DESKTOP-L8OUL9F\gfl0034
94dd2d819c
Nginx auth_request plus MaxMind City lookup blocks non-Shanghai mainland CN with a fixed notice page for sparkmessenger/sparkmsg (and deploy helpers for the shared Singapore host). Co-authored-by: Cursor <cursoragent@cursor.com>
65 lines
3.5 KiB
Markdown
65 lines
3.5 KiB
Markdown
# Nginx 443 SNI (C3 / C4)
|
||
|
||
gnet v2 has no native TLS. IM certificates live here, not in spark-server `tcp.tls`.
|
||
|
||
```text
|
||
Client --TLS--> :443 ssl_preread
|
||
├─ SNI sparkapi.wyrs365.com → 127.0.0.1:8443 (HTTP TLS)
|
||
│ → proxy_pass http://127.0.0.1:18080 + X-Real-IP
|
||
├─ SNI sparkr.wyrs365.com → 127.0.0.1:8443 (HTTP TLS)
|
||
│ → proxy_pass http://127.0.0.1:9000 RustFS S3
|
||
├─ SNI sparkmessenger / sparkmsg → 127.0.0.1:8443 (静态官网)
|
||
└─ SNI sparkim.wyrs365.com → 127.0.0.1:19001 (IM TLS)
|
||
→ PROXY protocol → 127.0.0.1:9090 gnet
|
||
```
|
||
|
||
On this ECS, `:443` is shared with other wyrs HTTPS sites. Do **not** replace `/etc/nginx/nginx.conf`. Drop-ins:
|
||
|
||
- `host/sparkapi.conf` → `/etc/nginx/conf.d/`
|
||
- `host/sparkr.conf` → `/etc/nginx/conf.d/` (RustFS S3; DNS A record `sparkr.wyrs365.com` → this host)
|
||
- `host/sparkmessenger.conf` → `/etc/nginx/conf.d/`（官网；`sparkmessenger.wyrs365.com` / `sparkmsg.wyrs365.com`）
|
||
- `host/spark-sni.conf` → `/etc/nginx/stream.d/`
|
||
- `snippets/wyrs-cn-geo-access.conf` → `/etc/nginx/snippets/`（大陆除上海拦截；依赖 `wyrs-geo-guard`）
|
||
- `deploy/geo-guard/` → 本机 `127.0.0.1:18099` MaxMind City 鉴权（海外+上海放行）
|
||
|
||
官网静态文件在 `/var/www/sparkmessenger.wyrs365.com`，部署：
|
||
|
||
```bash
|
||
bash deploy/website/deploy.sh
|
||
```
|
||
|
||
大陆地区访问控制（官网 + 同机 `fullstorynovel.com`）：
|
||
|
||
- GeoIP：`/usr/share/GeoIP/GeoLite2-City.mmdb`（subdivision `SH` / city Shanghai 视为上海）
|
||
- 服务：`systemctl status wyrs-geo-guard`
|
||
- 拒绝页：`/var/www/wyrs-geo-deny/index.html`（文案：按照相关部门规定大陆地区禁止访问）
|
||
|
||
Existing `listen 443 ssl` vhosts move to `127.0.0.1:8443 ssl proxy_protocol` so SNI can take public 443. `00-spark-http.conf` sets `real_ip_header proxy_protocol` and `port_in_redirect off` so `$remote_addr` is the client and redirects stay on 443.
|
||
|
||
spark-server (Docker):
|
||
|
||
- HTTP `127.0.0.1:18080` → container `:8080`
|
||
- TCP `127.0.0.1:9090` with `proxy_protocol: true` → container `:9090` (host `:9000` is rustfs S3; bind `127.0.0.1:9000`, not public)
|
||
- Image / config / logs: `/data/spark-server/{images,compose,configs,logs}`（镜像在本机打包后 `docker load`）
|
||
- Public security group: 443 only
|
||
- Clients upload/download at `https://sparkr.wyrs365.com` (path-style). spark-server talks to `rustfs:9000` on the Docker network and signs URLs with `object_storage.public_endpoint`.
|
||
- Unsigned GET is allowed only for `/perm/avatar/` and `/perm/group/` (rewritten to `/spark/...`). Chat and other prefixes stay SigV4.
|
||
|
||
```bash
|
||
bash deploy/nginx/install-host.sh
|
||
```
|
||
|
||
`http.conf` / `stream.conf` / `nginx.conf` are a dedicated-box template. `/readyz` is loopback-only on 8443; local probes hit Gin on `127.0.0.1:18080`.
|
||
|
||
## popadmin 接入 V3 管理 API
|
||
|
||
popadmin 前端仍请求同源 `/api/admin/*`（无需改 `API` 常量）。在 **popadmin.wyrs365.com** 的 Nginx 里，把 IM/群/用户等路径转到 spark-server：
|
||
|
||
```bash
|
||
sudo cp deploy/nginx/host/popadmin-spark-admin-locations.conf /etc/nginx/conf.d/
|
||
# Aliyun 仓库 nginx-popadmin-wyrs.conf 已 include 该文件
|
||
sudo nginx -t && sudo systemctl reload nginx
|
||
```
|
||
|
||
确保 spark-server 容器监听 `127.0.0.1:18080`，且 `admin.jwt_secret` 与 Java `WYRS_ADMIN_JWT_SECRET` 一致。登录、仪表盘、configs/通讯录/相册仍走 Java `:8090`。
|