docs: update production workflow design and runtime changes
This commit is contained in:
@@ -0,0 +1,94 @@
|
||||
<!doctype html>
|
||||
<html lang="zh-CN">
|
||||
<head>
|
||||
<meta charset="UTF-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<title>Access Restricted</title>
|
||||
<style>
|
||||
:root {
|
||||
color-scheme: light;
|
||||
font-family: "Microsoft YaHei", "Segoe UI", Arial, sans-serif;
|
||||
background: #f6f7fb;
|
||||
color: #182033;
|
||||
}
|
||||
* {
|
||||
box-sizing: border-box;
|
||||
}
|
||||
body {
|
||||
margin: 0;
|
||||
min-height: 100vh;
|
||||
display: grid;
|
||||
place-items: center;
|
||||
padding: 32px;
|
||||
}
|
||||
main {
|
||||
width: min(720px, 100%);
|
||||
background: #ffffff;
|
||||
border: 1px solid #d9dfeb;
|
||||
border-radius: 8px;
|
||||
box-shadow: 0 18px 48px rgba(23, 31, 50, 0.10);
|
||||
padding: 34px;
|
||||
}
|
||||
.eyebrow {
|
||||
margin: 0 0 12px;
|
||||
color: #7f1d1d;
|
||||
font-size: 13px;
|
||||
font-weight: 800;
|
||||
letter-spacing: 0;
|
||||
text-transform: uppercase;
|
||||
}
|
||||
h1 {
|
||||
margin: 0 0 14px;
|
||||
font-size: 30px;
|
||||
line-height: 1.18;
|
||||
}
|
||||
p {
|
||||
margin: 0 0 18px;
|
||||
color: #475569;
|
||||
line-height: 1.7;
|
||||
font-size: 15px;
|
||||
}
|
||||
dl {
|
||||
display: grid;
|
||||
grid-template-columns: 120px 1fr;
|
||||
gap: 10px 14px;
|
||||
margin: 24px 0;
|
||||
padding: 18px;
|
||||
background: #f8fafc;
|
||||
border: 1px solid #e2e8f0;
|
||||
border-radius: 8px;
|
||||
}
|
||||
dt {
|
||||
color: #64748b;
|
||||
font-weight: 700;
|
||||
}
|
||||
dd {
|
||||
margin: 0;
|
||||
font-family: Consolas, "SFMono-Regular", monospace;
|
||||
color: #0f172a;
|
||||
overflow-wrap: anywhere;
|
||||
}
|
||||
.notice {
|
||||
margin-top: 20px;
|
||||
padding-top: 18px;
|
||||
border-top: 1px solid #e2e8f0;
|
||||
font-size: 14px;
|
||||
color: #64748b;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<main>
|
||||
<p class="eyebrow">403 Access Restricted</p>
|
||||
<h1>当前设备未被授权访问 InSAR 管理系统</h1>
|
||||
<p>系统仅允许预先登记的局域网 IP 访问。请将下面的客户端 IP 提供给管理员，由管理员加入访问白名单后再重试。</p>
|
||||
<dl>
|
||||
<dt>客户端 IP</dt>
|
||||
<dd>__CLIENT_IP__</dd>
|
||||
<dt>访问主机</dt>
|
||||
<dd>__REQUEST_HOST__</dd>
|
||||
</dl>
|
||||
<p class="notice">管理员配置入口：项目根目录 <strong>.env</strong> 中的 <strong>NGINX_ALLOWED_CLIENT_IPS</strong>，修改后重启或 reload Nginx。</p>
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,2 @@
|
||||
# Generated by scripts/start_app.ps1.
|
||||
# Configure NGINX_ALLOWED_CLIENT_IPS in .env. Empty means allow all clients.
|
||||
+68
-3
@@ -24,18 +24,44 @@ http {
|
||||
server {
|
||||
listen 80;
|
||||
server_name localhost;
|
||||
include "D:/Code/Insar_management_system_v2/nginx/client_allow.conf";
|
||||
error_page 403 /__access_denied.html;
|
||||
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
# CSP: allow both legacy tile port 8900 and current tile-server port 8910
|
||||
# If tile server address changes, update the sources below accordingly
|
||||
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http://127.0.0.1:8900 http://127.0.0.1:8910 https://*.tile.openstreetmap.org https://*.tile.opentopomap.org; connect-src 'self' http://127.0.0.1:8900 http://127.0.0.1:8910; font-src 'self' data:; worker-src blob:;" always;
|
||||
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://*.tile.openstreetmap.org https://*.tile.opentopomap.org; connect-src 'self'; font-src 'self' data:; worker-src blob:;" always;
|
||||
|
||||
root "D:/Code/Insar_management_system_v2/frontend/dist";
|
||||
index index.html;
|
||||
|
||||
location = /index.html {
|
||||
try_files /index.html =404;
|
||||
add_header Cache-Control "no-store, no-cache, must-revalidate" always;
|
||||
}
|
||||
|
||||
location /assets/ {
|
||||
try_files $uri @asset_not_found;
|
||||
add_header Cache-Control "public, max-age=31536000, immutable" always;
|
||||
}
|
||||
|
||||
location @asset_not_found {
|
||||
add_header Cache-Control "no-store, no-cache, must-revalidate" always;
|
||||
return 404;
|
||||
}
|
||||
|
||||
location = /__access_denied.html {
|
||||
internal;
|
||||
allow all;
|
||||
root "D:/Code/Insar_management_system_v2/frontend/dist";
|
||||
try_files /access_denied.html =403;
|
||||
default_type text/html;
|
||||
sub_filter_once off;
|
||||
sub_filter "__CLIENT_IP__" "$remote_addr";
|
||||
sub_filter "__REQUEST_HOST__" "$host";
|
||||
}
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
@@ -49,6 +75,45 @@ http {
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
location /tiles/ {
|
||||
proxy_pass http://127.0.0.1:8910;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_cache_valid 200 365d;
|
||||
expires 365d;
|
||||
add_header Cache-Control "public, max-age=31536000, immutable" always;
|
||||
}
|
||||
|
||||
location /geojson/ {
|
||||
proxy_pass http://127.0.0.1:8910;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
location /shp/ {
|
||||
proxy_pass http://127.0.0.1:8910;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
location /vectors/ {
|
||||
proxy_pass http://127.0.0.1:8910;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
# SSE: disable buffering so events are pushed immediately
|
||||
location /api/tasks/active/stream {
|
||||
proxy_pass http://127.0.0.1:18000;
|
||||
|
||||
Reference in New Issue
Block a user