86 lines
3.8 KiB
Plaintext
86 lines
3.8 KiB
Plaintext
# 手机远程控制台（/m/）的 HTTPS 入口。
|
||
#
|
||
# 自 2026-09-28（mobile-http-20260928）起按用户要求，内外网都允许明文 HTTP 登录手机端
|
||
# （MOBILE_REQUIRE_HTTPS 默认 never）。HTTP 下 ZYT 密码和手机会话令牌在公网上可被截获；
|
||
# 配好本 HTTPS 入口后，建议给 api 服务加环境变量 MOBILE_REQUIRE_HTTPS=auto（公网必须 HTTPS，内网仍可 HTTP）。
|
||
#
|
||
# 启用步骤（宝塔面板或手工均可）：
|
||
# 1. 证书：宝塔「网站 → im.zhenyangtang.cn → SSL」申请 Let's Encrypt，或 acme.sh。
|
||
# 公网 443 没有转发到本机时，HTTP-01 验证会失败，改用 DNS-01（DNS API）签发。
|
||
# 2. 端口：路由器把公网 TCP 443（或选定的 HTTPS 端口，例如 8443）转发到 192.168.110.111。
|
||
# 用非 443 端口时把下面的 listen 改成对应端口，手机访问 https://im.zhenyangtang.cn:8443/m/。
|
||
# 3. 把本文件复制成 im.zhenyangtang.cn.https.conf 放到与现有 conf 相同的目录，修改证书路径，
|
||
# `nginx -t` 通过后 `nginx -s reload`。现有的 80 端口配置保持不动，桌面端继续可用。
|
||
# 4. 验证：curl -I https://im.zhenyangtang.cn/m/ 返回 200；手机浏览器打开后登录页不再提示明文连接。
|
||
#
|
||
# 注意 X-Real-IP 必须由 Nginx 用 $remote_addr 覆盖写入：后台用它做登录限流和"是否内网"的判断。
|
||
|
||
server {
|
||
listen 443 ssl http2;
|
||
server_name im.zhenyangtang.cn;
|
||
|
||
ssl_certificate /www/server/panel/vhost/cert/im.zhenyangtang.cn/fullchain.pem;
|
||
ssl_certificate_key /www/server/panel/vhost/cert/im.zhenyangtang.cn/privkey.pem;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_prefer_server_ciphers off;
|
||
ssl_session_cache shared:SSL_IM:10m;
|
||
ssl_session_timeout 1d;
|
||
add_header Strict-Transport-Security "max-age=31536000" always;
|
||
|
||
client_max_body_size 100m;
|
||
|
||
location ^~ /api/v2/ {
|
||
proxy_pass http://127.0.0.1:18766;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 15s;
|
||
proxy_send_timeout 300s;
|
||
# 桌面端命令通道长轮询最长挂起 25 秒，远小于这里的读超时。
|
||
proxy_read_timeout 300s;
|
||
}
|
||
|
||
location ^~ /api/ {
|
||
proxy_pass http://127.0.0.1:18766/api/v2/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 15s;
|
||
proxy_send_timeout 300s;
|
||
proxy_read_timeout 300s;
|
||
}
|
||
|
||
location ^~ /gateway/ {
|
||
proxy_pass http://127.0.0.1:18770/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 15s;
|
||
proxy_send_timeout 300s;
|
||
proxy_read_timeout 300s;
|
||
}
|
||
|
||
location / {
|
||
proxy_pass http://127.0.0.1:18766;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection $connection_upgrade;
|
||
proxy_connect_timeout 15s;
|
||
proxy_send_timeout 300s;
|
||
proxy_read_timeout 300s;
|
||
}
|
||
|
||
access_log /www/wwwlogs/im.zhenyangtang.cn.https.log;
|
||
error_log /www/wwwlogs/im.zhenyangtang.cn.https.error.log;
|
||
}
|