easyai/easyai-proxy.conf.sample

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# $host 会丢失客户端 authority 中的显式端口；后端公开 URL 推断需保留 $http_host。
map $http_host $easyai_forwarded_host {
    default $http_host;
    ''      $host;
}

# www 域名重定向，使用二级域名注释掉此部分的域名重定向
server {
    listen 80;
    listen [::]:80;
    server_name www.51easyai.com;

    # 添加 HSTS 策略
#     add_header Strict-Transport-Security "max-age=31536000" always;

   # ssl 版本控制
    ssl_protocols TLSv1.2 TLSv1.3;  # 只启用 TLS 1.2 和 TLS 1.3

    # 用于 certbot 验证的配置
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
        try_files $uri =404;
    }

    # 更严格的重定向规则
    location / {
        return 301 https://51easyai.com$request_uri;
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name 51easyai.com;

    # EasyAI response gzip: compress JSON/text API responses; SSE/WebSocket stay uncompressed by content type.
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_comp_level 4;
    gzip_proxied any;
    gzip_types
        application/json
        application/javascript
        application/xml
        text/css
        text/plain
        text/xml
        image/svg+xml;

       # ssl 版本控制
        ssl_protocols TLSv1.2 TLSv1.3;  # 只启用 TLS 1.2 和 TLS 1.3
        # 通用安全头部
        add_header X-Content-Type-Options nosniff;
        # add_header X-Frame-Options "SAMEORIGIN";
        add_header X-XSS-Protection "1; mode=block";
    # 用于 certbot 验证的配置
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
        try_files $uri =404;
    }

        # 专门处理企业微信验证文件的请求
#         location = /WW_verify_9eWb5ozYfqE0Bb2i.txt {
#             default_type text/plain;  # 设置正确的Content-Type
#             return 200 '9eWb5ozYfqE0Bb2i';  # 直接返回验证内容
#         }

    location / {
        proxy_pass http://127.0.0.1:3010/;
        proxy_redirect off;  # 修改重定向处理
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;

        # 如果 X-Frame-Options 是上游返回的，隐藏它
        proxy_hide_header X-Frame-Options;

        # Wujie 会 fetch HTML，必须允许跨源读取
        add_header Access-Control-Allow-Origin "*" always;
        add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Accept, Authorization" always;
        add_header Cross-Origin-Resource-Policy "cross-origin" always;
    }

    # 规范化 API 根路径，确保 https://example.com/api 不会落到前端 location /。
    location = /api {
        return 308 /api/;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:3001/;
        proxy_read_timeout 1200s;  # 您已设置，适合长连接
        client_max_body_size 100M;
        proxy_redirect off;

        # --- SSE 关键配置开始 ---
        proxy_buffering off;            # 必须：关闭代理缓冲，数据会立即从后端发送到客户端
        proxy_cache off;                # 必须：禁用缓存，SSE是动态内容
        proxy_set_header Connection ''; # 清除 Connection header，有助于保持长连接
        proxy_http_version 1.1;         # 推荐使用 HTTP/1.1
        proxy_set_header Accept-Encoding ''; # 可选：防止上游压缩导致缓冲，如果后端有gzip等压缩，可能会影响流式输出
        # --- SSE 关键配置结束 ---
        proxy_set_header X-Original-Prefix '/api';
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $easyai_forwarded_host;
        proxy_set_header X-Forwarded-Host $easyai_forwarded_host;
        proxy_set_header X-Forwarded-Port $server_port;
    }

    location /asg-api/ {
        proxy_pass http://127.0.0.1:3003/;
        proxy_read_timeout 300s;
        client_max_body_size 20M;
        proxy_redirect off;
        proxy_set_header X-Original-Prefix '/asg-api';
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    # Agent 记忆服务 API（可选，用于健康检查或外部调用）
    location /ams-api/ {
        proxy_pass http://127.0.0.1:3004/;
        proxy_read_timeout 300s;
        client_max_body_size 20M;
        proxy_redirect off;
        proxy_set_header X-Original-Prefix '/ams-api';
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    location /plugins/ {
        proxy_pass http://127.0.0.1:3020/plugins/;
        proxy_redirect off;
        proxy_set_header X-Original-Prefix '/plugins';
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }
    location /logs-web/ {
        proxy_pass http://127.0.0.1:8080/logs-web/;
        proxy_redirect off;
        proxy_set_header X-Original-Prefix '/logs-web';
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }
    location /jupyterlab/ {
        proxy_pass http://127.0.0.1:8888/lab/;
        proxy_redirect off;
        proxy_set_header X-Original-Prefix '/lab';
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }
    location /socket.io {
        proxy_pass http://127.0.0.1:3002;
        proxy_read_timeout 300s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_buffering off;  # 对于 WebSocket 连接禁用缓冲
    }
    #  转发/mcp/messages 消息到3001
    location /mcp {
        proxy_pass http://127.0.0.1:3001/mcp;
        proxy_read_timeout 300s;
        proxy_set_header Host $easyai_forwarded_host;
        proxy_set_header X-Forwarded-Host $easyai_forwarded_host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_buffering off;  # 对于 WebSocket 连接禁用缓冲
    }

    # 沙箱环境 API（脚本执行、下载、安装依赖等），需在 docker-compose 中取消 SANDBOX_PORT 映射
    location /sandbox/ {
        proxy_pass http://127.0.0.1:8081/;
        proxy_read_timeout 300s;
        client_max_body_size 50M;
        proxy_redirect off;
        proxy_set_header X-Original-Prefix '/sandbox';
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

}