# Nginx 443 SNI (C3 / C4)

gnet v2 has no native TLS. IM certificates live here, not in spark-server `tcp.tls`.

```text
Client --TLS--> :443 ssl_preread
                  ├─ SNI sparkapi.wyrs365.com → 127.0.0.1:8443 (HTTP TLS)
                  │                              → proxy_pass http://127.0.0.1:18080 + X-Real-IP
                  ├─ SNI sparkr.wyrs365.com   → 127.0.0.1:8443 (HTTP TLS)
                  │                              → proxy_pass http://127.0.0.1:9000 RustFS S3
                  ├─ SNI sparkmessenger / sparkmsg → 127.0.0.1:8443 (静态官网)
                  └─ SNI sparkim.wyrs365.com  → 127.0.0.1:19001 (IM TLS)
                                               → PROXY protocol → 127.0.0.1:9090 gnet
```

On this ECS, `:443` is shared with other wyrs HTTPS sites. Do **not** replace `/etc/nginx/nginx.conf`. Drop-ins:

- `host/sparkapi.conf` → `/etc/nginx/conf.d/`
- `host/sparkr.conf` → `/etc/nginx/conf.d/` (RustFS S3; DNS A record `sparkr.wyrs365.com` → this host)
- `host/sparkmessenger.conf` → `/etc/nginx/conf.d/`（官网；`sparkmessenger.wyrs365.com` / `sparkmsg.wyrs365.com`）
- `host/spark-sni.conf` → `/etc/nginx/stream.d/`
- `snippets/wyrs-cn-geo-access.conf` → `/etc/nginx/snippets/`（大陆除上海拦截；依赖 `wyrs-geo-guard`）
- `deploy/geo-guard/` → 本机 `127.0.0.1:18099` MaxMind City 鉴权（海外+上海放行）

官网静态文件在 `/var/www/sparkmessenger.wyrs365.com`，部署：

```bash
bash deploy/website/deploy.sh
```

大陆地区访问控制（官网 + 同机 `fullstorynovel.com`）：

- GeoIP：`/usr/share/GeoIP/GeoLite2-City.mmdb`（subdivision `SH` / city Shanghai 视为上海）
- 服务：`systemctl status wyrs-geo-guard`
- 拒绝页：`/var/www/wyrs-geo-deny/index.html`（文案：按照相关部门规定大陆地区禁止访问）

Existing `listen 443 ssl` vhosts move to `127.0.0.1:8443 ssl proxy_protocol` so SNI can take public 443. `00-spark-http.conf` sets `real_ip_header proxy_protocol` and `port_in_redirect off` so `$remote_addr` is the client and redirects stay on 443.

spark-server (Docker):

- HTTP `127.0.0.1:18080` → container `:8080`
- TCP `127.0.0.1:9090` with `proxy_protocol: true` → container `:9090` (host `:9000` is rustfs S3; bind `127.0.0.1:9000`, not public)
- Image / config / logs: `/data/spark-server/{images,compose,configs,logs}`（镜像在本机打包后 `docker load`）
- Public security group: 443 only
- Clients upload/download at `https://sparkr.wyrs365.com` (path-style). spark-server talks to `rustfs:9000` on the Docker network and signs URLs with `object_storage.public_endpoint`.
- Unsigned GET is allowed only for `/perm/avatar/` and `/perm/group/` (rewritten to `/spark/...`). Chat and other prefixes stay SigV4.

```bash
bash deploy/nginx/install-host.sh
```

`http.conf` / `stream.conf` / `nginx.conf` are a dedicated-box template. `/readyz` is loopback-only on 8443; local probes hit Gin on `127.0.0.1:18080`.

## popadmin 接入 V3 管理 API

popadmin 前端仍请求同源 `/api/admin/*`（无需改 `API` 常量）。在 **popadmin.wyrs365.com** 的 Nginx 里，把 IM/群/用户等路径转到 spark-server：

```bash
sudo cp deploy/nginx/host/popadmin-spark-admin-locations.conf /etc/nginx/conf.d/
# Aliyun 仓库 nginx-popadmin-wyrs.conf 已 include 该文件
sudo nginx -t && sudo systemctl reload nginx
```

确保 spark-server 容器监听 `127.0.0.1:18080`，且 `admin.jwt_secret` 与 Java `WYRS_ADMIN_JWT_SECRET` 一致。登录、仪表盘、configs/通讯录/相册仍走 Java `:8090`。

## popadmin 世界地图底图（IP 属地日活）

`popadmin-sg-panels.js` 请求 `GET /admin/geo/world.json`（echarts GeoJSON）。必须在 nginx 里单独 `alias` 静态文件，否则会被 `location /` 302 成 HTML，地图报 `Unexpected token '<'`。

```bash
# 静态文件放到服务器
sudo mkdir -p /opt/wyrs-admin/static-override/geo
# 从 Aliyun SG GO/scripts/popadmin-static/geo/world.json 上传
sudo cp world.json /opt/wyrs-admin/static-override/geo/world.json
# 把 host/popadmin-world-geo.snippet.conf 插入 popadmin-wyrs.conf 的 location / 之前
# 或执行：Aliyun SG GO/scripts/popadmin-static/patch_world_geo.sh
sudo nginx -t && sudo systemctl reload nginx
curl -skI https://popadmin.wyrs365.com/admin/geo/world.json   # 期望 200 application/json
```