front/nginx-default.conf

# ============ 生产环境部署必读（避免「本地可以、线上不行」）============
# 1. 本文件必须真正生效：确认 oms.nanafa.com 的请求由「本 server 块」处理
#    - 若用 include：确保 include 的是含本 server 的 conf，且无其它 server 抢先匹配
#    - 更新后必须执行：nginx -t && nginx -s reload
# 2. /api、/Track 由 nginx 代理到 api.nanafa.com，避免浏览器跨域 405；rbac 由前端直连 admin
# 3. HTTPS：证书部署到服务器（勿提交 .key 到 git）
#      /etc/nginx/ssl/oms.nanafa.com.pem
#      /etc/nginx/ssl/oms.nanafa.com.key
# 4. 客户登录在根路径 /；管理端 /admin。旧 /login 永久重定向到 /
# 5. 静态资源使用 /login-assets/，勿使用 /login/ 目录名
# 6. 微信公众号服务器 URL 请使用 https://oms.nanafa.com/api/apiwechat/verification
# ============================================================================

# HTTP → HTTPS
server {
    listen       80;
    server_name  oms.nanafa.com;

    return 301 https://$host$request_uri;
}

server {
    listen       443 ssl;
    http2        on;
    server_name  oms.nanafa.com;

    ssl_certificate     /etc/nginx/ssl/oms.nanafa.com.pem;
    ssl_certificate_key /etc/nginx/ssl/oms.nanafa.com.key;

    ssl_session_timeout 1d;
    ssl_session_cache shared:OMS_SSL:10m;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    # 启用gzip压缩
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json application/xml image/svg+xml;
    gzip_comp_level 6;
    gzip_disable "msie6";

    root /usr/share/nginx/html;

    # ============ 旧客户登录路径 → 首页 ============
    rewrite ^/login/?$ / permanent;

    # ============ 管理端登录入口 ============
    rewrite ^/admin/?$ /index.html last;

    location = /admin {
        try_files /index.html =200;
    }
    location = /admin/ {
        try_files /index.html =200;
    }

    # ============ API 前端路由（必须先于 /api/ 代理）============
    location ~ ^/api/(upstreamInterface|upstreamInterfaceConfig|upstreamInterfaceConfigEdit|downstreamInterface(|/newPort)|appList(|/createApplication)|requestLog|callStatistics|apiDebugger|apiTest)(/|$) {
        try_files /index.html =200;
    }

    # ============ 小红书前端路由（必须先于后端 API 反代）============
    location ~ ^/xhs/(startService|analysis|creation|publishHistory|skills|humanSettings)(/|$) {
        try_files /index.html =200;
    }

    # ============ 微信公众号服务器回调（admin API，非 itfx）============
    location ^~ /api/apiwechat/ {
        rewrite ^/api/apiwechat/(.*)$ /admin/apiwechat/$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }

    # ============ API 代理（仅真实后端接口，同源请求避免跨域 405）============
    location ~ ^/api/ {
        rewrite ^/api/(.*)$ /itfx/$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }

    location ^~ /Track {
        rewrite ^/Track(.*)$ /track/Track$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }

    # HTML 不缓存
    location = /index.html {
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Pragma "no-cache";
        add_header Expires "0";
    }

    # ============ 静态资源缓存 ============

    location ~* \.(?:js|css)$ {
        try_files $uri =404;
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    location ~* \.(?:jpg|jpeg|png|gif|ico|svg|webp|avif)$ {
        try_files $uri =404;
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    location ~* \.(?:woff2?|ttf|eot|otf)$ {
        try_files $uri =404;
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    location ~* \.(?:pdf|zip|tar|gz|br)$ {
        try_files $uri =404;
        expires 1M;
        add_header Cache-Control "public";
        access_log off;
    }

    # ============ SPA 前端路由（放在最后）============
    # 不用 try_files $uri $uri/ —— 若磁盘存在同名目录且无 index，会 403 且不会回落 index.html
    location / {
        index index.html;
        try_files $uri /index.html;
    }

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root html;
    }
}