renjianbo
beff3fac8d
- Fix delete agent 500: clean up FK records (agent_llm_logs, permissions, schedules, executions, team_members) and unbind goals/tasks before delete - Remove hardcoded personality templates in Android, replace with dynamic system prompt generation from name + description - Set promptSectionsEnabled=false to bypass PromptComposer for personality - Add Tencent Cloud Linux deployment guide (Docker Compose) - Accumulated backend service updates, frontend UI fixes, Android app changes Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
117 lines
4.1 KiB
Nginx Configuration File
117 lines
4.1 KiB
Nginx Configuration File
# HTTP → HTTPS 重定向
|
|
server {
|
|
listen 80;
|
|
server_name localhost;
|
|
|
|
# 仅用于健康检查
|
|
location /health {
|
|
return 200 "OK";
|
|
}
|
|
|
|
# 其他全部重定向到 HTTPS
|
|
location / {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|
|
|
|
# HTTPS 主配置
|
|
server {
|
|
listen 443 ssl http2;
|
|
server_name localhost;
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# ─── SSL 配置 ────────────────────────────────────────
|
|
ssl_certificate /etc/nginx/certs/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/privkey.pem;
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_tickets off;
|
|
|
|
# 仅启用 TLS 1.2 / 1.3
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
|
|
# 强密码套件
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
# ─── 安全头 ─────────────────────────────────────────
|
|
# HSTS (max-age=1 year, includeSubDomains)
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
# 防点击劫持
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
|
|
# MIME 类型嗅探防护
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
# XSS 过滤器
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
|
|
# Referrer Policy
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
# Permissions Policy (限制敏感 API)
|
|
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
|
|
|
# Content-Security-Policy
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https: wss:; frame-ancestors 'self'" always;
|
|
|
|
# 隐藏 Nginx 版本
|
|
server_tokens off;
|
|
|
|
# 请求体大小限制（防大 payload 攻击）
|
|
client_max_body_size 20m;
|
|
client_body_timeout 60s;
|
|
client_header_timeout 30s;
|
|
|
|
# ─── 前端静态资源 ───────────────────────────────────
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
# ─── API 代理 ───────────────────────────────────────
|
|
location /api/ {
|
|
proxy_pass http://backend:8037;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 300s;
|
|
proxy_connect_timeout 60s;
|
|
|
|
# 隐藏后端版本信息
|
|
proxy_hide_header X-Powered-By;
|
|
proxy_hide_header Server;
|
|
}
|
|
|
|
# ─── WebSocket 代理 ─────────────────────────────────
|
|
location /ws/ {
|
|
proxy_pass http://backend:8037;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# ─── 健康检查 ───────────────────────────────────────
|
|
location /health {
|
|
return 200 "OK";
|
|
}
|
|
|
|
# ─── 屏蔽敏感文件 ──────────────────────────────────
|
|
location ~ /\. {
|
|
deny all;
|
|
access_log off;
|
|
log_not_found off;
|
|
}
|
|
location ~* \.(env|ini|yml|yaml|sql|md|bak|backup|old)$ {
|
|
deny all;
|
|
access_log off;
|
|
log_not_found off;
|
|
}
|
|
}
|