96 lines
4.7 KiB
Plaintext
96 lines
4.7 KiB
Plaintext
# zcbot nginx 反代示例(蓝绿双实例,RUN.md §无感更新 B 档)。
|
||
#
|
||
# 端口约定:nginx 接管原单实例的对外端口 8765(客户端 / platform 嵌入 URL 不用改),
|
||
# 实例挪到本机 8766(blue)/ 8767(green)。装 nginx 前先停旧单实例服务释放 8765。
|
||
#
|
||
# 安装(一次性):
|
||
# sudo cp deploy/nginx/zcbot.conf.example /etc/nginx/conf.d/zcbot.conf # 按需改 server_name/TLS
|
||
# echo 'server 127.0.0.1:8766;' | sudo tee /etc/nginx/zcbot_upstream.conf # 初始指 blue
|
||
# sudo nginx -t && sudo systemctl reload nginx
|
||
#
|
||
# 之后 zcbot_upstream.conf 由 deploy/update_bluegreen.sh 改写 + reload nginx 切流量,
|
||
# 本文件不再动。nginx reload 对已建立连接零影响:旧 SSE 留在旧实例自然收尾,新请求走新实例。
|
||
|
||
upstream zcbot_backend {
|
||
# 只含一行 server 127.0.0.1:8766|8767;由 update_bluegreen.sh 维护
|
||
include /etc/nginx/zcbot_upstream.conf;
|
||
keepalive 32;
|
||
}
|
||
|
||
server {
|
||
# 对外沿用原单实例端口,客户端无感
|
||
listen 8765;
|
||
server_name _;
|
||
|
||
# ── 上 TLS 时:上面 listen 换成下面这段(同端口只能一条 listen,ssl 与明文不能并存)──
|
||
# listen 8765 ssl;
|
||
# server_name bot.example.com;
|
||
# ssl_certificate /path/to/fullchain.pem;
|
||
# ssl_certificate_key /path/to/privkey.pem;
|
||
# # 明文 HTTP 打到 ssl 端口 → nginx 报 497,借它跳 https。
|
||
# # 注意 `if ($scheme = http)` 在 ssl-only 端口永远不触发(握手层就 497 了),别用。
|
||
# # 跳转目标写死域名而非 $host:用户敲 http://IP 进来也被带回域名,不撞证书警告
|
||
# # (https://IP 直连的警告 nginx 层无解 —— TLS 握手先于跳转,入口统一用域名)。
|
||
# # 用 308 不用 301:301 会让多数 HTTP 客户端把 POST 降级成 GET 重发(API 调用
|
||
# # 变 405),308 保留方法和 body;浏览器行为不变。API 调用方仍应直配 https ——
|
||
# # 明文首跳会把 platform_key/JWT 暴露在网络上,重定向救不了已发出的那次。
|
||
# error_page 497 =308 https://bot.example.com:8765$request_uri;
|
||
# # 企业微信回调 / OAuth 可信域名只认 80/443 标准端口 —— 要用企微入站/扫码登录,
|
||
# # 另加一个 listen 443 ssl 的 server 块同样 proxy 到 zcbot_backend。
|
||
|
||
# 上传接口(/v1/files/upload)会传大文件;与后端无硬限制,给足余量
|
||
client_max_body_size 512m;
|
||
|
||
# ★ WebSocket(流式语音转写):必须透传 Upgrade/Connection 握手头,否则前端
|
||
# 连不上 WS、自动退回整段 POST 兜底(功能不坏但没了实时字幕 + 松手秒出)。
|
||
# 单独 location 精确匹配,不影响主 location 的 keepalive(Connection "")。
|
||
location = /v1/asr/stream {
|
||
proxy_pass http://zcbot_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_buffering off;
|
||
proxy_read_timeout 300s; # 单次录音 ≤60s + 余量;别沿用 3600 占着连接
|
||
proxy_send_timeout 300s;
|
||
}
|
||
|
||
# ★ Windows Node 长连接:注册走普通 POST,注册后的节点控制通道走 WebSocket。
|
||
# 必须独立于下面会清空 Connection 头的默认 location；15s 应用心跳保持链路活跃。
|
||
location = /v1/compute/nodes/connect {
|
||
proxy_pass http://zcbot_backend;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_buffering off;
|
||
proxy_read_timeout 3600s;
|
||
proxy_send_timeout 3600s;
|
||
}
|
||
|
||
location / {
|
||
proxy_pass http://zcbot_backend;
|
||
proxy_http_version 1.1;
|
||
# keepalive upstream 需要清掉 Connection 头
|
||
proxy_set_header Connection "";
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
|
||
# ★ SSE(GET /v1/tasks/{id}/events):关 buffering、拉长 read 超时。
|
||
# 后端响应头已带 X-Accel-Buffering: no(对 proxy_buffering 同效),这里显式
|
||
# 再关一层作双保险;30s 服务端 ping 心跳 < read_timeout,长连接不会被掐。
|
||
proxy_buffering off;
|
||
proxy_cache off;
|
||
proxy_read_timeout 3600s;
|
||
proxy_send_timeout 3600s;
|
||
}
|
||
}
|