fix(deploy): 默认关闭沙箱公网访问

easyai-proxy.conf.sample

@@ -95,6 +95,15 @@ server {
         return 308 /api/;
     }
 
+    # Sandbox 只能由 easyai-server 通过 Docker 内网访问，禁止从公网 API 入口绕过。
+    location = /api/sandbox {
+        return 404;
+    }
+
+    location ^~ /api/sandbox/ {
+        return 404;
+    }
+
     location /api/ {
         proxy_pass http://127.0.0.1:3001/;
         proxy_read_timeout 1200s;  # 您已设置，适合长连接
@@ -160,14 +169,12 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header Host $host;
     }
-    location /jupyterlab/ {
-        proxy_pass http://127.0.0.1:8888/lab/;
-        proxy_redirect off;
-        proxy_set_header X-Original-Prefix '/lab';
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Host $host;
+    location = /jupyterlab {
+        return 404;
+    }
+
+    location ^~ /jupyterlab/ {
+        return 404;
     }
     location /socket.io {
         proxy_pass http://127.0.0.1:3002;
@@ -197,17 +204,12 @@ server {
         proxy_buffering off;  # 对于 WebSocket 连接禁用缓冲
     }
 
-    # 沙箱环境 API（脚本执行、下载、安装依赖等），需在 docker-compose 中取消 SANDBOX_PORT 映射
-    location /sandbox/ {
-        proxy_pass http://127.0.0.1:8081/;
-        proxy_read_timeout 300s;
-        client_max_body_size 50M;
-        proxy_redirect off;
-        proxy_set_header X-Original-Prefix '/sandbox';
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Host $host;
+    location = /sandbox {
+        return 404;
+    }
+
+    location ^~ /sandbox/ {
+        return 404;
     }
 
 }