37 lines
2.0 KiB
Markdown
37 lines
2.0 KiB
Markdown
# Nginx 443 SNI (C3 / C4)
|
|
|
|
gnet v2 has no native TLS. IM certificates live here, not in spark-server `tcp.tls`.
|
|
|
|
```text
|
|
Client --TLS--> :443 ssl_preread
|
|
├─ SNI sparkapi.wyrs365.com → 127.0.0.1:8443 (HTTP TLS)
|
|
│ → proxy_pass http://127.0.0.1:18080 + X-Real-IP
|
|
├─ SNI sparkr.wyrs365.com → 127.0.0.1:8443 (HTTP TLS)
|
|
│ → proxy_pass http://127.0.0.1:9000 RustFS S3
|
|
└─ SNI sparkim.wyrs365.com → 127.0.0.1:19001 (IM TLS)
|
|
→ PROXY protocol → 127.0.0.1:9090 gnet
|
|
```
|
|
|
|
On this ECS, `:443` is shared with other wyrs HTTPS sites. Do **not** replace `/etc/nginx/nginx.conf`. Drop-ins:
|
|
|
|
- `host/sparkapi.conf` → `/etc/nginx/conf.d/`
|
|
- `host/sparkr.conf` → `/etc/nginx/conf.d/` (RustFS S3; DNS A record `sparkr.wyrs365.com` → this host)
|
|
- `host/spark-sni.conf` → `/etc/nginx/stream.d/`
|
|
|
|
Existing `listen 443 ssl` vhosts move to `127.0.0.1:8443 ssl proxy_protocol` so SNI can take public 443. `00-spark-http.conf` sets `real_ip_header proxy_protocol` and `port_in_redirect off` so `$remote_addr` is the client and redirects stay on 443.
|
|
|
|
spark-server (Docker):
|
|
|
|
- HTTP `127.0.0.1:18080` → container `:8080`
|
|
- TCP `127.0.0.1:9090` with `proxy_protocol: true` → container `:9090` (host `:9000` is rustfs S3; bind `127.0.0.1:9000`, not public)
|
|
- Image / config / logs: `/data/spark-server/{images,configs,logs}`
|
|
- Public security group: 443 only
|
|
- Clients upload/download at `https://sparkr.wyrs365.com` (path-style). spark-server talks to `rustfs:9000` on the Docker network and signs URLs with `object_storage.public_endpoint`.
|
|
- Unsigned GET is allowed only for `/perm/avatar/` and `/perm/group/` (rewritten to `/spark/...`). Chat and other prefixes stay SigV4.
|
|
|
|
```bash
|
|
bash deploy/nginx/install-host.sh
|
|
```
|
|
|
|
`http.conf` / `stream.conf` / `nginx.conf` are a dedicated-box template. `/readyz` is loopback-only on 8443; local probes hit Gin on `127.0.0.1:18080`.
|