fix: separate public object store TLS

deploy/keycloak/realm-voice-local.json

@@ -20,6 +20,7 @@
         "http://127.0.0.1:3100/*",
         "http://121.41.46.238/*",
         "https://121.41.46.238/*",
+        "https://121.41.46.238:80/*",
         "http://localhost:5173/*",
         "http://127.0.0.1:5173/*"
       ],
@@ -28,6 +29,7 @@
         "http://127.0.0.1:3100",
         "http://121.41.46.238",
         "https://121.41.46.238",
+        "https://121.41.46.238:80",
         "http://localhost:5173",
         "http://127.0.0.1:5173"
       ],

deploy/server/README.md

@@ -21,4 +21,4 @@ docker compose -f compose.yaml -f deploy/server/compose.override.yaml \
   mock-provider api worker web gateway
 ```
 
-安全组和主机防火墙只保留TCP 80、443以及受限来源的SSH 22。正式环境仍应配置自有域名、生产OIDC和真实外部服务，并切换到Kubernetes生产覆盖层。
+安全组和主机防火墙只保留TCP 80、443以及受限来源的SSH 22。如果云安全组暂未放行443，可临时将宿主机80映射到网关443，并使用`https://SERVER_IP:80`；放行443后应恢复标准HTTPS地址。正式环境仍应配置自有域名、生产OIDC和真实外部服务，并切换到Kubernetes生产覆盖层。

deploy/server/compose.override.yaml

@@ -15,7 +15,8 @@ x-server-backend-environment: &server-backend-environment
   OBJECT_STORE_SECRET_KEY: ${MINIO_SECRET_KEY}
   OBJECT_STORE_EXPORT_BUCKET: private-exports
   OBJECT_STORE_REGION: us-east-1
-  OBJECT_STORE_SECURE: "true"
+  OBJECT_STORE_SECURE: "false"
+  OBJECT_STORE_PUBLIC_SECURE: "true"
   CURSOR_SIGNING_SECRET: ${CURSOR_SIGNING_SECRET}
   SHARE_TOKEN_SIGNING_SECRET: ${SHARE_TOKEN_SIGNING_SECRET}
   EMBEDDING_PROVIDER: local
@@ -158,7 +159,7 @@ services:
   gateway:
     image: nginx:1.30-alpine
     ports:
-      - "80:80"
+      - "80:443"
       - "443:443"
     volumes:
       - ./deploy/server/nginx.conf:/etc/nginx/conf.d/default.conf:ro

deploy/server/nginx.conf

@@ -18,6 +18,13 @@ server {
 
     add_header Strict-Transport-Security "max-age=31536000" always;
 
+    resolver 127.0.0.11 ipv6=off valid=10s;
+    set $api_backend http://api:8080;
+    set $callbacks_backend http://callbacks:8081;
+    set $keycloak_backend http://keycloak:8080;
+    set $minio_backend http://minio:9000;
+    set $web_backend http://web:8080;
+
     proxy_http_version 1.1;
     proxy_set_header Host $http_host;
     proxy_set_header X-Forwarded-Host $http_host;
@@ -27,36 +34,36 @@ server {
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
     location /api/ {
-        proxy_pass http://api:8080;
+        proxy_pass $api_backend;
         proxy_buffering off;
         proxy_read_timeout 3600s;
     }
 
     location /device/ {
-        proxy_pass http://api:8080;
+        proxy_pass $api_backend;
         proxy_buffering off;
     }
 
     location /callbacks/ {
-        proxy_pass http://callbacks:8081;
+        proxy_pass $callbacks_backend;
         proxy_buffering off;
     }
 
     location /realms/ {
-        proxy_pass http://keycloak:8080;
+        proxy_pass $keycloak_backend;
     }
 
     location /resources/ {
-        proxy_pass http://keycloak:8080;
+        proxy_pass $keycloak_backend;
     }
 
     location /private-exports/ {
-        proxy_pass http://minio:9000;
+        proxy_pass $minio_backend;
         proxy_request_buffering off;
         proxy_buffering off;
     }
 
     location / {
-        proxy_pass http://web:8080;
+        proxy_pass $web_backend;
     }
 }