Add initial setup for local HTTPS debugging and Nginx configuration
- Introduce `setup-certs.sh` script for generating trusted local TLS certificates using mkcert. - Add Nginx configuration files for local and Docker environments to handle HTTPS requests and proxy to backend services. - Update `docker-compose.yaml` to include Nginx service for unified TLS entry and adjust frontend service ports for local development. - Create `AGENTS.md` and `README.md` files to document the local HTTPS setup process and usage instructions. - Modify backend startup commands in `README.md` for consistency with new requirements. - Add `.gitignore` to exclude generated certificates from version control.
This commit is contained in:
Xin Wang
94
deploy/nginx/ai-video.dev.conf
Normal file
94
deploy/nginx/ai-video.dev.conf
Normal file
@@ -0,0 +1,94 @@
|
||||
# AI Video Assistant —— 本地/局域网开发用 nginx 反代(统一 TLS 入口)
|
||||
#
|
||||
# 作用:浏览器只跟 nginx(:443)打交道,一张 mkcert 证书统管;
|
||||
# 前端(:3000)和后端(:8000)在后面照常跑明文,不用各自配证书。
|
||||
# 前端页面与信令 ws 同源(同 host 同端口),没有混合内容/跨源问题。
|
||||
#
|
||||
# 用法:
|
||||
# 1. ./deploy/setup-certs.sh # mkcert 生成证书到 deploy/certs/
|
||||
# 2. 启动前后端(docker compose → ui:3030;本地裸跑 → ui:3000;后端均 :8000)
|
||||
# 3. nginx -c $(pwd)/deploy/nginx/ai-video.dev.conf -g 'daemon off;'
|
||||
# 4. 浏览器访问 https://<本机IP 或 ai-video.local>
|
||||
#
|
||||
# 注意:证书路径下面写的是绝对路径,换机器/换目录时改 __CERT_DIR__ 两行即可。
|
||||
|
||||
worker_processes 1;
|
||||
events { worker_connections 256; }
|
||||
|
||||
http {
|
||||
# mac/homebrew 的 nginx 默认 mime.types 路径;Linux 一般是 /etc/nginx/mime.types
|
||||
include mime.types;
|
||||
default_type application/octet-stream;
|
||||
sendfile on;
|
||||
|
||||
# 前端上游:优先本地裸跑的 :3000,连不上自动落到 docker ui 发布的 :3030
|
||||
upstream ui_upstream {
|
||||
server 127.0.0.1:3000;
|
||||
server 127.0.0.1:3030 backup;
|
||||
}
|
||||
|
||||
# 80 → 全部跳 443
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name _; # catch-all:任何 host/IP 都匹配,LAN 调试省心
|
||||
|
||||
# __CERT_DIR__ —— mkcert 生成的证书(setup-certs.sh 会放到这里)
|
||||
ssl_certificate /Users/wangx/Code/AI-VideoAssistant-Project/ai-video/deploy/certs/ai-video.pem;
|
||||
ssl_certificate_key /Users/wangx/Code/AI-VideoAssistant-Project/ai-video/deploy/certs/ai-video-key.pem;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
# ---- 语音信令 / 裸音频流 ws:/ws/voice、/ws/stream ----
|
||||
# 关键:Upgrade/Connection 头让 ws 握手成功;长超时防止长连接被掐;关缓冲实时透传。
|
||||
location /ws/ {
|
||||
proxy_pass http://127.0.0.1:8000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
|
||||
proxy_read_timeout 3600s; # 语音是长连接,默认 60s 会断
|
||||
proxy_send_timeout 3600s;
|
||||
proxy_buffering off; # 流式音频不能攒着
|
||||
}
|
||||
|
||||
# ---- 后端 HTTP 接口:/api/*(assistants/credentials/knowledge-bases)+ /health ----
|
||||
location /api/ {
|
||||
proxy_pass http://127.0.0.1:8000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
client_max_body_size 50M; # 知识库文件上传留余量
|
||||
}
|
||||
|
||||
location /health {
|
||||
proxy_pass http://127.0.0.1:8000;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
|
||||
# ---- 前端 Next dev(其余全部)----
|
||||
# Upgrade 头是给 Next 热更新(HMR)的 ws 用的。
|
||||
location / {
|
||||
proxy_pass http://ui_upstream;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
}
|
||||
}
|
||||
}
|
||||
75
deploy/nginx/ai-video.docker.conf
Normal file
75
deploy/nginx/ai-video.docker.conf
Normal file
@@ -0,0 +1,75 @@
|
||||
# AI Video Assistant —— docker compose 用 nginx 反代(统一 TLS 入口)
|
||||
#
|
||||
# 与 ai-video.dev.conf 的唯一区别:proxy_pass 用 compose 的服务名(api/ui),
|
||||
# 不是 127.0.0.1——容器之间靠 app-network 上的服务名互通。
|
||||
# 证书挂载到容器内 /etc/nginx/certs(见 docker-compose 的 nginx 服务)。
|
||||
#
|
||||
# 这份文件被 nginx:alpine 容器当作 /etc/nginx/nginx.conf 整体加载。
|
||||
|
||||
worker_processes 1;
|
||||
events { worker_connections 256; }
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
sendfile on;
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name _;
|
||||
|
||||
ssl_certificate /etc/nginx/certs/ai-video.pem;
|
||||
ssl_certificate_key /etc/nginx/certs/ai-video-key.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
# 语音信令 / 裸音频流
|
||||
location /ws/ {
|
||||
proxy_pass http://api:8000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_read_timeout 3600s;
|
||||
proxy_send_timeout 3600s;
|
||||
proxy_buffering off;
|
||||
}
|
||||
|
||||
# 后端 HTTP 接口
|
||||
location /api/ {
|
||||
proxy_pass http://api:8000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
client_max_body_size 50M;
|
||||
}
|
||||
|
||||
location /health {
|
||||
proxy_pass http://api:8000;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
|
||||
# 前端 Next dev(含 HMR 的 ws)
|
||||
location / {
|
||||
proxy_pass http://ui:3000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user