1294 lines
51 KiB
Markdown
1294 lines
51 KiB
Markdown
|
||
# 172.25.101.113:
|
||
## nacos
|
||
/data/nacos
|
||
|
||
```
|
||
bash deploy.sh
|
||
```
|
||
|
||
|
||
## redis
|
||
```
|
||
systemctl start redis
|
||
```
|
||
|
||
## harbor
|
||
|
||
```
|
||
cd /data/harbor
|
||
docker-compose start
|
||
```
|
||
|
||
|
||
## minio
|
||
|
||
```
|
||
docker start minio
|
||
```
|
||
|
||
|
||
```new password for admin
|
||
uiPah2iok,e;giew
|
||
```
|
||
|
||
## tomcat
|
||
|
||
```
|
||
cd /usr/local/apache-tomcat-8.5.69
|
||
./bin/startup.sh
|
||
```
|
||
|
||
|
||
|
||
# 172.25.101.39
|
||
## wyn
|
||
```
|
||
docker start wyn
|
||
```
|
||
|
||
## pyresb
|
||
```
|
||
cd /opt/apps
|
||
bash deploy.sh
|
||
```
|
||
|
||
## nginx
|
||
```
|
||
cd /usr/local/nginx
|
||
./sbin/nginx
|
||
```
|
||
|
||
|
||
|
||
# mysql
|
||
172.25.1.45
|
||
|
||
```
|
||
root/Gzzn!37622
|
||
py_credit/Credit@gzzn2021
|
||
pyresbs/pyresb123@Admin
|
||
```
|
||
|
||
```old root
|
||
Gzzn!37622
|
||
```
|
||
|
||
```
|
||
ALTER USER 'pyresbs'@'%' IDENTIFIED BY 'pyresbs2024@Admin';
|
||
```
|
||
|
||
```
|
||
pyresbs2024@Admin
|
||
```
|
||
|
||
```
|
||
ALTER USER 'root'@'%' IDENTIFIED BY 'Gzzn37622@2024';
|
||
```
|
||
|
||
```
|
||
SET PASSWORD FOR 'root'@'%' = 'Gzzn37622@2024';
|
||
SET PASSWORD FOR 'root'@'localhost' = 'Gzzn37622@2024';
|
||
```
|
||
|
||
```
|
||
FLUSH PRIVILEGES;
|
||
```
|
||
|
||
new root:
|
||
```
|
||
Gzzn37622@2024
|
||
```
|
||
|
||
|
||
```
|
||
ALTER USER 'py_credit'@'%' IDENTIFIED BY 'Credit@gzzn2024';
|
||
```
|
||
|
||
|
||
```
|
||
Credit@gzzn2024
|
||
```
|
||
|
||
|
||
|
||
|
||
Harbor 公开镜像仓库未授权访问 CVE-2022-46463
|
||
|
||
限制公开访问，进入“项目设置”→“配置管理”→“项目仓库”中的“公开”，取消勾选。
|
||
|
||
|
||
|
||
|
||
证书：
|
||
|
||
```bash
|
||
#!/bin/bash
|
||
|
||
# 配置变量
|
||
CERT_PATH="/etc/letsencrypt"
|
||
DATA_PATH="/var/lib/letsencrypt"
|
||
LOG_PATH="/var/log/certbot"
|
||
WEBROOT_PATH="/var/www/certbot"
|
||
|
||
# 颜色输出函数
|
||
print_info() {
|
||
echo -e "\033[0;34m[INFO] $1\033[0m"
|
||
}
|
||
|
||
print_success() {
|
||
echo -e "\033[0;32m[SUCCESS] $1\033[0m"
|
||
}
|
||
|
||
print_error() {
|
||
echo -e "\033[0;31m[ERROR] $1\033[0m"
|
||
}
|
||
|
||
# 创建必要的目录
|
||
create_directories() {
|
||
local dirs=(
|
||
"$CERT_PATH"
|
||
"$DATA_PATH"
|
||
"$LOG_PATH"
|
||
"$WEBROOT_PATH"
|
||
)
|
||
|
||
for dir in "${dirs[@]}"; do
|
||
if [ ! -d "$dir" ]; then
|
||
print_info "Creating directory: $dir"
|
||
mkdir -p "$dir"
|
||
if [ $? -eq 0 ]; then
|
||
print_success "Created $dir successfully"
|
||
else
|
||
print_error "Failed to create $dir"
|
||
return 1
|
||
fi
|
||
else
|
||
print_info "Directory already exists: $dir"
|
||
fi
|
||
done
|
||
}
|
||
|
||
# 设置权限
|
||
set_permissions() {
|
||
print_info "Setting directory permissions..."
|
||
|
||
# 设置基本目录权限
|
||
chmod 755 "$CERT_PATH" "$DATA_PATH" "$LOG_PATH" "$WEBROOT_PATH"
|
||
|
||
# 如果证书目录已存在，设置证书文件权限
|
||
if [ -d "$CERT_PATH/live" ]; then
|
||
find "$CERT_PATH/live" -type d -exec chmod 755 {} \;
|
||
find "$CERT_PATH/live" -type f -exec chmod 644 {} \;
|
||
find "$CERT_PATH/live" -name "privkey.pem" -exec chmod 600 {} \;
|
||
fi
|
||
|
||
print_success "Permissions set successfully"
|
||
}
|
||
|
||
# 创建日志文件
|
||
create_logfile() {
|
||
local logfile="$LOG_PATH/certbot.log"
|
||
if [ ! -f "$logfile" ]; then
|
||
print_info "Creating log file: $logfile"
|
||
touch "$logfile"
|
||
chmod 644 "$logfile"
|
||
print_success "Created log file successfully"
|
||
else
|
||
print_info "Log file already exists: $logfile"
|
||
fi
|
||
}
|
||
|
||
# 主函数
|
||
main() {
|
||
print_info "Starting initialization..."
|
||
|
||
# 检查是否为 root 用户
|
||
if [ "$EUID" -ne 0 ]; then
|
||
print_error "Please run as root"
|
||
exit 1
|
||
fi
|
||
|
||
# 执行初始化步骤
|
||
create_directories || exit 1
|
||
set_permissions || exit 1
|
||
create_logfile || exit 1
|
||
|
||
print_success "Initialization completed successfully"
|
||
}
|
||
|
||
# 执行主函数
|
||
main
|
||
|
||
|
||
```
|
||
|
||
|
||
|
||
```bash
|
||
#!/bin/bash
|
||
|
||
# 域名配置
|
||
DOMAIN="pyqys.panyu.gd.cn"
|
||
EMAIL="zhiqiang@windy.me"
|
||
|
||
# 路径配置
|
||
CERT_PATH="/etc/letsencrypt"
|
||
DATA_PATH="/var/lib/letsencrypt"
|
||
LOG_PATH="/var/log/certbot"
|
||
WEBROOT_PATH="/var/www/certbot"
|
||
|
||
# 颜色输出函数
|
||
print_info() {
|
||
echo -e "\033[0;34m[INFO] $1\033[0m"
|
||
}
|
||
|
||
print_success() {
|
||
echo -e "\033[0;32m[SUCCESS] $1\033[0m"
|
||
}
|
||
|
||
print_error() {
|
||
echo -e "\033[0;31m[ERROR] $1\033[0m"
|
||
}
|
||
|
||
```
|
||
|
||
|
||
```bash
|
||
#!/bin/bash
|
||
|
||
# 配置
|
||
DOMAIN="httpyqys.panyu.gd.cn"
|
||
EMAIL="zhiqiang@windy.me"
|
||
CERT_PATH="/etc/letsencrypt"
|
||
DATA_PATH="/var/lib/letsencrypt"
|
||
|
||
|
||
# 申请证书
|
||
docker run -it --rm \
|
||
-v "${CERT_PATH}:${CERT_PATH}" \
|
||
-v "${DATA_PATH}:${DATA_PATH}" \
|
||
certbot/certbot certonly \
|
||
--manual \
|
||
--preferred-challenges dns \
|
||
--email "$EMAIL" \
|
||
-d "$DOMAIN" \
|
||
--agree-tos \
|
||
--no-eff-email
|
||
|
||
|
||
```
|
||
|
||
renew
|
||
|
||
```bash
|
||
|
||
DOMAIN="httpyqys.panyu.gd.cn"
|
||
EMAIL="zhiqiang@windy.me"
|
||
CERT_PATH="/etc/letsencrypt"
|
||
DATA_PATH="/var/lib/letsencrypt"
|
||
|
||
|
||
# 申请证书
|
||
docker run -it --rm \
|
||
-v "${CERT_PATH}:${CERT_PATH}" \
|
||
-v "${DATA_PATH}:${DATA_PATH}" \
|
||
certbot/certbot renew \
|
||
--manual \
|
||
--preferred-challenges dns \
|
||
--email "$EMAIL" \
|
||
-d "$DOMAIN" \
|
||
--agree-tos \
|
||
--no-eff-email
|
||
```
|
||
|
||
|
||
original:
|
||
|
||
```nginx.conf
|
||
worker_processes 2;
|
||
|
||
error_log /var/log/nginx/error.log error;
|
||
|
||
events {
|
||
worker_connections 1024;
|
||
}
|
||
#stream {
|
||
# server {
|
||
# listen 443;
|
||
# proxy_pass mysql_server;
|
||
# }
|
||
# upstream mysql_server{
|
||
# server 172.16.0.2:3306;
|
||
#
|
||
# }
|
||
#}
|
||
|
||
http {
|
||
include mime.types;
|
||
default_type application/octet-stream;
|
||
|
||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||
'$status $body_bytes_sent "$http_referer" '
|
||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||
|
||
access_log logs/access.log main;
|
||
|
||
sendfile off;
|
||
|
||
server_names_hash_bucket_size 128;
|
||
client_max_body_size 100m; #ÖҪÊÕ¸öýÆËϴ«Î¼þ´ó¡
|
||
client_body_timeout 10;
|
||
client_header_timeout 10;
|
||
keepalive_timeout 65;
|
||
send_timeout 10;
|
||
keepalive_requests 10;
|
||
#server {
|
||
## listen 80;
|
||
# server_name 172.25.101.39 ;
|
||
# rewrite ^/$ http://${server_name}/portal/ ;
|
||
#}
|
||
server {
|
||
listen 80;
|
||
server_name pyqys.panyu.gd.cn localhost 127.0.0.1 _;
|
||
# deny 172.25.244.179;
|
||
# deny 172.25.200.115;
|
||
# allow all;
|
||
#rewrite ^/$ https://${host}/portal/;
|
||
rewrite ^(.*)$ https://$host$1 permanent;
|
||
|
||
set $method $request_method;
|
||
if ($http_X_HTTP_Method_Override ~* 'DELETE') {
|
||
set $method DELETE;
|
||
}
|
||
proxy_method $method;
|
||
|
||
# if ( $remote_addr ~* "172\.25\.200\.115"){
|
||
# return 302 "https://www.baidu.com/";
|
||
# }
|
||
|
||
#location ~ / {
|
||
# if ( $query_string ~* ^\/pcidss\/report.* ){
|
||
# return 400;
|
||
# }
|
||
#}
|
||
# if ($content_length = 0) {
|
||
# return 403;
|
||
# }
|
||
|
||
location /kaAV6VwL8o.txt {
|
||
alias /usr/local/nginx/html/kaAV6VwL8o.txt;
|
||
}
|
||
|
||
location /gzznGIS {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/gzznGIS;
|
||
}
|
||
|
||
location /aPicture {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/aPicture;
|
||
}
|
||
location /portal/system/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/system/;
|
||
}
|
||
|
||
location =/pyresbLogin/config/ {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location =/pyresbLogin/user/unlock {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location =/pyresbLogin/user/ {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location =/pyresbLogin/user/find/ {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
|
||
location /pyresbLogin/css {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location /pyresbLogin/img {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location /pyresbLogin/js {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location =/pyresbLogin/pyresbLogin/ {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location =/pyresbLogin/pyresbLogin/config/ {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location /portal/assets {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location /portal/css {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location /portal/fonts {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location /portal/img {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location /portal/js {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location =/report/ {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
location /report {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
location =/report/captcha/ {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
|
||
location /wyn/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/;
|
||
}
|
||
location /Account/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/Account/;
|
||
}
|
||
location /LicenseRegister {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/LicenseRegister;
|
||
}
|
||
location /api/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/api/;
|
||
}
|
||
location /dashboard {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/dashboard;
|
||
}
|
||
|
||
location /mobile {
|
||
alias /usr/local/nginx/html/mobile;
|
||
index index.html index.htm;
|
||
}
|
||
|
||
# mobile
|
||
|
||
location /mobile/gzznGIS {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/gzznGIS/;
|
||
}
|
||
|
||
location /mobile/aPicture {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/aPicture/;
|
||
}
|
||
location /mobile/portal/system/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/system/;
|
||
}
|
||
|
||
location /mobile/pyresbLogin {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
rewrite ^/mobile/(.*) /$1 break;
|
||
proxy_pass http://172.25.101.39:8081/pyresbLogin/;
|
||
}
|
||
|
||
location /mobile/report {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/report;
|
||
}
|
||
|
||
location /mobile/display {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/;
|
||
}
|
||
|
||
location /mobile/portal {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/portal/;
|
||
}
|
||
|
||
location /mobile/system {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/system/;
|
||
}
|
||
|
||
location /mobile/doc {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/doc/;
|
||
}
|
||
|
||
location /mobile/wyn/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/;
|
||
}
|
||
location /mobile/Account/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/Account/;
|
||
}
|
||
location /mobile/LicenseRegister {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/LicenseRegister/;
|
||
}
|
||
location /mobile/api/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/api/;
|
||
}
|
||
location /mobile/dashboard {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/dashboard/;
|
||
}
|
||
|
||
location /dmp-client {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.113:8080/dmp-client;
|
||
}
|
||
|
||
location / {
|
||
|
||
if ( $request_uri !~* ^/(Model|display|report|portal|pyresbLogin|system|doc|wyn|system|gzznGIS|dashboard|aPicture|mobile|ibls-s
|
||
erver) ){
|
||
return 403;
|
||
}
|
||
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
# location /nacos {
|
||
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
# proxy_set_header X-Real-IP $remote_addr;
|
||
# proxy_set_header Host $host:$server_port;
|
||
# proxy_pass http://172.25.101.113:8848/nacos;
|
||
# }
|
||
|
||
|
||
|
||
error_page 500 502 503 504 /50x.html;
|
||
location = /50x.html {
|
||
root html;
|
||
}
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl;
|
||
#listen [::]:443 ssl;
|
||
#ssl on;
|
||
server_name localhost pyqys.panyu.gd.cn 172.25.101.39 127.0.0.1 _;
|
||
# deny 172.25.244.179;
|
||
# deny 172.25.200.115;
|
||
# allow all;
|
||
rewrite ^/$ http://${host}/portal/;
|
||
|
||
ssl_certificate "/opt/soft/ca/_.panyu.gd.cn/Nginx_Other_Server/_.panyu.gd.cn_chain.crt";
|
||
ssl_certificate_key "/opt/soft/ca/_.panyu.gd.cn/_.panyu.gd.cn.key";
|
||
ssl_session_cache shared:SSL:1m;
|
||
ssl_session_timeout 10m;
|
||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||
ssl_prefer_server_ciphers on;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
|
||
set $method $request_method;
|
||
if ($http_X_HTTP_Method_Override ~* 'DELETE') {
|
||
set $method DELETE;
|
||
}
|
||
proxy_method $method;
|
||
|
||
|
||
#location ~ / {
|
||
# if ( $query_string ~* ^\/pcidss\/report.* ){
|
||
# return 400;
|
||
# }
|
||
#}
|
||
|
||
#if ($request_method !~* GET|POST) {
|
||
# return 403;
|
||
#}
|
||
|
||
location /kaAV6VwL8o.txt {
|
||
alias /usr/local/nginx/html/kaAV6VwL8o.txt;
|
||
}
|
||
|
||
#if ($content_length = 0) {
|
||
# return 403;
|
||
#}
|
||
|
||
location /gzznGIS {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/gzznGIS;
|
||
}
|
||
|
||
location /aPicture {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/aPicture;
|
||
}
|
||
location /portal/system/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/system/;
|
||
}
|
||
location =/pyresbLogin/user/ {
|
||
if ($request_method !~ ^(GET)$)
|
||
{
|
||
return 403;
|
||
}
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
|
||
location /wyn/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/;
|
||
}
|
||
location /Account/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/Account/;
|
||
}
|
||
location /LicenseRegister {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/LicenseRegister;
|
||
}
|
||
location /api/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/api/;
|
||
}
|
||
location /dashboard {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/dashboard;
|
||
}
|
||
|
||
#location /mobile {
|
||
# alias /usr/local/nginx/html/mobile;
|
||
# index index.html index.htm;
|
||
#}
|
||
|
||
location /mobile {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8860/;
|
||
}
|
||
|
||
# mobile
|
||
|
||
location /mobile/gzznGIS {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/gzznGIS/;
|
||
}
|
||
location /mobile/aPicture {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/aPicture/;
|
||
}
|
||
location /mobile/portal/system/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/system/;
|
||
}
|
||
|
||
location /mobile/pyresbLogin {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/pyresbLogin/;
|
||
}
|
||
|
||
location /mobile/login {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/pyresbLogin/;
|
||
}
|
||
|
||
location /mobile/report {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/report;
|
||
}
|
||
location /mobile/display {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/;
|
||
}
|
||
|
||
location /mobile/portal {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/portal/;
|
||
}
|
||
|
||
location /mobile/system {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/system/;
|
||
}
|
||
|
||
location /mobile/doc {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/doc/;
|
||
}
|
||
|
||
location /mobile/wyn/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/;
|
||
}
|
||
location /mobile/Account/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/Account/;
|
||
}
|
||
location /mobile/LicenseRegister {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/LicenseRegister/;
|
||
}
|
||
location /mobile/api/ {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:51980/api/;
|
||
}
|
||
location /mobile/dashboard {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081/display/dashboard/;
|
||
}
|
||
|
||
location /dmp-client {
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host;
|
||
proxy_pass http://172.25.101.113:8080/dmp-client;
|
||
}
|
||
location / {
|
||
|
||
if ( $request_uri !~* ^/(Model|display|report|portal|pyresbLogin|system|doc|wyn|system|gzznGIS|dashboard|aPicture|mobile|ibls-s
|
||
erver) ){
|
||
return 403;
|
||
}
|
||
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://172.25.101.39:8081;
|
||
}
|
||
|
||
# location /nacos {
|
||
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
# proxy_set_header X-Real-IP $remote_addr;
|
||
# proxy_set_header Host $host:$server_port;
|
||
# proxy_pass http://172.25.101.113:8848/nacos;
|
||
# }
|
||
|
||
error_page 500 502 503 504 /50x.html;
|
||
location = /50x.html {
|
||
root html;
|
||
}
|
||
}
|
||
|
||
# server {
|
||
# listen 51980;
|
||
# server_name wyn;
|
||
# allow all;
|
||
# deny 172.25.244.179;
|
||
# deny 172.25.200.115;
|
||
|
||
# location /wyn {
|
||
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
# proxy_set_header X-Real-IP $remote_addr;
|
||
# proxy_set_header Host $host:$server_port;
|
||
# proxy_pass http://172.25.1.46:51980;
|
||
# }
|
||
|
||
|
||
# error_page 500 502 503 504 /50x.html;
|
||
# location = /50x.html {
|
||
# root html;
|
||
# }
|
||
# }
|
||
|
||
}
|
||
|
||
#stream {
|
||
|
||
# log_format basic '$remote_addr [$time_local] '
|
||
# '$protocol $status $bytes_sent $bytes_received '
|
||
# '$session_time';
|
||
# access_log logs/stream-access.log basic buffer=32k;
|
||
|
||
# server {
|
||
# allow all;
|
||
# deny 172.25.244.179;
|
||
# deny 172.25.200.115;
|
||
# listen 51980 ;
|
||
# proxy_pass 172.25.1.46:51980;
|
||
# }
|
||
#}
|
||
|
||
|
||
```
|
||
|
||
|
||
|
||
prod:
|
||
```nginx.conf
|
||
|
||
worker_processes 2;
|
||
error_log /var/log/nginx/error.log error;
|
||
|
||
events { worker_connections 1024; }
|
||
|
||
http {
|
||
include /etc/nginx/mime.types;
|
||
default_type application/octet-stream;
|
||
|
||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||
'$status $body_bytes_sent "$http_referer" '
|
||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||
access_log /var/log/nginx/access.log main;
|
||
|
||
sendfile off;
|
||
|
||
server_names_hash_bucket_size 128;
|
||
client_max_body_size 100m;
|
||
client_body_timeout 10;
|
||
client_header_timeout 10;
|
||
keepalive_timeout 65;
|
||
send_timeout 10;
|
||
keepalive_requests 10;
|
||
|
||
# === 新增：网关 upstream，指向 swarm 服务名（内网 8080） ===
|
||
upstream gw {
|
||
server pyresb_pyresb-gateway:8080;
|
||
}
|
||
|
||
server {
|
||
listen 80;
|
||
server_name pyqys.panyu.gd.cn localhost 127.0.0.1 _;
|
||
|
||
# 80 全量跳转到 https
|
||
rewrite ^(.*)$ https://$host$1 permanent;
|
||
|
||
set $method $request_method;
|
||
if ($http_X_HTTP_Method_Override ~* 'DELETE') { set $method DELETE; }
|
||
proxy_method $method;
|
||
|
||
location /kaAV6VwL8o.txt { alias /usr/share/nginx/html/kaAV6VwL8o.txt; }
|
||
|
||
# === 以下把 8081（宿主映射到后端 8080）全部改为网关 upstream ===
|
||
location /gzznGIS { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/gzznGIS; }
|
||
location /aPicture { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/aPicture; }
|
||
location /portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; }
|
||
|
||
location =/pyresbLogin/config/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
location =/pyresbLogin/user/unlock { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
location =/pyresbLogin/user/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
location =/pyresbLogin/user/find/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
|
||
location /pyresbLogin/css { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
location /pyresbLogin/img { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
location /pyresbLogin/js { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
|
||
location =/pyresbLogin/pyresbLogin/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
location =/pyresbLogin/pyresbLogin/config/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
|
||
location /portal/assets { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
location /portal/css { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
location /portal/fonts { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
location /portal/img { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
location /portal/js { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
|
||
location =/report/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
location /report { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
location =/report/captcha/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
|
||
# 仍在物理网/其它端口的目标保持不变
|
||
location /wyn/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; }
|
||
location /Account/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; }
|
||
location /LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister; }
|
||
location /api/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; }
|
||
location /dashboard { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/dashboard; }
|
||
|
||
location /mobile { alias /usr/share/nginx/html/mobile; index index.html index.htm; }
|
||
location /mobile/gzznGIS { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/gzznGIS/; }
|
||
location /mobile/aPicture { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/aPicture/; }
|
||
location /mobile/portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; }
|
||
location /mobile/pyresbLogin { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; rewrite ^/mobile/(.*) /$1 break; proxy_pass http://gw/pyresbLogin/; }
|
||
location /mobile/report { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/report; }
|
||
location /mobile/display { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/; }
|
||
location /mobile/portal { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/portal/; }
|
||
location /mobile/system { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; }
|
||
location /mobile/doc { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/doc/; }
|
||
|
||
location /mobile/wyn/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; }
|
||
location /mobile/Account/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; }
|
||
location /mobile/LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister/; }
|
||
location /mobile/api/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; }
|
||
location /mobile/dashboard { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/dashboard/; }
|
||
|
||
location /dmp-client { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_pass http://172.25.101.113:8080/dmp-client; }
|
||
|
||
location / {
|
||
if ( $request_uri !~* ^/(Model|display|report|portal|pyresbLogin|system|doc|wyn|system|gzznGIS|dashboard|aPicture|mobile|ibls-server) ){ return 403; }
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://gw;
|
||
}
|
||
|
||
error_page 500 502 503 504 /50x.html;
|
||
location = /50x.html { root /usr/share/nginx/html; }
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl;
|
||
server_name localhost pyqys.panyu.gd.cn 172.25.101.39 127.0.0.1 _;
|
||
|
||
rewrite ^/$ http://${host}/portal/;
|
||
|
||
ssl_certificate /etc/nginx/ssl/_.panyu.gd.cn_chain.crt;
|
||
ssl_certificate_key /etc/nginx/ssl/_.panyu.gd.cn.key;
|
||
ssl_session_cache shared:SSL:1m;
|
||
ssl_session_timeout 10m;
|
||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||
ssl_prefer_server_ciphers on;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
|
||
set $method $request_method;
|
||
if ($http_X_HTTP_Method_Override ~* 'DELETE') { set $method DELETE; }
|
||
proxy_method $method;
|
||
|
||
location /kaAV6VwL8o.txt { alias /usr/share/nginx/html/kaAV6VwL8o.txt; }
|
||
|
||
# 443 下同样改到 upstream gw
|
||
location /gzznGIS { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/gzznGIS; }
|
||
location /aPicture { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/aPicture; }
|
||
location /portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; }
|
||
|
||
location =/pyresbLogin/user/ { if ($request_method !~ ^(GET)$) { return 403; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw; }
|
||
|
||
# 仍走物理网段的保留
|
||
location /wyn/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; }
|
||
location /Account/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; }
|
||
location /LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister; }
|
||
location /api/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; }
|
||
location /dashboard { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/dashboard; }
|
||
|
||
location /mobile { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:8860/; }
|
||
|
||
# 其余 mobile* 同上（gw 或物理网段，已在 80 里示范）
|
||
location /mobile/gzznGIS { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/gzznGIS/; }
|
||
location /mobile/aPicture { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/aPicture/; }
|
||
location /mobile/portal/system/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; }
|
||
location /mobile/pyresbLogin { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/pyresbLogin/; }
|
||
location /mobile/login { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/pyresbLogin/; }
|
||
location /mobile/report { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/report; }
|
||
location /mobile/display { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/; }
|
||
location /mobile/portal { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/portal/; }
|
||
location /mobile/system { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/system/; }
|
||
location /mobile/doc { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/doc/; }
|
||
location /mobile/wyn/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/; }
|
||
location /mobile/Account/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/Account/; }
|
||
location /mobile/LicenseRegister { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/LicenseRegister/; }
|
||
location /mobile/api/ { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://172.25.101.39:51980/api/; }
|
||
location /mobile/dashboard { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host:$server_port; proxy_pass http://gw/display/dashboard/; }
|
||
|
||
location /dmp-client { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_pass http://172.25.101.113:8080/dmp-client; }
|
||
|
||
location / {
|
||
if ( $request_uri !~* ^/(Model|display|report|portal|pyresbLogin|system|doc|wyn|system|gzznGIS|dashboard|aPicture|mobile|ibls-server) ){ return 403; }
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header Host $host:$server_port;
|
||
proxy_pass http://gw;
|
||
}
|
||
|
||
error_page 500 502 503 504 /50x.html;
|
||
location = /50x.html { root /usr/share/nginx/html; }
|
||
}
|
||
}
|
||
|
||
|
||
```
|
||
|
||
|
||
test:
|
||
```bash
|
||
docker run --rm -v "$PWD/nginx.conf:/etc/nginx/nginx.conf:ro" nginx -t
|
||
```
|
||
|
||
|
||
```stack.yml
|
||
version: "3.9"
|
||
|
||
configs:
|
||
nginx_conf:
|
||
file: ./nginx.conf
|
||
kaAV6VwL8o:
|
||
file: ./kaAV6VwL8o.txt
|
||
|
||
secrets:
|
||
wildcard_panyu_chain_crt:
|
||
file: /opt/soft/ca/_.panyu.gd.cn/Nginx_Other_Server/_.panyu.gd.cn_chain.crt
|
||
wildcard_panyu_key:
|
||
file: /opt/soft/ca/_.panyu.gd.cn/_.panyu.gd.cn.key
|
||
|
||
services:
|
||
nginx:
|
||
image: nginx
|
||
deploy:
|
||
replicas: 1
|
||
restart_policy:
|
||
condition: on-failure
|
||
placement:
|
||
constraints:
|
||
- node.hostname == worker1
|
||
environment:
|
||
- TZ=Asia/Shanghai
|
||
volumes:
|
||
- ./logs:/var/log/nginx
|
||
ports:
|
||
- target: 80
|
||
published: 80
|
||
protocol: tcp
|
||
mode: ingress
|
||
- target: 443
|
||
published: 443
|
||
protocol: tcp
|
||
mode: ingress
|
||
configs:
|
||
- source: nginx_conf
|
||
target: /etc/nginx/nginx.conf
|
||
mode: 0444
|
||
- source: kaAV6VwL8o
|
||
target: /usr/share/nginx/html/kaAV6VwL8o.txt
|
||
mode: 0444
|
||
secrets:
|
||
- source: wildcard_panyu_chain_crt
|
||
target: /etc/nginx/ssl/_.panyu.gd.cn_chain.crt
|
||
mode: 0400
|
||
- source: wildcard_panyu_key
|
||
target: /etc/nginx/ssl/_.panyu.gd.cn.key
|
||
mode: 0400
|
||
healthcheck:
|
||
test: ["CMD", "nginx", "-t"]
|
||
interval: 30s
|
||
timeout: 5s
|
||
retries: 3
|
||
networks:
|
||
- pyresb # 关键：加入现有 overlay
|
||
|
||
networks:
|
||
pyresb:
|
||
external: true
|
||
name: pyresb_pyresb
|
||
|
||
``` |