From 7fc3c850afa23f73315360b696bc4dfd05b75eee Mon Sep 17 00:00:00 2001
From: Xiaoxia AI <xiaoxia@localhost>
Date: Fri, 26 Jun 2026 10:41:18 +0800
Subject: [PATCH] fix(infra): pin production web API proxy to production API
 container

- Add production nginx config that proxies /api to xiaoxia-api-production
- Use production nginx config when building tagged production web artifact
- Prevent production web from resolving shared Docker alias api to staging API
---
 .gitea/workflows/deploy.yml        |  1 +
 infra/docker/nginx.production.conf | 28 ++++++++++++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 infra/docker/nginx.production.conf

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index f7939cb9c..a93ed5627 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -152,6 +152,7 @@ jobs:
           docker.m.daocloud.io/library/node:20 \
           sh -lc 'npm ci && npm run build'
         docker build --pull=false \
+          --build-arg NGINX_CONF=infra/docker/nginx.production.conf \
           -f infra/docker/web-artifact.Dockerfile \
           -t "xiaoxia-saas-web:${GITHUB_REF_NAME}" \
           .
diff --git a/infra/docker/nginx.production.conf b/infra/docker/nginx.production.conf
new file mode 100644
index 000000000..64737287f
--- /dev/null
+++ b/infra/docker/nginx.production.conf
@@ -0,0 +1,28 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml+rss;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location /api/ {
+        proxy_pass http://xiaoxia-api-production:8000/api/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+}