From cbedb66bff00366a953e2cf113f8e224e4c96837 Mon Sep 17 00:00:00 2001 From: tiananlin Date: Tue, 15 Sep 2026 11:31:44 +0800 Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20Dockerfiles/Dockerfile-pub?= =?UTF-8?q?lic/default.conf?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Dockerfiles/Dockerfile-public/default.conf | 34 +++++++++++++++++----- 1 file changed, 26 insertions(+), 8 deletions(-) diff --git a/Dockerfiles/Dockerfile-public/default.conf b/Dockerfiles/Dockerfile-public/default.conf index 44210dd..e07c21c 100644 --- a/Dockerfiles/Dockerfile-public/default.conf +++ b/Dockerfiles/Dockerfile-public/default.conf @@ -1,27 +1,45 @@ server { listen 80; - server_name localhost; + server_name _; client_max_body_size 100m; - root /usr/share/nginx/html; index index.html; - location / { - try_files $uri $uri/ /index.html; + add_header X-Robots-Tag "noindex, nofollow" always; + + # 公开构建中的 sw.js 只负责注销该域名历史遗留的后台 PWA。 + location = /sw.js { + add_header Cache-Control "no-store, no-cache, must-revalidate"; + try_files $uri =404; } - location /api/open/onboarding/ { + location = /index.html { + add_header Cache-Control "no-store, no-cache, must-revalidate"; + try_files $uri =404; + } + + # 员工域名只允许入职公开接口。内部后端路由不包含外层 /api。 + location ^~ /api/open/onboarding/ { proxy_pass http://onboardx-api-svc:5566/open/onboarding/; proxy_http_version 1.1; - + proxy_request_buffering off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; - proxy_connect_timeout 60s; proxy_read_timeout 300s; proxy_send_timeout 300s; } -} \ No newline at end of file + + # 公开域名拒绝系统、后台业务及其他 API。 + location ^~ /api/ { + return 404; + } + + # Hash 路由的有效链接在服务器看来也是根路径，必须返回公开版 index.html。 + location / { + try_files $uri $uri/ /index.html; + } +}