refactor: extract nginx to standalone nginx-gateway deployment
- Remove coze-web service from docker-compose.yml
- Replace nginx second stage in frontend/Dockerfile with alpine dist-only stage
- Add nginx-gateway/ with standalone nginx container deployment
- docker-compose.yml joining both coze-network and kong-net
- Split nginx configs into 6 per-domain files:
- 00-upstreams.conf (shared upstreams)
- 10-default-server.conf (catch-all 444)
- 20-coze.conf (coze studio)
- 30-kong-api.conf (kong ai gateway)
- 40-admin-portal.conf (admin portal)
- 50-grafana.conf (grafana dashboard)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -436,28 +436,6 @@ services:
|
||||
condition: service_healthy
|
||||
command: ['/app/opencoze']
|
||||
|
||||
coze-web:
|
||||
# build:
|
||||
# context: ..
|
||||
# dockerfile: frontend/Dockerfile
|
||||
image: cozedev/coze-studio-web:latest
|
||||
container_name: coze-web
|
||||
restart: always
|
||||
ports:
|
||||
- "8888:80"
|
||||
- "443:443" # SSL port (uncomment if using SSL)
|
||||
volumes:
|
||||
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro # Main nginx config
|
||||
- ./nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf:ro # Proxy config
|
||||
- ./nginx/ssl:/etc/nginx/ssl:ro # SSL certificates (uncomment if using SSL)
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
depends_on:
|
||||
- coze-server
|
||||
- minio
|
||||
networks:
|
||||
- coze-network
|
||||
|
||||
networks:
|
||||
coze-network:
|
||||
external: true
|
||||
|
||||
+4
-16
@@ -36,19 +36,7 @@ RUN chmod +x scripts/hooks/post-rush-install.sh && rm -rf /app/common/temp && ru
|
||||
# Use rush build to build the specific project
|
||||
RUN rush build --to @coze-studio/app
|
||||
|
||||
# Production image stage
|
||||
FROM nginx:1.25-alpine
|
||||
|
||||
|
||||
# if you located in China, you can use aliyun mirror to speed up
|
||||
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
|
||||
# Install necessary tools for SSL configuration
|
||||
RUN apk add --no-cache bash
|
||||
|
||||
# Copy build artifacts to nginx static directory
|
||||
COPY --from=builder /app/frontend/apps/coze-studio/dist /usr/share/nginx/html
|
||||
|
||||
EXPOSE 8888
|
||||
|
||||
# Start nginx
|
||||
CMD ["nginx", "-g", "daemon off;"]
|
||||
# Dist-only stage: 镜像仅用于提取构建产物，不运行任何服务
|
||||
FROM alpine:latest
|
||||
WORKDIR /app
|
||||
COPY --from=builder /app/frontend/apps/coze-studio/dist /app/dist
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
# ============================================================
|
||||
# 上游定义 - 所有反向代理目标集中在此
|
||||
# ============================================================
|
||||
|
||||
# --- Coze 业务后端 (coze-network) ---
|
||||
upstream coze_backend {
|
||||
server coze-server:8888;
|
||||
keepalive 16;
|
||||
}
|
||||
|
||||
upstream coze_minio {
|
||||
server coze-minio:9000;
|
||||
keepalive 16;
|
||||
}
|
||||
|
||||
# --- Kong AI Gateway 相关 (kong-ai-gateway-prod_kong-net) ---
|
||||
upstream kong_proxy {
|
||||
server kong:8000;
|
||||
keepalive 32;
|
||||
}
|
||||
|
||||
upstream admin_portal {
|
||||
server admin-portal:8080;
|
||||
keepalive 4;
|
||||
}
|
||||
|
||||
upstream grafana_ui {
|
||||
server grafana:3000;
|
||||
keepalive 4;
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
# ============================================================
|
||||
# 默认 server - 拒绝未知 host 的请求
|
||||
# 必须存在，否则未匹配的请求会落到「按文件顺序的第一个 server 块」，
|
||||
# 引发「全部变成 XX 服务」的故障
|
||||
# ============================================================
|
||||
|
||||
# HTTP 80 默认：直接拒绝
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
server_name _;
|
||||
return 444;
|
||||
}
|
||||
|
||||
# HTTPS 443 默认：直接拒绝
|
||||
server {
|
||||
listen 443 ssl http2 default_server;
|
||||
listen [::]:443 ssl http2 default_server;
|
||||
server_name _;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/_.kejiankejian.com_chain.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/_.kejiankejian.com_key.key;
|
||||
|
||||
return 444;
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
# ============================================================
|
||||
# Coze Studio
|
||||
# 域名: testcoze.kejiankejian.com / coze-testcoze.kejiankejian.com
|
||||
# ============================================================
|
||||
|
||||
# HTTP -> HTTPS
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name testcoze.kejiankejian.com coze-testcoze.kejiankejian.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# HTTPS
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name testcoze.kejiankejian.com coze-testcoze.kejiankejian.com;
|
||||
|
||||
client_max_body_size 100M;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/_.kejiankejian.com_chain.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/_.kejiankejian.com_key.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 10m;
|
||||
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256;
|
||||
|
||||
access_log /dev/stdout;
|
||||
error_log /dev/stderr;
|
||||
|
||||
# 前端静态资源
|
||||
location / {
|
||||
root /usr/share/nginx/html;
|
||||
try_files $uri $uri/ /index.html;
|
||||
index index.html index.htm;
|
||||
add_header Cache-Control "public, max-age=3600" always;
|
||||
}
|
||||
|
||||
# 后端 API
|
||||
location ~ ^/(api|v[1-3]|admin)(/|$) {
|
||||
proxy_pass http://coze_backend;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 600s;
|
||||
|
||||
sub_filter ':8889' ':8888/local_storage';
|
||||
sub_filter 'minio:9000' '$http_host/local_storage';
|
||||
sub_filter_once off;
|
||||
sub_filter_types 'application/json' 'text/event-stream';
|
||||
}
|
||||
|
||||
# MinIO 文件代理
|
||||
location /local_storage/ {
|
||||
rewrite ^/local_storage/(.*)$ /$1 break;
|
||||
proxy_pass http://coze_minio;
|
||||
proxy_set_header Host coze-minio:9000;
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 600s;
|
||||
|
||||
add_header Access-Control-Allow-Origin "*" always;
|
||||
add_header Access-Control-Allow-Credentials "true" always;
|
||||
add_header Access-Control-Allow-Methods "*" always;
|
||||
add_header Access-Control-Allow-Headers "*" always;
|
||||
if ($request_method = 'OPTIONS') {
|
||||
return 204;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,52 @@
|
||||
# ============================================================
|
||||
# Kong AI Gateway - 对外 API
|
||||
# 域名: api.kejiankejian.com
|
||||
# ============================================================
|
||||
|
||||
# HTTP -> HTTPS
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name api.kejiankejian.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# HTTPS
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name api.kejiankejian.com;
|
||||
|
||||
client_max_body_size 50m;
|
||||
client_body_buffer_size 10m;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/_.kejiankejian.com_chain.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/_.kejiankejian.com_key.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=63072000" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
|
||||
access_log /dev/stdout;
|
||||
error_log /dev/stderr;
|
||||
|
||||
location / {
|
||||
proxy_pass http://kong_proxy;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Connection "";
|
||||
|
||||
# SSE / 流式响应
|
||||
proxy_buffering off;
|
||||
proxy_cache off;
|
||||
proxy_read_timeout 300s;
|
||||
proxy_send_timeout 300s;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
# ============================================================
|
||||
# Admin Portal - 管理后台
|
||||
# 域名: admin.kejiankejian.com
|
||||
# ============================================================
|
||||
|
||||
# HTTP -> HTTPS
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name admin.kejiankejian.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# HTTPS
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name admin.kejiankejian.com;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/_.kejiankejian.com_chain.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/_.kejiankejian.com_key.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
|
||||
# IP 白名单 (生产建议开启)
|
||||
# allow 10.0.0.0/8;
|
||||
# allow 172.16.0.0/12;
|
||||
# allow 192.168.0.0/16;
|
||||
# deny all;
|
||||
|
||||
access_log /dev/stdout;
|
||||
error_log /dev/stderr;
|
||||
|
||||
location / {
|
||||
proxy_pass http://admin_portal;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
# ============================================================
|
||||
# Grafana - 观测仪表盘
|
||||
# 域名: grafana.kejiankejian.com
|
||||
# ============================================================
|
||||
|
||||
# HTTP -> HTTPS
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name grafana.kejiankejian.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# HTTPS
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name grafana.kejiankejian.com;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/_.kejiankejian.com_chain.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/_.kejiankejian.com_key.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
|
||||
# IP 白名单 (生产建议开启)
|
||||
# allow 10.0.0.0/8;
|
||||
# allow 172.16.0.0/12;
|
||||
# allow 192.168.0.0/16;
|
||||
# deny all;
|
||||
|
||||
# 原配置启用了 auth_basic, 但容器内没挂载 .htpasswd, 会 500
|
||||
# 如需开启:
|
||||
# 1) 在 nginx-gateway/ 下生成 .htpasswd
|
||||
# 2) 在此 compose volumes 加挂: - ./.htpasswd:/etc/nginx/.htpasswd:ro
|
||||
# 3) 取消下方注释
|
||||
# auth_basic "Grafana";
|
||||
# auth_basic_user_file /etc/nginx/.htpasswd;
|
||||
|
||||
access_log /dev/stdout;
|
||||
error_log /dev/stderr;
|
||||
|
||||
location / {
|
||||
proxy_pass http://grafana_ui;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# Grafana Live (WebSocket)
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
name: nginx-gateway
|
||||
|
||||
services:
|
||||
nginx-gateway:
|
||||
image: nginx:1.25-alpine
|
||||
container_name: nginx-gateway
|
||||
restart: always
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
volumes:
|
||||
- ./nginx.conf:/etc/nginx/nginx.conf:ro
|
||||
- ./conf.d:/etc/nginx/conf.d:ro
|
||||
- ./ssl:/etc/nginx/ssl:ro
|
||||
- ./dist:/usr/share/nginx/html:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
networks:
|
||||
- coze-network
|
||||
- kong-net
|
||||
|
||||
networks:
|
||||
coze-network:
|
||||
external: true
|
||||
kong-net:
|
||||
external:
|
||||
name: kong-ai-gateway-prod_kong-net
|
||||
@@ -0,0 +1,14 @@
|
||||
worker_processes 1;
|
||||
events { worker_connections 1024; }
|
||||
|
||||
http {
|
||||
include mime.types;
|
||||
default_type application/octet-stream;
|
||||
sendfile on;
|
||||
keepalive_timeout 65;
|
||||
|
||||
# setting client request body size limit - 0 means no limit
|
||||
client_max_body_size 0;
|
||||
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
}
|
||||
Reference in New Issue
Block a user