From 71adc35b5385f7c5bd700cbccceb3820c371e197 Mon Sep 17 00:00:00 2001
From: Pine <wwork.wss@icloud.com>
Date: Tue, 8 Sep 2026 22:47:15 +0800
Subject: [PATCH] =?UTF-8?q?nginx=EF=BC=9A=E5=8F=8D=E4=BB=A3=E4=B8=8A?=
 =?UTF-8?q?=E6=B8=B8=E6=94=B9=E4=B8=BA=E5=AE=B9=E5=99=A8=E5=90=8D=20opc-se?=
 =?UTF-8?q?rver:8090=EF=BC=8C=E4=BF=AE=E6=AD=A3=20502?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 此前注释/实际生效配置反代 47.108.226.213:8090（已废弃旧服务器 IP），
  新服务器为腾讯云 124.221.143.140，请求连到错误主机 → 502 upstream prematurely closed
- 明确前提：nginx 容器需 docker network connect opc-network 才能解析容器名
- .gitignore 排除 nginx ssl 私钥与运行日志（防止敏感信息入库）
---
 .gitignore                               |  4 ++
 nginx/nginx/conf.d/opc.pinesound.cn.conf | 56 ++++++++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 nginx/nginx/conf.d/opc.pinesound.cn.conf

diff --git a/.gitignore b/.gitignore
index 20e3370..3b1f96a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,6 +35,10 @@ serverdata/redis-data/
 serverdata/emqx-data/
 serverdata/emqx-log/
 data/users.json
+
+# nginx 部署目录：私钥与运行日志绝不入库；仅提交 conf 配置（证书链可选）
+nginx/nginx/ssl/*.key
+nginx/nginx/logs/
 data/tokens.json
 data/agents.json
 
diff --git a/nginx/nginx/conf.d/opc.pinesound.cn.conf b/nginx/nginx/conf.d/opc.pinesound.cn.conf
new file mode 100644
index 0000000..930bfd0
--- /dev/null
+++ b/nginx/nginx/conf.d/opc.pinesound.cn.conf
@@ -0,0 +1,56 @@
+# ============================================================
+# opc.pinesound.cn 反向代理 —— Docker 内网容器名反代
+#
+# 拓扑：
+#   公网 → nginx(80/443) → opc-server:8090（唯一对外入口，dispatcher）
+#         → /park、/api/*、/im/ws 等均由 opc-server 内部路由
+#
+# 前提（关键）：
+#   1. nginx 容器必须加入业务网络，才能解析容器名：
+#        docker network connect opc-network nginx
+#      （若 nginx 由 compose 管理，则在 nginx 服务下声明 networks: [opc-network]）
+#   2. 禁止再用公网 IP/宿主机回环反代（此前 47.108.226.213:8090 为已废弃旧服务器，
+#      请求连到错误主机导致 502 upstream prematurely closed）。
+# ============================================================
+
+server {
+    listen 80;
+    server_name opc.pinesound.cn;
+
+    # HTTP 强制跳转 HTTPS
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name opc.pinesound.cn;
+
+    ssl_certificate     /data/nginx/ssl/opc.pinesound.cn_bundle.crt;
+    ssl_certificate_key /data/nginx/ssl/opc.pinesound.cn.key;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+
+    client_max_body_size 100m;
+
+    access_log /var/log/nginx/opc.pinesound.cn.access.log;
+    error_log  /var/log/nginx/opc.pinesound.cn.error.log;
+
+    location / {
+        # 容器名反代：opc-server 与 nginx 同属 opc-network
+        proxy_pass http://opc-server:8090;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # WebSocket（/im/ws 等）长连接支持
+        proxy_set_header Upgrade           $http_upgrade;
+        proxy_set_header Connection        "upgrade";
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+        proxy_connect_timeout 10s;
+    }
+}