136 lines
3.9 KiB
Markdown
Executable File
136 lines
3.9 KiB
Markdown
Executable File
# Nginx 反向代理配置
|
||
|
||
# Nginx 反向代理配置
|
||
|
||
> 前提说明
|
||
>
|
||
>
|
||
|
||
1. 假设域名：
|
||
|
||
- `abs.example.com` → 代理 Audiobookshelf \(ABS\)，容器内部端口 `80`，宿主机端口 `13378`
|
||
|
||
- `ting.example.com` → 代理 Ting‑Reader，容器内部端口 `3000`，宿主机端口 `3000`
|
||
|
||
2. 使用 `certbot` 获取 SSL 证书；证书路径 `/etc/letsencrypt/live/你的域名/`
|
||
|
||
3. Nginx 与 docker 服务在同一台机器，后端地址写 `127.0.0.1:端口`；不在同一台则替换为对应内网 IP。
|
||
|
||
4. 两个服务都需要**websocket 支持**，否则网页端实时状态、播放进度同步会异常。
|
||
|
||
## 1）Audiobookshelf \([abs\.example\.com](https://abs.example.com)\) nginx 配置
|
||
|
||
```nginx
|
||
server {
|
||
listen 80;
|
||
server_name abs.example.com;
|
||
return 301 https://$host$request_uri;
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl http2;
|
||
server_name abs.example.com;
|
||
|
||
ssl_certificate /etc/letsencrypt/live/abs.example.com/fullchain.pem;
|
||
ssl_certificate_key /etc/letsencrypt/live/abs.example.com/privkey.pem;
|
||
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X‑Real‑IP $remote_addr;
|
||
proxy_set_header X‑Forwarded‑For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X‑Forwarded‑Proto $scheme;
|
||
|
||
# WebSocket 关键配置，ABS必须
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
|
||
location / {
|
||
proxy_pass http://127.0.0.1:13378;
|
||
proxy_buffering off;
|
||
client_max_body_size 100M;
|
||
}
|
||
}
|
||
```
|
||
|
||
## 2）Ting‑Reader \([ting\.example\.com](https://ting.example.com)\) nginx 配置
|
||
|
||
```nginx
|
||
server {
|
||
listen 80;
|
||
server_name ting.example.com;
|
||
return 301 https://$host$request_uri;
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl http2;
|
||
server_name ting.example.com;
|
||
|
||
ssl_certificate /etc/letsencrypt/live/ting.example.com/fullchain.pem;
|
||
ssl_certificate_key /etc/letsencrypt/live/ting.example.com/privkey.pem;
|
||
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X‑Real‑IP $remote_addr;
|
||
proxy_set_header X‑Forwarded‑For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X‑Forwarded‑Proto $scheme;
|
||
|
||
# Ting‑Reader 同样需要WebSocket
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
|
||
location / {
|
||
proxy_pass http://127.0.0.1:3000;
|
||
proxy_buffering off;
|
||
client_max_body_size 100M;
|
||
}
|
||
}
|
||
```
|
||
|
||
## 单域名子路径模式（不推荐，简单给示例）
|
||
|
||
> 不建议子路径部署（如 `https://xxx.com/abs`、`https://xxx.com/ting`），两个程序对子路径兼容都一般，容易出现静态资源、websocket 异常。优先用**子域名**。
|
||
>
|
||
>
|
||
|
||
## 使用步骤
|
||
|
||
1. 将配置写入 nginx sites‑available 下，软链接到 sites‑enabled
|
||
|
||
2. 检查配置语法：
|
||
|
||
```bash
|
||
nginx -t
|
||
```
|
||
|
||
3. 重载 nginx
|
||
|
||
```bash
|
||
systemctl reload nginx
|
||
```
|
||
|
||
## 重要踩坑提示
|
||
|
||
1. **容器绑定地址**：docker 端口映射必须是 `0.0.0.0:xxxx:xxxx`，不要只绑定 \[127\.0\.0\.1\]\(127\.0\.0\.1\)（如果你 nginx 不在本机）。
|
||
|
||
2. 不要直接把容器端口暴露公网，全部走 nginx 443 HTTPS。
|
||
|
||
3. ABS 第三方客户端（希声 Still、AudioBooth 等）填写地址时直接填完整 `https://abs.example.com`，不要带端口。
|
||
|
||
4. Ting‑Reader 网页 / PWA 访问也直接用 `https://ting.example.com`。
|
||
|
||
5. 如果你使用 Nginx Proxy Manager \(NPM\)，不需要手写上面配置，网页界面填后端地址，开启 Websocket 开关即可。
|
||
|
||
## NPM（Nginx Proxy Manager）界面填写要点
|
||
|
||
- ABS：Forward Hostname/IP `127.0.0.1`，Port `13378`，勾选 **WebSockets Support**
|
||
|
||
- Ting‑Reader：Forward Hostname/IP `127.0.0.1`，Port `3000`，勾选 **WebSockets Support**
|
||
|
||
- 申请 SSL 证书，强制 HTTPS。
|
||
|
||
> 如果你需要，我可以顺带给一份两者的 Caddy v2 配置（更简单，自动 https）。
|
||
>
|
||
>
|
||
|
||
> （注：部分内容可能由 AI 生成）
|