root/vscode-workbench
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: compose必填变量+环回绑定+nginx安全头/admin内网化；产物去跟踪88项；冻结规格+审计+BLOCKED runbook落盘
vscode-planning-ci / planning-smoke (push) Failing after 1m30s
Details

Browse Source
This commit is contained in:
root
2026-09-16 18:18:42 +08:00
parent 5b3850c191
commit 6d22fb161f
95 changed files with 210 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nginx-docker.conf
+30 -6
View File
@@ -3,6 +3,29 @@ server {
server_name localhost;
root /usr/share/nginx/html;
index index.html;
server_tokens off;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
# API 目录封面等同源静态资源：必须优先于 SPA fallback，避免返回 index.html。
# 文件来自 frontend public/api-directory/，构建后位于 /usr/share/nginx/html/api-directory/。
location ^~ /api-directory/ {
try_files $uri =404;
expires 1y;
add_header Cache-Control "public, max-age=31536000, immutable" always;
types {
image/avif avif;
image/gif gif;
image/jpeg jpg jpeg;
image/png png;
image/svg+xml svg;
image/webp webp;
}
default_type application/octet-stream;
access_log off;
}
# 开启gzip压缩
gzip on;
@@ -202,15 +225,16 @@ server {
}
# Django admin / swagger / redoc / i18n / 测试页
location /admin/ { proxy_pass http://backend:8000; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; client_max_body_size 50M; }
location /swagger { proxy_pass http://backend:8000; proxy_set_header Host $host; }
location /swagger.json { proxy_pass http://backend:8000; proxy_set_header Host $host; }
location /redoc/ { proxy_pass http://backend:8000; proxy_set_header Host $host; }
# 生产默认仅内网可达；如需公网管理入口请走独立域名 + IP 白名单 + MFA。
location /admin/ { allow 127.0.0.1; allow 10.0.0.0/8; allow 172.16.0.0/12; allow 192.168.0.0/16; deny all; proxy_pass http://backend:8000; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; client_max_body_size 5M; }
location /swagger { allow 127.0.0.1; allow 10.0.0.0/8; allow 172.16.0.0/12; allow 192.168.0.0/16; deny all; proxy_pass http://backend:8000; proxy_set_header Host $host; }
location /swagger.json { allow 127.0.0.1; allow 10.0.0.0/8; allow 172.16.0.0/12; allow 192.168.0.0/16; deny all; proxy_pass http://backend:8000; proxy_set_header Host $host; }
location /redoc/ { allow 127.0.0.1; allow 10.0.0.0/8; allow 172.16.0.0/12; allow 192.168.0.0/16; deny all; proxy_pass http://backend:8000; proxy_set_header Host $host; }
location /i18n/ { proxy_pass http://backend:8000; proxy_set_header Host $host; }
location /test/ { proxy_pass http://backend:8000; proxy_set_header Host $host; }
location /test/ { allow 127.0.0.1; allow 10.0.0.0/8; allow 172.16.0.0/12; allow 192.168.0.0/16; deny all; proxy_pass http://backend:8000; proxy_set_header Host $host; }
# 带哈希指纹的构建产物：永久强缓存（immutable）
location ~* \assets/.*\.(js|css|png|jpg|jpeg|gif|webp|avif|ico|svg|woff|woff2|ttf|eot)$ {
location ~* ^/assets/.*\.(js|css|png|jpg|jpeg|gif|webp|avif|ico|svg|woff|woff2|ttf|eot)$ {
expires 1y;
add_header Cache-Control "public, immutable";
access_log off;