feat(0.2.1): TLS 前置 13443 —— PowerSync 网页端必须安全上下文 (navigator.locks), 自签证书按路径分流 app/sync

2026-10-26 01:59:31 +08:00
parent 533a05832e
commit e963140bf9
4 changed files with 56 additions and 2 deletions
@@ -0,0 +1,37 @@
+# 0.2.1 TLS 前置: 单端口 13443, 按路径分流 (自签证书, 见 README)
+# PowerSync 页面必须在安全上下文运行 (navigator.locks 仅 HTTPS/localhost), 故 app 与 sync 统一走 TLS
+server {
+    listen 443 ssl;
+    server_name bh.vps.honor3.com;
+
+    ssl_certificate     /etc/nginx/certs/bh.pem;
+    ssl_certificate_key /etc/nginx/certs/bh.key;
+
+    # PowerSync (HTTP 流式 + WebSocket 兜底)
+    location /sync/ {
+        proxy_pass http://powersync:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Connection '';
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+    location /socket/ {
+        proxy_pass http://powersync:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 3600s;
+    }
+    location /health {
+        proxy_pass http://powersync:8080;
+    }
+
+    # 应用 (静态前端 + API)
+    location / {
+        proxy_pass http://app:13001;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+    }
+}