https_server.conf

# Todo: May be can auto discovery
upstream http_server {
  ip_hash;
  server web:8080;  # 这个是可以通过容器访问, 外部访问是 80端口
}

server {
  listen 80;  # 容器内部固定端口，对外映射由 installer 控制
  # listen [::]:80;
  # server_name demo.jumpserver.org;  # 取消注释并自行修改成你自己的域名
  # HTTPS_REDIRECT

  client_max_body_size 5000m;

  location / {
    proxy_pass http://http_server;
    proxy_buffering off;
    proxy_request_buffering off;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    # 默认作为第一层；仅显式 USE_LB=0 时由启动脚本改为信任上游代理头。
    proxy_set_header X-Forwarded-For $remote_addr;

    proxy_ignore_client_abort on;
    proxy_connect_timeout 600;
    proxy_send_timeout 600;
    proxy_read_timeout 600;
    send_timeout 6000;
  }
}

server {
  listen 443 ssl;  # 容器内部固定端口，对外映射由 installer 控制
  http2 on;
  # listen [::]:443 ssl;
  # server_name demo.jumpserver.org;      # 取消注释并自行修改成你自己的域名
  server_tokens off;
  ssl_certificate cert/server.crt;        # 修改 server.crt 为你的证书, 不要改路径 cert/
  ssl_certificate_key cert/server.key;    # 修改 server.key 为你的证书, 不要改路径 cert/
  ssl_session_timeout 1d;
  ssl_session_cache shared:MozSSL:10m;
  ssl_session_tickets off;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_prefer_server_ciphers off;

  client_max_body_size 5000m;

  location / {
    proxy_pass http://http_server;
    proxy_buffering off;
    proxy_request_buffering off;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    # 默认作为第一层；仅显式 USE_LB=0 时由启动脚本改为信任上游代理头。
    proxy_set_header X-Forwarded-For $remote_addr;

    proxy_ignore_client_abort on;
    proxy_connect_timeout 600;
    proxy_send_timeout 600;
    proxy_read_timeout 600;
    send_timeout 6000;
  }
}