/ca/_.panyu.gd.cn/_.panyu.gd.cn.key services: nginx: image: nginx deploy: replicas: 1 restart_policy: condition: on-failure placement: constraints: - node.hostname == worker1 environment: - TZ=Asia/Shanghai volumes: - ./logs:/var/log/nginx ports: - target: 80 published: 80 protocol: tcp mode: ingress - target: 443 published: 443 protocol: tcp mode: ingress configs: - source: nginx_conf target: /etc/nginx/nginx.conf mode: 0444 - source: kaAV6VwL8o target: /usr/share/nginx/html/kaAV6VwL8o.txt mode: 0444 secrets: - source: wildcard_panyu_chain_crt target: /etc/nginx/ssl/_.panyu.gd.cn_chain.crt mode: 0400 - source: wildcard_panyu_key target: /etc/nginx/ssl/_.panyu.gd.cn.key mode: 0400 healthcheck: test: ["CMD", "nginx", "-t"] interval: 30s timeout: 5s retries: 3 networks: - pyresb # 关键：加入现有 overlay networks: pyresb: external: true name: pyresb_pyresb ```