From ea90cac50cd314f19e01dd32bb850e9fcce54360 Mon Sep 17 00:00:00 2001 From: Codex Local Date: Wed, 26 Aug 2026 10:04:01 +0800 Subject: [PATCH] deploy: enable trusted HTTPS IP endpoint --- deploy/keycloak/realm-voice-local.json | 2 ++ deploy/server/README.md | 6 +++--- deploy/server/certbot-ip-renew.service | 10 ++++++++++ deploy/server/certbot-ip-renew.timer | 11 +++++++++++ deploy/server/compose.override.yaml | 4 +++- deploy/server/nginx.conf | 15 ++++++++++++++- 6 files changed, 43 insertions(+), 5 deletions(-) create mode 100644 deploy/server/certbot-ip-renew.service create mode 100644 deploy/server/certbot-ip-renew.timer diff --git a/deploy/keycloak/realm-voice-local.json b/deploy/keycloak/realm-voice-local.json index fd4a84f..ba10069 100644 --- a/deploy/keycloak/realm-voice-local.json +++ b/deploy/keycloak/realm-voice-local.json @@ -19,6 +19,7 @@ "http://localhost:3100/*", "http://127.0.0.1:3100/*", "http://121.41.46.238/*", + "https://121.41.46.238/*", "http://localhost:5173/*", "http://127.0.0.1:5173/*" ], @@ -26,6 +27,7 @@ "http://localhost:3100", "http://127.0.0.1:3100", "http://121.41.46.238", + "https://121.41.46.238", "http://localhost:5173", "http://127.0.0.1:5173" ], diff --git a/deploy/server/README.md b/deploy/server/README.md index 27cc830..145aa12 100644 --- a/deploy/server/README.md +++ b/deploy/server/README.md @@ -1,12 +1,12 @@ # 阿里云单机演示部署 -该配置用于单机公网演示，不是生产验收配置。只向公网发布HTTP 80；PostgreSQL、Redis、MinIO、Keycloak内部端口以及API/Worker端口均不映射到宿主机。真实RTC、模型、内容安全、HTTPS、云KMS、备份恢复和监控告警仍按阶段8验收清单执行。 +该配置用于单机公网演示，不是生产验收配置。只向公网发布HTTP 80和HTTPS 443；PostgreSQL、Redis、MinIO、Keycloak内部端口以及API/Worker端口均不映射到宿主机。当前阿里云演示机使用Let's Encrypt短期IP证书，`certbot-ip-renew.timer`负责自动续期。真实RTC、模型、内容安全、云KMS、备份恢复和监控告警仍按阶段8验收清单执行。 服务器至少需要Docker Engine 29与Compose 2.40。首次部署先生成权限为600的服务器专用配置： ```sh ./deploy/server/bootstrap-secrets.sh \ - http://SERVER_IP \ + https://SERVER_IP \ 0.64.0-rc.cloud1 \ FULL_GIT_COMMIT \ 2026-08-26T00:00:00Z @@ -21,4 +21,4 @@ docker compose -f compose.yaml -f deploy/server/compose.override.yaml \ mock-provider api worker web gateway ``` -安全组和主机防火墙只保留TCP 80以及受限来源的SSH 22。使用域名前只能运行HTTP演示；正式环境必须配置域名、受信HTTPS证书、生产OIDC和真实外部服务，并切换到Kubernetes生产覆盖层。 +安全组和主机防火墙只保留TCP 80、443以及受限来源的SSH 22。正式环境仍应配置自有域名、生产OIDC和真实外部服务，并切换到Kubernetes生产覆盖层。 diff --git a/deploy/server/certbot-ip-renew.service b/deploy/server/certbot-ip-renew.service new file mode 100644 index 0000000..21eaa40 --- /dev/null +++ b/deploy/server/certbot-ip-renew.service @@ -0,0 +1,10 @@ +[Unit] +Description=Renew the data terminal cloud IP certificate +After=docker.service network-online.target +Requires=docker.service + +[Service] +Type=oneshot +WorkingDirectory=/opt/data-terminal-cloud/current +ExecStart=/opt/certbot-5-runtime/bin/certbot renew --cert-name 121.41.46.238 --quiet --pre-hook "/usr/bin/docker compose -f compose.yaml -f deploy/server/compose.override.yaml --env-file deploy/server/.env stop gateway" --post-hook "/usr/bin/docker compose -f compose.yaml -f deploy/server/compose.override.yaml --env-file deploy/server/.env start gateway" + diff --git a/deploy/server/certbot-ip-renew.timer b/deploy/server/certbot-ip-renew.timer new file mode 100644 index 0000000..a07778e --- /dev/null +++ b/deploy/server/certbot-ip-renew.timer @@ -0,0 +1,11 @@ +[Unit] +Description=Check the data terminal cloud IP certificate twice daily + +[Timer] +OnCalendar=*-*-* 03,15:17:00 +RandomizedDelaySec=1h +Persistent=true + +[Install] +WantedBy=timers.target + diff --git a/deploy/server/compose.override.yaml b/deploy/server/compose.override.yaml index 8a417a4..d460bfd 100644 --- a/deploy/server/compose.override.yaml +++ b/deploy/server/compose.override.yaml @@ -15,7 +15,7 @@ x-server-backend-environment: &server-backend-environment OBJECT_STORE_SECRET_KEY: ${MINIO_SECRET_KEY} OBJECT_STORE_EXPORT_BUCKET: private-exports OBJECT_STORE_REGION: us-east-1 - OBJECT_STORE_SECURE: "false" + OBJECT_STORE_SECURE: "true" CURSOR_SIGNING_SECRET: ${CURSOR_SIGNING_SECRET} SHARE_TOKEN_SIGNING_SECRET: ${SHARE_TOKEN_SIGNING_SECRET} EMBEDDING_PROVIDER: local @@ -159,8 +159,10 @@ services: image: nginx:1.30-alpine ports: - "80:80" + - "443:443" volumes: - ./deploy/server/nginx.conf:/etc/nginx/conf.d/default.conf:ro + - /etc/letsencrypt:/etc/letsencrypt:ro depends_on: - api - callbacks diff --git a/deploy/server/nginx.conf b/deploy/server/nginx.conf index c5805da..5a75aba 100644 --- a/deploy/server/nginx.conf +++ b/deploy/server/nginx.conf @@ -1,9 +1,23 @@ server { listen 80; server_name _; + return 301 https://121.41.46.238$request_uri; +} + +server { + listen 443 ssl; + server_name 121.41.46.238; server_tokens off; client_max_body_size 256m; + ssl_certificate /etc/letsencrypt/live/121.41.46.238/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/121.41.46.238/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 1d; + + add_header Strict-Transport-Security "max-age=31536000" always; + proxy_http_version 1.1; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-Host $http_host; @@ -46,4 +60,3 @@ server { proxy_pass http://web:8080; } } -