xiaoxia-saas/deploy/configs/host-nginx-cms-staging.conf

# Host nginx config for staging server: /etc/nginx/sites-available/05-xiaoxia-cms
# Xiaoxia CMS - cms.xiaoxiajianji.com
# 
# 注意：此文件是宿主机 nginx 配置的备份/参考，不是 Docker 容器内的 nginx。
# Docker 容器内的 nginx 配置见 nginx-staging.conf。
#
# GPU relay 路由说明：
# P4000 编码完成后通过 http://100.69.73.60:8092/api/v1/internal/gpu-relay/{key} PUT 上传
# Worker 容器通过 http://xiaoxia-api-staging:8000/api/v1/internal/gpu-relay/{key} GET 下载
# 8092 端口由 CMS 宿主机 nginx 承载，GPU relay 路由通过最长前缀匹配优先代理到 staging API (8000)

# 80 端口：ACME 验证 + 重定向到 HTTPS
server {
    listen 80;
    server_name cms.xiaoxiajianji.com;

    # Let's Encrypt ACME 验证
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# 443 端口：CMS 主站
server {
    listen 443 ssl http2;
    server_name cms.xiaoxiajianji.com;

    ssl_certificate /etc/letsencrypt/live/cms.xiaoxiajianji.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cms.xiaoxiajianji.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    client_max_body_size 50m;

    # Security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    root /data/www/cms/current;
    index index.html;

    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
    gzip_min_length 1024;

    location / {
        try_files $uri $uri/ /index.html;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:8091/api/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location = /health {
        proxy_pass http://127.0.0.1:8091/health;
    }
}

# 临时访问：8092 端口（IP直接访问，后续可关闭）
server {
    listen 8092;
    server_name _;

    root /data/www/cms/current;
    index index.html;

    client_max_body_size 50m;

    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
    gzip_min_length 1024;

    location / {
        try_files $uri $uri/ /index.html;
    }

    # GPU relay endpoints - proxy to staging API (port 8000) instead of CMS
    # 此 location 必须在 location /api/ 之前，利用 nginx 最长前缀匹配优先路由
    location /api/v1/internal/gpu-relay/ {
        proxy_pass http://127.0.0.1:8000/api/v1/internal/gpu-relay/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_request_buffering off;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:8091/api/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location = /health {
        proxy_pass http://127.0.0.1:8091/health;
    }
}