refactor: extract nginx to standalone nginx-gateway deployment

- Remove coze-web service from docker-compose.yml
- Replace nginx second stage in frontend/Dockerfile with alpine dist-only stage
- Add nginx-gateway/ with standalone nginx container deployment
  - docker-compose.yml joining both coze-network and kong-net
  - Split nginx configs into 6 per-domain files:
    - 00-upstreams.conf (shared upstreams)
    - 10-default-server.conf (catch-all 444)
    - 20-coze.conf (coze studio)
    - 30-kong-api.conf (kong ai gateway)
    - 40-admin-portal.conf (admin portal)
    - 50-grafana.conf (grafana dashboard)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker/docker-compose.yml

@@ -436,28 +436,6 @@ services:
         condition: service_healthy
     command: ['/app/opencoze']
 
-  coze-web:
-    # build:
-    #   context: ..
-    #   dockerfile: frontend/Dockerfile
-    image: cozedev/coze-studio-web:latest
-    container_name: coze-web
-    restart: always
-    ports:
-      - "8888:80"
-      - "443:443"  # SSL port (uncomment if using SSL)
-    volumes:
-      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro  # Main nginx config
-      - ./nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf:ro  # Proxy config
-      - ./nginx/ssl:/etc/nginx/ssl:ro  # SSL certificates (uncomment if using SSL)
-      - /etc/localtime:/etc/localtime:ro
-      - /etc/timezone:/etc/timezone:ro
-    depends_on:
-      - coze-server
-      - minio
-    networks:
-      - coze-network
-
 networks:
   coze-network:
     external: true

frontend/Dockerfile

@@ -36,19 +36,7 @@ RUN chmod +x scripts/hooks/post-rush-install.sh && rm -rf /app/common/temp && ru
 # Use rush build to build the specific project
 RUN rush build --to @coze-studio/app
 
-# Production image stage
-FROM nginx:1.25-alpine
-
-
-# if you located in China, you can use aliyun mirror to speed up
-RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
-# Install necessary tools for SSL configuration
-RUN apk add --no-cache bash
-
-# Copy build artifacts to nginx static directory
-COPY --from=builder /app/frontend/apps/coze-studio/dist /usr/share/nginx/html
-
-EXPOSE 8888
-
-# Start nginx
-CMD ["nginx", "-g", "daemon off;"]
+# Dist-only stage: 镜像仅用于提取构建产物，不运行任何服务
+FROM alpine:latest
+WORKDIR /app
+COPY --from=builder /app/frontend/apps/coze-studio/dist /app/dist

nginx-gateway/conf.d/00-upstreams.conf

@@ -0,0 +1,30 @@
+# ============================================================
+# 上游定义 - 所有反向代理目标集中在此
+# ============================================================
+
+# --- Coze 业务后端 (coze-network) ---
+upstream coze_backend {
+    server coze-server:8888;
+    keepalive 16;
+}
+
+upstream coze_minio {
+    server coze-minio:9000;
+    keepalive 16;
+}
+
+# --- Kong AI Gateway 相关 (kong-ai-gateway-prod_kong-net) ---
+upstream kong_proxy {
+    server kong:8000;
+    keepalive 32;
+}
+
+upstream admin_portal {
+    server admin-portal:8080;
+    keepalive 4;
+}
+
+upstream grafana_ui {
+    server grafana:3000;
+    keepalive 4;
+}

nginx-gateway/conf.d/10-default-server.conf

@@ -0,0 +1,25 @@
+# ============================================================
+# 默认 server - 拒绝未知 host 的请求
+# 必须存在，否则未匹配的请求会落到「按文件顺序的第一个 server 块」，
+# 引发「全部变成 XX 服务」的故障
+# ============================================================
+
+# HTTP 80 默认：直接拒绝
+server {
+    listen      80 default_server;
+    listen      [::]:80 default_server;
+    server_name _;
+    return      444;
+}
+
+# HTTPS 443 默认：直接拒绝
+server {
+    listen      443 ssl http2 default_server;
+    listen      [::]:443 ssl http2 default_server;
+    server_name _;
+
+    ssl_certificate     /etc/nginx/ssl/_.kejiankejian.com_chain.pem;
+    ssl_certificate_key /etc/nginx/ssl/_.kejiankejian.com_key.key;
+
+    return 444;
+}

nginx-gateway/conf.d/20-coze.conf

@@ -0,0 +1,76 @@
+# ============================================================
+# Coze Studio
+# 域名: testcoze.kejiankejian.com / coze-testcoze.kejiankejian.com
+# ============================================================
+
+# HTTP -> HTTPS
+server {
+    listen      80;
+    listen      [::]:80;
+    server_name testcoze.kejiankejian.com coze-testcoze.kejiankejian.com;
+    return      301 https://$host$request_uri;
+}
+
+# HTTPS
+server {
+    listen      443 ssl http2;
+    listen      [::]:443 ssl http2;
+    server_name testcoze.kejiankejian.com coze-testcoze.kejiankejian.com;
+
+    client_max_body_size 100M;
+
+    ssl_certificate     /etc/nginx/ssl/_.kejiankejian.com_chain.pem;
+    ssl_certificate_key /etc/nginx/ssl/_.kejiankejian.com_key.key;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache   shared:SSL:10m;
+    ssl_session_timeout 10m;
+    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256;
+
+    access_log /dev/stdout;
+    error_log  /dev/stderr;
+
+    # 前端静态资源
+    location / {
+        root  /usr/share/nginx/html;
+        try_files $uri $uri/ /index.html;
+        index index.html index.htm;
+        add_header Cache-Control "public, max-age=3600" always;
+    }
+
+    # 后端 API
+    location ~ ^/(api|v[1-3]|admin)(/|$) {
+        proxy_pass http://coze_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 60s;
+        proxy_send_timeout    60s;
+        proxy_read_timeout    600s;
+
+        sub_filter ':8889'       ':8888/local_storage';
+        sub_filter 'minio:9000'  '$http_host/local_storage';
+        sub_filter_once off;
+        sub_filter_types 'application/json' 'text/event-stream';
+    }
+
+    # MinIO 文件代理
+    location /local_storage/ {
+        rewrite ^/local_storage/(.*)$ /$1 break;
+        proxy_pass http://coze_minio;
+        proxy_set_header Host coze-minio:9000;
+        proxy_connect_timeout 60s;
+        proxy_send_timeout    60s;
+        proxy_read_timeout    600s;
+
+        add_header Access-Control-Allow-Origin      "*" always;
+        add_header Access-Control-Allow-Credentials "true" always;
+        add_header Access-Control-Allow-Methods     "*" always;
+        add_header Access-Control-Allow-Headers     "*" always;
+        if ($request_method = 'OPTIONS') {
+            return 204;
+        }
+    }
+}

nginx-gateway/conf.d/30-kong-api.conf

@@ -0,0 +1,52 @@
+# ============================================================
+# Kong AI Gateway - 对外 API
+# 域名: api.kejiankejian.com
+# ============================================================
+
+# HTTP -> HTTPS
+server {
+    listen      80;
+    listen      [::]:80;
+    server_name api.kejiankejian.com;
+    return      301 https://$host$request_uri;
+}
+
+# HTTPS
+server {
+    listen      443 ssl http2;
+    listen      [::]:443 ssl http2;
+    server_name api.kejiankejian.com;
+
+    client_max_body_size    50m;
+    client_body_buffer_size 10m;
+
+    ssl_certificate     /etc/nginx/ssl/_.kejiankejian.com_chain.pem;
+    ssl_certificate_key /etc/nginx/ssl/_.kejiankejian.com_key.key;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
+    ssl_prefer_server_ciphers off;
+
+    add_header Strict-Transport-Security "max-age=63072000" always;
+    add_header X-Frame-Options           "SAMEORIGIN" always;
+    add_header X-Content-Type-Options    "nosniff" always;
+
+    access_log /dev/stdout;
+    error_log  /dev/stderr;
+
+    location / {
+        proxy_pass http://kong_proxy;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection        "";
+
+        # SSE / 流式响应
+        proxy_buffering    off;
+        proxy_cache        off;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+}

nginx-gateway/conf.d/40-admin-portal.conf

@@ -0,0 +1,41 @@
+# ============================================================
+# Admin Portal - 管理后台
+# 域名: admin.kejiankejian.com
+# ============================================================
+
+# HTTP -> HTTPS
+server {
+    listen      80;
+    listen      [::]:80;
+    server_name admin.kejiankejian.com;
+    return      301 https://$host$request_uri;
+}
+
+# HTTPS
+server {
+    listen      443 ssl http2;
+    listen      [::]:443 ssl http2;
+    server_name admin.kejiankejian.com;
+
+    ssl_certificate     /etc/nginx/ssl/_.kejiankejian.com_chain.pem;
+    ssl_certificate_key /etc/nginx/ssl/_.kejiankejian.com_key.key;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+
+    # IP 白名单 (生产建议开启)
+    # allow 10.0.0.0/8;
+    # allow 172.16.0.0/12;
+    # allow 192.168.0.0/16;
+    # deny  all;
+
+    access_log /dev/stdout;
+    error_log  /dev/stderr;
+
+    location / {
+        proxy_pass http://admin_portal;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

nginx-gateway/conf.d/50-grafana.conf

@@ -0,0 +1,53 @@
+# ============================================================
+# Grafana - 观测仪表盘
+# 域名: grafana.kejiankejian.com
+# ============================================================
+
+# HTTP -> HTTPS
+server {
+    listen      80;
+    listen      [::]:80;
+    server_name grafana.kejiankejian.com;
+    return      301 https://$host$request_uri;
+}
+
+# HTTPS
+server {
+    listen      443 ssl http2;
+    listen      [::]:443 ssl http2;
+    server_name grafana.kejiankejian.com;
+
+    ssl_certificate     /etc/nginx/ssl/_.kejiankejian.com_chain.pem;
+    ssl_certificate_key /etc/nginx/ssl/_.kejiankejian.com_key.key;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+
+    # IP 白名单 (生产建议开启)
+    # allow 10.0.0.0/8;
+    # allow 172.16.0.0/12;
+    # allow 192.168.0.0/16;
+    # deny  all;
+
+    # 原配置启用了 auth_basic, 但容器内没挂载 .htpasswd, 会 500
+    # 如需开启:
+    #   1) 在 nginx-gateway/ 下生成 .htpasswd
+    #   2) 在此 compose volumes 加挂: - ./.htpasswd:/etc/nginx/.htpasswd:ro
+    #   3) 取消下方注释
+    # auth_basic           "Grafana";
+    # auth_basic_user_file /etc/nginx/.htpasswd;
+
+    access_log /dev/stdout;
+    error_log  /dev/stderr;
+
+    location / {
+        proxy_pass http://grafana_ui;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Grafana Live (WebSocket)
+        proxy_set_header Upgrade    $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}

nginx-gateway/docker-compose.yml

@@ -0,0 +1,27 @@
+name: nginx-gateway
+
+services:
+  nginx-gateway:
+    image: nginx:1.25-alpine
+    container_name: nginx-gateway
+    restart: always
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./conf.d:/etc/nginx/conf.d:ro
+      - ./ssl:/etc/nginx/ssl:ro
+      - ./dist:/usr/share/nginx/html:ro
+      - /etc/localtime:/etc/localtime:ro
+      - /etc/timezone:/etc/timezone:ro
+    networks:
+      - coze-network
+      - kong-net
+
+networks:
+  coze-network:
+    external: true
+  kong-net:
+    external:
+      name: kong-ai-gateway-prod_kong-net

nginx-gateway/nginx.conf

@@ -0,0 +1,14 @@
+worker_processes 1;
+events { worker_connections 1024; }
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+    sendfile        on;
+    keepalive_timeout  65;
+
+    # setting client request body size limit - 0 means no limit
+    client_max_body_size 0;
+
+    include /etc/nginx/conf.d/*.conf;
+}