!577 发布 5.2.2 正式版 安全性提升 Merge pull request !577 from 疯狂的狮子Li/dev

疯狂的狮子Li

2024-08-26 098d3347a0df808908aab8c554cd7c4febc5e6d9

 script/docker/nginx/conf/nginx.conf

@@ -31,8 +31,8 @@
        server 127.0.0.1:9090;
    }

    upstream powerjob-server {
        server 127.0.0.1:7700;
    upstream snailjob-server {
        server 127.0.0.1:8800;
    }

    server {
@@ -63,7 +63,7 @@
        # }

        # 限制外网访问内网 actuator 相关路径
        location ~ ^(/[^/]*)?/actuator(/.*)?$ {
        location ~ ^(/[^/]*)?/actuator.*(/.*)?$ {
            return 403;
        }

@@ -78,10 +78,13 @@
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header REMOTE-HOST $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            # websocket参数
            proxy_read_timeout 86400s;
            # sse 与 websocket参数
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_buffering off;
            proxy_cache off;
            proxy_pass http://server/;
        }

@@ -96,20 +99,12 @@
            proxy_pass http://monitor-admin/admin/;
        }

        # https 会拦截内链所有的 http 请求 造成功能无法使用
        # 解决方案1 将 powerjob 服务 也配置成 https
        # 解决方案2 将菜单配置为外链访问 走独立页面 http 访问
        location /powerjob/ {
        location /snail-job/ {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header REMOTE-HOST $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass http://powerjob-server/;
        }

        # 解决 powerjob 代理之后静态文件无法访问的问题 请勿修改乱动
        location ~ ^/(js|css|jpg|png|svg|woff|ttf|ico|img)/ {
            proxy_pass http://powerjob-server;
            proxy_pass http://snailjob-server/snail-job/;
        }

        error_page   500 502 503 504  /50x.html;