0adb3ed8a1
- Introduce `setup-certs.sh` script for generating trusted local TLS certificates using mkcert. - Add Nginx configuration files for local and Docker environments to handle HTTPS requests and proxy to backend services. - Update `docker-compose.yaml` to include Nginx service for unified TLS entry and adjust frontend service ports for local development. - Create `AGENTS.md` and `README.md` files to document the local HTTPS setup process and usage instructions. - Modify backend startup commands in `README.md` for consistency with new requirements. - Add `.gitignore` to exclude generated certificates from version control.
95 lines
3.8 KiB
Plaintext
95 lines
3.8 KiB
Plaintext
# AI Video Assistant —— 本地/局域网开发用 nginx 反代(统一 TLS 入口)
|
|
#
|
|
# 作用:浏览器只跟 nginx(:443)打交道,一张 mkcert 证书统管;
|
|
# 前端(:3000)和后端(:8000)在后面照常跑明文,不用各自配证书。
|
|
# 前端页面与信令 ws 同源(同 host 同端口),没有混合内容/跨源问题。
|
|
#
|
|
# 用法:
|
|
# 1. ./deploy/setup-certs.sh # mkcert 生成证书到 deploy/certs/
|
|
# 2. 启动前后端(docker compose → ui:3030;本地裸跑 → ui:3000;后端均 :8000)
|
|
# 3. nginx -c $(pwd)/deploy/nginx/ai-video.dev.conf -g 'daemon off;'
|
|
# 4. 浏览器访问 https://<本机IP 或 ai-video.local>
|
|
#
|
|
# 注意:证书路径下面写的是绝对路径,换机器/换目录时改 __CERT_DIR__ 两行即可。
|
|
|
|
worker_processes 1;
|
|
events { worker_connections 256; }
|
|
|
|
http {
|
|
# mac/homebrew 的 nginx 默认 mime.types 路径;Linux 一般是 /etc/nginx/mime.types
|
|
include mime.types;
|
|
default_type application/octet-stream;
|
|
sendfile on;
|
|
|
|
# 前端上游:优先本地裸跑的 :3000,连不上自动落到 docker ui 发布的 :3030
|
|
upstream ui_upstream {
|
|
server 127.0.0.1:3000;
|
|
server 127.0.0.1:3030 backup;
|
|
}
|
|
|
|
# 80 → 全部跳 443
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
server_name _; # catch-all:任何 host/IP 都匹配,LAN 调试省心
|
|
|
|
# __CERT_DIR__ —— mkcert 生成的证书(setup-certs.sh 会放到这里)
|
|
ssl_certificate /Users/wangx/Code/AI-VideoAssistant-Project/ai-video/deploy/certs/ai-video.pem;
|
|
ssl_certificate_key /Users/wangx/Code/AI-VideoAssistant-Project/ai-video/deploy/certs/ai-video-key.pem;
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
# ---- 语音信令 / 裸音频流 ws:/ws/voice、/ws/stream ----
|
|
# 关键:Upgrade/Connection 头让 ws 握手成功;长超时防止长连接被掐;关缓冲实时透传。
|
|
location /ws/ {
|
|
proxy_pass http://127.0.0.1:8000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
|
|
proxy_read_timeout 3600s; # 语音是长连接,默认 60s 会断
|
|
proxy_send_timeout 3600s;
|
|
proxy_buffering off; # 流式音频不能攒着
|
|
}
|
|
|
|
# ---- 后端 HTTP 接口:/api/*(assistants/credentials/knowledge-bases)+ /health ----
|
|
location /api/ {
|
|
proxy_pass http://127.0.0.1:8000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
client_max_body_size 50M; # 知识库文件上传留余量
|
|
}
|
|
|
|
location /health {
|
|
proxy_pass http://127.0.0.1:8000;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
# ---- 前端 Next dev(其余全部)----
|
|
# Upgrade 头是给 Next 热更新(HMR)的 ws 用的。
|
|
location / {
|
|
proxy_pass http://ui_upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|
|
}
|