guanghulab/server/setup/lighthouse-cn/nginx/lighthouse.conf

# ════════════════════════════════════════════════════════════════
# 光湖灯塔 · Nginx 反代
# Sovereign: TCS-0002∞ · 国作登字-2026-A-00037559
# 守护: 铸渊 · ICE-GL-ZY001
#
# 端口分配:
#   80   → http (备案前临时入口, 备案后只重定向到 443)
#   443  → https (灯塔门户 + Gitea + 总控台 API)
#   3000 → Gitea (内部, 仅 127.0.0.1 监听, 由本配置反代)
#
# 子路径分配:
#   /                  → 灯塔门户 (公告 / 论坛 / 广播, 占位)
#   /git/              → Gitea Web UI
#   /api/v1/           → Gitea API
#   /api/lighthouse/   → 灯塔总控台 API (操作系统总控, 旁挂)
#   /__switch/         → channel-switcher (复用既有标准插座)
# ════════════════════════════════════════════════════════════════

upstream gitea_upstream {
    server 127.0.0.1:3000;
    keepalive 16;
}

# 灯塔总控台占位 (PM2 进程 lighthouse-console 后续接入)
upstream lighthouse_console {
    server 127.0.0.1:3100;
    keepalive 8;
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;

    # 备案前临时直接服务, 备案后请改为 301 redirect 到 https
    client_max_body_size 200m;

    access_log /data/logs/nginx/lighthouse-access.log;
    error_log  /data/logs/nginx/lighthouse-error.log;

    # ── 灯塔门户根路径 (静态 + SSE) ──────────────────────────
    location = / {
        return 200 '光湖灯塔 · HoloLake Lighthouse · 国作登字-2026-A-00037559\n灯塔门户构建中...\nGitea: /git/\n';
        add_header Content-Type "text/plain; charset=utf-8";
    }

    # ── Gitea Web UI ─────────────────────────────────────────
    location /git/ {
        proxy_pass         http://gitea_upstream/;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_read_timeout 300s;
        proxy_request_buffering off;
        client_max_body_size 500m;
    }

    # ── Gitea API (供 GitHub Actions 兼容工具调用) ──────────
    location /api/v1/ {
        proxy_pass         http://gitea_upstream/api/v1/;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_read_timeout 300s;
    }

    # ── 灯塔总控台 API 占位 ─────────────────────────────────
    location /api/lighthouse/ {
        proxy_pass         http://lighthouse_console/;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_read_timeout 300s;
        # 总控台未启动时返回 503 而不是 502
        error_page 502 = @lighthouse_pending;
    }

    location @lighthouse_pending {
        return 503 '灯塔总控台尚未启动 (lighthouse-console PM2 进程未运行)\n';
        add_header Content-Type "text/plain; charset=utf-8";
    }

    # ── 健康检查 ─────────────────────────────────────────────
    location = /health {
        return 200 'lighthouse-cn ok\n';
        add_header Content-Type "text/plain; charset=utf-8";
    }

    # ── ACME challenge (certbot 用) ──────────────────────────
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }
}

# ════════════════════════════════════════════════════════════════
# 备案后启用 HTTPS 时, 反注释以下 server 块, 并把 80 server 改成 301
# ════════════════════════════════════════════════════════════════
# server {
#     listen 443 ssl http2;
#     server_name __DOMAIN__;
#
#     ssl_certificate     /etc/letsencrypt/live/__DOMAIN__/fullchain.pem;
#     ssl_certificate_key /etc/letsencrypt/live/__DOMAIN__/privkey.pem;
#     ssl_protocols TLSv1.2 TLSv1.3;
#     ssl_ciphers HIGH:!aNULL:!MD5;
#     ssl_prefer_server_ciphers on;
#
#     # ... 其余 location 与 80 server 块完全相同
# }