add 20251112 report
This commit is contained in:
Jiao77
323
jiao77.cn.conf
Normal file
323
jiao77.cn.conf
Normal file
@@ -0,0 +1,323 @@
|
||||
############################################################
|
||||
# Apache 子域名反向代理配置（jiao77.cn）
|
||||
#
|
||||
# 说明：
|
||||
# - 避免子路径带来的静态资源/重写/WS 问题，每个服务独立子域名
|
||||
# - 统一在 443 终止 TLS，Apache 反代到本地端口服务
|
||||
# - 主站 jiao77.cn 使用 Docker 容器部署（端口 3001）
|
||||
# - API 后端服务使用 Docker 容器部署（端口 3000）
|
||||
#
|
||||
# 前置：
|
||||
# - DNS 为以下子域名添加 A/AAAA 记录 -> 服务器 IP
|
||||
# - 证书需覆盖所有子域（通配符 *.jiao77.cn 或 SAN 多域名证书）
|
||||
# - 启用模块：ssl headers proxy proxy_http proxy_wstunnel rewrite deflate cache cache_disk expires
|
||||
#
|
||||
# 部署：
|
||||
# - 放置到 /etc/apache2/sites-available/jiao77-subdomains.conf
|
||||
# - sudo a2enmod ssl headers proxy proxy_http proxy_wstunnel rewrite deflate cache cache_disk expires
|
||||
# - sudo a2ensite jiao77-subdomains && sudo systemctl reload apache2
|
||||
############################################################
|
||||
|
||||
# ============ 主站（前端 Docker 容器） ============
|
||||
<VirtualHost *:80>
|
||||
ServerName jiao77.cn
|
||||
ServerAlias www.jiao77.cn
|
||||
RewriteEngine On
|
||||
RewriteRule ^/(.*)$ https://jiao77.cn/$1 [R=301,L]
|
||||
</VirtualHost>
|
||||
|
||||
<IfModule mod_ssl.c>
|
||||
<VirtualHost *:443>
|
||||
ServerName jiao77.cn
|
||||
ServerAlias www.jiao77.cn
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/ssl/jiao77/cert.pem
|
||||
SSLCertificateKeyFile /etc/ssl/jiao77/key.pem
|
||||
SSLCertificateChainFile /etc/ssl/jiao77/chain.pem
|
||||
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
|
||||
SSLCipherSuite HIGH:!aNULL:!MD5
|
||||
|
||||
# 安全头配置
|
||||
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
|
||||
Header always set X-Content-Type-Options "nosniff"
|
||||
Header always set X-Frame-Options "SAMEORIGIN"
|
||||
Header always set Referrer-Policy "no-referrer-when-downgrade"
|
||||
|
||||
# 代理配置
|
||||
ProxyPreserveHost On
|
||||
ProxyRequests Off
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"
|
||||
|
||||
# 缓存策略（VirtualHost 级别）
|
||||
# 注意：一些缓存指令（如 CacheIgnoreHeaders）不允许放在 <LocationMatch> 中
|
||||
# 因此在虚拟主机级别声明，以便对下方的缓存生效
|
||||
CacheIgnoreHeaders Set-Cookie
|
||||
|
||||
# ============ API 后端代理 ============
|
||||
# 暂时注释掉 API 代理，如果需要可以取消注释
|
||||
# 健康检查（不记录日志）
|
||||
# <Location /health>
|
||||
# ProxyPass http://127.0.0.1:3000/health
|
||||
# ProxyPassReverse http://127.0.0.1:3000/health
|
||||
# SetEnv no-log 1
|
||||
# </Location>
|
||||
|
||||
# API 接口代理
|
||||
# 关键：使用 <Location> 并带尾部斜杠，确保路径正确传递
|
||||
# <Location /api/>
|
||||
# ProxyPass http://127.0.0.1:3000/api/
|
||||
# ProxyPassReverse http://127.0.0.1:3000/api/
|
||||
#
|
||||
# # API 缓存配置（10分钟）
|
||||
# CacheEnable disk
|
||||
# CacheHeader on
|
||||
# CacheDefaultExpire 600
|
||||
# CacheMaxExpire 600
|
||||
# </Location>
|
||||
|
||||
# ============ 静态资源缓存 ============
|
||||
# 由于现在直接使用静态文件服务，这个 LocationMatch 可以移除
|
||||
# 静态资源缓存已在下面的 Directory 配置中处理
|
||||
|
||||
# ============ 前端应用代理（默认） ============
|
||||
# 直接提供静态文件服务，不使用 Docker 容器
|
||||
DocumentRoot /var/www/jiao77.cn
|
||||
DirectoryIndex index.html
|
||||
|
||||
# 静态文件处理
|
||||
<Directory /var/www/jiao77.cn>
|
||||
Options -Indexes +FollowSymLinks
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
# 对静态资源启用缓存
|
||||
<LocationMatch "\.(js|css|png|jpg|jpeg|gif|ico|woff|woff2|svg|webp)$">
|
||||
ExpiresActive On
|
||||
ExpiresDefault "access plus 30 days"
|
||||
Header set Cache-Control "public, max-age=2592000, immutable"
|
||||
</LocationMatch>
|
||||
|
||||
# Gzip 压缩配置
|
||||
<IfModule mod_deflate.c>
|
||||
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
|
||||
AddOutputFilterByType DEFLATE application/javascript application/json
|
||||
AddOutputFilterByType DEFLATE application/xml application/rss+xml
|
||||
</IfModule>
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/jiao77-main-error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/jiao77-main-access.log combined
|
||||
</VirtualHost>
|
||||
</IfModule>
|
||||
|
||||
# 公共代理选项
|
||||
<IfModule mod_ssl.c>
|
||||
SSLProxyEngine on
|
||||
</IfModule>
|
||||
|
||||
# ============ Gitea ============
|
||||
<VirtualHost *:80>
|
||||
ServerName gitea.jiao77.cn
|
||||
RewriteEngine On
|
||||
RewriteRule ^/(.*)$ https://gitea.jiao77.cn/$1 [R=301,L]
|
||||
</VirtualHost>
|
||||
|
||||
<IfModule mod_ssl.c>
|
||||
<VirtualHost *:443>
|
||||
ServerName gitea.jiao77.cn
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/ssl/jiao77/cert.pem
|
||||
SSLCertificateKeyFile /etc/ssl/jiao77/key.pem
|
||||
SSLCertificateChainFile /etc/ssl/jiao77/chain.pem
|
||||
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
|
||||
ProxyPass / http://127.0.0.1:3012/
|
||||
ProxyPassReverse / http://127.0.0.1:3012/
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/gitea-error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/gitea-access.log combined
|
||||
</VirtualHost>
|
||||
</IfModule>
|
||||
|
||||
# ============ AList ============
|
||||
<VirtualHost *:80>
|
||||
ServerName alist.jiao77.cn
|
||||
RewriteEngine On
|
||||
RewriteRule ^/(.*)$ https://alist.jiao77.cn/$1 [R=301,L]
|
||||
</VirtualHost>
|
||||
|
||||
<IfModule mod_ssl.c>
|
||||
<VirtualHost *:443>
|
||||
ServerName alist.jiao77.cn
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/ssl/jiao77/cert.pem
|
||||
SSLCertificateKeyFile /etc/ssl/jiao77/key.pem
|
||||
SSLCertificateChainFile /etc/ssl/jiao77/chain.pem
|
||||
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
# 如果 AList 后端是 HTTPS（如 52443），保持 https 代理；若是 http，改为 http://127.0.0.1:<port>
|
||||
ProxyPass / https://127.0.0.1:52443/
|
||||
ProxyPassReverse / https://127.0.0.1:52443/
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/alist-error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/alist-access.log combined
|
||||
</VirtualHost>
|
||||
</IfModule>
|
||||
|
||||
# ============ Q-Nas ============
|
||||
<VirtualHost *:80>
|
||||
ServerName qnas.jiao77.cn
|
||||
RewriteEngine On
|
||||
RewriteRule ^/(.*)$ https://qnas.jiao77.cn/$1 [R=301,L]
|
||||
</VirtualHost>
|
||||
|
||||
<IfModule mod_ssl.c>
|
||||
<VirtualHost *:443>
|
||||
ServerName qnas.jiao77.cn
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/ssl/jiao77/cert.pem
|
||||
SSLCertificateKeyFile /etc/ssl/jiao77/key.pem
|
||||
SSLCertificateChainFile /etc/ssl/jiao77/chain.pem
|
||||
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
|
||||
ProxyPass / http://127.0.0.1:5666/
|
||||
ProxyPassReverse / http://127.0.0.1:5666/
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/qnas-error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/qnas-access.log combined
|
||||
</VirtualHost>
|
||||
</IfModule>
|
||||
|
||||
# ============ nuc-Nas ============
|
||||
<VirtualHost *:80>
|
||||
ServerName nucnas.jiao77.cn
|
||||
RewriteEngine On
|
||||
RewriteRule ^/(.*)$ https://nucnas.jiao77.cn/$1 [R=301,L]
|
||||
</VirtualHost>
|
||||
|
||||
<IfModule mod_ssl.c>
|
||||
<VirtualHost *:443>
|
||||
ServerName nucnas.jiao77.cn
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/ssl/jiao77/cert.pem
|
||||
SSLCertificateKeyFile /etc/ssl/jiao77/key.pem
|
||||
SSLCertificateChainFile /etc/ssl/jiao77/chain.pem
|
||||
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
|
||||
ProxyPass / http://127.0.0.1:56661/
|
||||
ProxyPassReverse / http://127.0.0.1:56661/
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/nucnas-error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/nucnas-access.log combined
|
||||
</VirtualHost>
|
||||
</IfModule>
|
||||
|
||||
# ============ RAGflow ============
|
||||
<VirtualHost *:80>
|
||||
ServerName ragflow.jiao77.cn
|
||||
RewriteEngine On
|
||||
RewriteRule ^/(.*)$ https://ragflow.jiao77.cn/$1 [R=301,L]
|
||||
</VirtualHost>
|
||||
|
||||
<IfModule mod_ssl.c>
|
||||
<VirtualHost *:443>
|
||||
ServerName ragflow.jiao77.cn
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/ssl/jiao77/cert.pem
|
||||
SSLCertificateKeyFile /etc/ssl/jiao77/key.pem
|
||||
SSLCertificateChainFile /etc/ssl/jiao77/chain.pem
|
||||
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
|
||||
ProxyPass / http://127.0.0.1:28081/
|
||||
ProxyPassReverse / http://127.0.0.1:28081/
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/ragflow-error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/ragflow-access.log combined
|
||||
</VirtualHost>
|
||||
</IfModule>
|
||||
|
||||
# ============ Open WebUI ============
|
||||
<VirtualHost *:80>
|
||||
ServerName ai.jiao77.cn
|
||||
RewriteEngine On
|
||||
RewriteRule ^/(.*)$ https://ai.jiao77.cn/$1 [R=301,L]
|
||||
</VirtualHost>
|
||||
|
||||
<IfModule mod_ssl.c>
|
||||
<VirtualHost *:443>
|
||||
ServerName ai.jiao77.cn
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/ssl/jiao77/cert.pem
|
||||
SSLCertificateKeyFile /etc/ssl/jiao77/key.pem
|
||||
SSLCertificateChainFile /etc/ssl/jiao77/chain.pem
|
||||
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
|
||||
ProxyPass / http://127.0.0.1:38080/
|
||||
ProxyPassReverse / http://127.0.0.1:38080/
|
||||
# 常见 WebSocket 路径（按需调整）
|
||||
ProxyPass /ws ws://127.0.0.1:38080/ws
|
||||
ProxyPassReverse /ws ws://127.0.0.1:38080/ws
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/ai-error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/ai-access.log combined
|
||||
</VirtualHost>
|
||||
</IfModule>
|
||||
|
||||
# ============ Navidrome ============
|
||||
<VirtualHost *:80>
|
||||
ServerName music.jiao77.cn
|
||||
RewriteEngine On
|
||||
RewriteRule ^/(.*)$ https://music.jiao77.cn/$1 [R=301,L]
|
||||
</VirtualHost>
|
||||
|
||||
<IfModule mod_ssl.c>
|
||||
<VirtualHost *:443>
|
||||
ServerName music.jiao77.cn
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/ssl/jiao77/cert.pem
|
||||
SSLCertificateKeyFile /etc/ssl/jiao77/key.pem
|
||||
SSLCertificateChainFile /etc/ssl/jiao77/chain.pem
|
||||
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
|
||||
ProxyPass / http://127.0.0.1:45332/
|
||||
ProxyPassReverse / http://127.0.0.1:45332/
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/music-error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/music-access.log combined
|
||||
</VirtualHost>
|
||||
</IfModule>
|
||||
|
||||
# ============ 缓存配置 ============
|
||||
<IfModule mod_cache.c>
|
||||
CacheRoot /var/cache/apache2/jiao77
|
||||
CacheDirLevels 2
|
||||
CacheDirLength 1
|
||||
CacheMaxFileSize 10000000
|
||||
CacheMinFileSize 1
|
||||
CacheReadSize 0
|
||||
CacheReadTime 3000
|
||||
</IfModule>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user