feat: 添加安全检查和部署优化

- 添加 JWT_SECRET 和 ADMIN_RESET_PASSWORD_KEY 安全检查，防止使用默认值 - 创建 docker-compose.prod.yml 和 docker-compose.prod.env.example，支持独立部署 - 添加 Nginx 反向代理配置示例，支持 HTTPS 和域名绑定 - 更新部署文档，将 Docker Hub 部署方式放在首位 - 添加多架构构建支持（amd64、arm64） - 优化部署文档结构，提供更清晰的部署指南
2025-12-07 17:08:56 +08:00
parent c114241ffb
commit 7d752073fb
9 changed files with 637 additions and 17 deletions
@@ -0,0 +1,170 @@
+# PolyHermes Nginx 反向代理配置示例
+# 
+# 适用于生产环境，在 Docker 容器外部部署 Nginx 作为反向代理
+# 
+# 使用场景：
+# - SSL/TLS 终止（HTTPS）
+# - 域名绑定
+# - 负载均衡
+# - 更灵活的配置
+#
+# 部署步骤：
+# 1. 将本文件复制到 /etc/nginx/sites-available/polyhermes
+# 2. 创建软链接: ln -s /etc/nginx/sites-available/polyhermes /etc/nginx/sites-enabled/
+# 3. 修改配置中的域名和 SSL 证书路径
+# 4. 测试配置: nginx -t
+# 5. 重载配置: systemctl reload nginx
+
+# HTTP 服务器（可选：用于重定向到 HTTPS）
+server {
+    listen 80;
+    server_name your-domain.com www.your-domain.com;
+
+    # 重定向到 HTTPS
+    return 301 https://$server_name$request_uri;
+}
+
+# HTTPS 服务器
+server {
+    listen 443 ssl http2;
+    server_name your-domain.com www.your-domain.com;
+
+    # SSL 证书配置（使用 Let's Encrypt 或其他证书）
+    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;
+
+    # SSL 安全配置
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    # 安全头
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    # 日志
+    access_log /var/log/nginx/polyhermes-access.log;
+    error_log /var/log/nginx/polyhermes-error.log;
+
+    # 客户端最大上传大小
+    client_max_body_size 10M;
+
+    # 上游服务（Docker 容器）
+    # 如果使用 docker-compose，容器名是 polyhermes，端口是 80
+    upstream polyhermes_backend {
+        server 127.0.0.1:80;
+        # 如果需要负载均衡，可以添加多个后端：
+        # server 127.0.0.1:8001;
+        # server 127.0.0.1:8002;
+    }
+
+    # API 代理
+    location /api {
+        proxy_pass http://polyhermes_backend;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+        
+        # 超时设置
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+        
+        # 缓冲设置
+        proxy_buffering on;
+        proxy_buffer_size 4k;
+        proxy_buffers 8 4k;
+        proxy_busy_buffers_size 8k;
+    }
+
+    # WebSocket 代理
+    location /ws {
+        proxy_pass http://polyhermes_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+        
+        # WebSocket 超时设置（长连接）
+        proxy_connect_timeout 7d;
+        proxy_send_timeout 7d;
+        proxy_read_timeout 7d;
+    }
+
+    # 前端静态文件代理
+    location / {
+        proxy_pass http://polyhermes_backend;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+        
+        # 静态资源缓存（由后端 Nginx 处理）
+        proxy_cache_valid 200 1y;
+    }
+
+    # 健康检查（可选）
+    location /health {
+        proxy_pass http://polyhermes_backend;
+        access_log off;
+    }
+}
+
+# 如果不需要 HTTPS，可以使用以下简化配置
+# server {
+#     listen 80;
+#     server_name your-domain.com www.your-domain.com;
+#
+#     access_log /var/log/nginx/polyhermes-access.log;
+#     error_log /var/log/nginx/polyhermes-error.log;
+#
+#     client_max_body_size 10M;
+#
+#     upstream polyhermes_backend {
+#         server 127.0.0.1:80;
+#     }
+#
+#     location /api {
+#         proxy_pass http://polyhermes_backend;
+#         proxy_set_header Host $host;
+#         proxy_set_header X-Real-IP $remote_addr;
+#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#     }
+#
+#     location /ws {
+#         proxy_pass http://polyhermes_backend;
+#         proxy_http_version 1.1;
+#         proxy_set_header Upgrade $http_upgrade;
+#         proxy_set_header Connection "upgrade";
+#         proxy_set_header Host $host;
+#         proxy_set_header X-Real-IP $remote_addr;
+#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#         proxy_read_timeout 86400;
+#         proxy_send_timeout 86400;
+#     }
+#
+#     location / {
+#         proxy_pass http://polyhermes_backend;
+#         proxy_set_header Host $host;
+#         proxy_set_header X-Real-IP $remote_addr;
+#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#     }
+# }
+