# ═══════════════════════════════════════════════════════════
# Awen 域名反向代理配置 · 新加坡中转
# ═══════════════════════════════════════════════════════════
#
# 编号: ZY-SVR-NGX-AWEN
# 中转服务器: ZY-SVR-002 (43.134.16.246 · 新加坡)
# 后端服务器: ZY-SVR-AWEN (广州 · Awen实际服务)
# 守护: 铸渊 · ICE-GL-ZY001
# 版权: 国作登字-2026-A-00037559
#
# 架构:
# 用户浏览器 → Awen域名(DNS→新加坡IP)
# → ZY-SVR-002 Nginx(本配置·反向代理)
# → Awen广州服务器(实际服务)
#
# 域名未备案解决方案:
# 域名DNS A记录指向新加坡IP → 无需中国大陆ICP备案
# 新加坡Nginx将请求反向代理到广州后端
# 延迟约30-50ms · 对Web应用可接受
#
# 占位符由 deploy workflow 自动替换:
# AWEN_DOMAIN_PLACEHOLDER ← GitHub Secret: AWEN_DOMAIN
# AWEN_BACKEND_HOST_PLACEHOLDER ← GitHub Secret: AWEN_BACKEND_HOST
# AWEN_BACKEND_PORT_PLACEHOLDER ← GitHub Secret: AWEN_BACKEND_PORT
# ═══════════════════════════════════════════════════════════
# ─── Awen 域名 · 反向代理到广州后端 ───
server {
listen 80;
server_name AWEN_DOMAIN_PLACEHOLDER;
# ─── 安全头 ───
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Server-Identity "ZY-SVR-002" always;
add_header X-Proxy-Mode "awen-reverse-proxy" always;
# ─── 请求体大小限制 (允许文件上传) ───
client_max_body_size 50m;
# ─── 主路由 · 反向代理到广州后端 ───
location / {
proxy_pass http://AWEN_BACKEND_HOST_PLACEHOLDER:AWEN_BACKEND_PORT_PLACEHOLDER;
proxy_http_version 1.1;
# ─── 请求头透传 ───
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
# ─── WebSocket 支持 ───
# 使用硬编码 "upgrade" 而非 map 变量，与 zhuyuan-sovereign.conf 保持一致
# 后端会忽略非 WebSocket 请求的 Connection: upgrade 头
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# ─── 超时设置 (跨境延迟考虑 · 新加坡↔广州) ───
proxy_connect_timeout 15s;
proxy_read_timeout 120s;
proxy_send_timeout 60s;
# ─── 缓冲设置 ───
proxy_buffering on;
proxy_buffer_size 16k;
proxy_buffers 4 32k;
proxy_busy_buffers_size 64k;
# ─── 错误处理 · 后端不可达时返回友好页面 ───
proxy_intercept_errors on;
error_page 502 503 504 /awen_backend_unavailable.html;
}
# ─── 健康检查端点 (不记录日志 · 减少噪音) ───
location = /health {
proxy_pass http://AWEN_BACKEND_HOST_PLACEHOLDER:AWEN_BACKEND_PORT_PLACEHOLDER/health;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_connect_timeout 5s;
proxy_read_timeout 10s;
access_log off;
}
# ─── Let's Encrypt 证书验证路径 ───
location /.well-known/acme-challenge/ {
root /var/www/certbot;
allow all;
}
# ─── 后端不可达时的友好错误页 ───
location = /awen_backend_unavailable.html {
internal;
default_type text/html;
return 502 'Service Temporarily Unavailable503 Service Temporarily Unavailable
The backend server is currently unreachable. Please try again later.
Proxy: ZY-SVR-002 (Singapore) → Backend: Guangzhou
';
}
# ─── 访问日志 · 独立文件便于监控 ───
access_log /opt/zhuyuan/data/logs/nginx-awen-proxy.log;
error_log /opt/zhuyuan/data/logs/nginx-awen-proxy-error.log;
}