spark-server/deploy/nginx

Nginx 443 SNI (C3 / C4)

gnet v2 has no native TLS. IM certificates live here, not in spark-server tcp.tls.

Client --TLS--> :443 ssl_preread
                  ├─ SNI sparkapi.wyrs365.com → 127.0.0.1:8443 (HTTP TLS)
                  │                              → proxy_pass http://127.0.0.1:18080 + X-Real-IP
                  ├─ SNI sparkr.wyrs365.com   → 127.0.0.1:8443 (HTTP TLS)
                  │                              → proxy_pass http://127.0.0.1:9000 RustFS S3
                  ├─ SNI sparkmessenger / sparkmsg → 127.0.0.1:8443 (静态官网)
                  └─ SNI sparkim.wyrs365.com  → 127.0.0.1:19001 (IM TLS)
                                               → PROXY protocol → 127.0.0.1:9090 gnet

On this ECS, :443 is shared with other wyrs HTTPS sites. Do not replace /etc/nginx/nginx.conf. Drop-ins:

• host/sparkapi.conf → /etc/nginx/conf.d/
• host/sparkr.conf → /etc/nginx/conf.d/ (RustFS S3; DNS A record sparkr.wyrs365.com → this host)
• host/sparkmessenger.conf → /etc/nginx/conf.d/（官网；sparkmessenger.wyrs365.com / sparkmsg.wyrs365.com）
• host/spark-sni.conf → /etc/nginx/stream.d/
• snippets/wyrs-cn-geo-access.conf → /etc/nginx/snippets/（大陆除上海拦截；依赖 wyrs-geo-guard）
• deploy/geo-guard/ → 本机 127.0.0.1:18099 MaxMind City 鉴权（海外+上海放行）

官网静态文件在 /var/www/sparkmessenger.wyrs365.com，部署：

bash deploy/website/deploy.sh

大陆地区访问控制（官网 + 同机 fullstorynovel.com）：

• GeoIP：/usr/share/GeoIP/GeoLite2-City.mmdb（subdivision SH / city Shanghai 视为上海）
• 服务：systemctl status wyrs-geo-guard
• 拒绝页：/var/www/wyrs-geo-deny/index.html（文案：按照相关部门规定大陆地区禁止访问）

Existing listen 443 ssl vhosts move to 127.0.0.1:8443 ssl proxy_protocol so SNI can take public 443. 00-spark-http.conf sets real_ip_header proxy_protocol and port_in_redirect off so $remote_addr is the client and redirects stay on 443.

spark-server (Docker):

• HTTP 127.0.0.1:18080 → container :8080
• TCP 127.0.0.1:9090 with proxy_protocol: true → container :9090 (host :9000 is rustfs S3; bind 127.0.0.1:9000, not public)
• Image / config / logs: /data/spark-server/{images,compose,configs,logs}（镜像在本机打包后 docker load）
• Public security group: 443 only
• Clients upload/download at https://sparkr.wyrs365.com (path-style). spark-server talks to rustfs:9000 on the Docker network and signs URLs with object_storage.public_endpoint.
• Unsigned GET is allowed only for /perm/avatar/ and /perm/group/ (rewritten to /spark/...). Chat and other prefixes stay SigV4.

bash deploy/nginx/install-host.sh

http.conf / stream.conf / nginx.conf are a dedicated-box template. /readyz is loopback-only on 8443; local probes hit Gin on 127.0.0.1:18080.

popadmin 接入 V3 管理 API

popadmin 前端仍请求同源 /api/admin/*（无需改 API 常量）。在 popadmin.wyrs365.com 的 Nginx 里，把 IM/群/用户等路径转到 spark-server：

sudo cp deploy/nginx/host/popadmin-spark-admin-locations.conf /etc/nginx/conf.d/
# Aliyun 仓库 nginx-popadmin-wyrs.conf 已 include 该文件
sudo nginx -t && sudo systemctl reload nginx

确保 spark-server 容器监听 127.0.0.1:18080，且 admin.jwt_secret 与 Java WYRS_ADMIN_JWT_SECRET 一致。登录、仪表盘、configs/通讯录/相册仍走 Java :8090。