chore: initial import

2026-04-19 14:05:40 +08:00
commit 89e9eae36e
81 changed files with 37363 additions and 0 deletions
@@ -0,0 +1,99 @@
+# Nginx 配置文件 for ST-System
+
+worker_processes  4;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+    sendfile        on;
+    keepalive_timeout  65;
+
+    # 允许大文件上传 (500MB)
+    client_max_body_size 500M;
+
+    # 定义后端服务地址
+    upstream st_backend {
+        server 127.0.0.1:5000;
+    }
+
+    # HTTPS 服务器配置
+    server {
+        listen       443 ssl;
+        server_name  localhost;
+
+        # SSL 证书配置
+        ssl_certificate      server.cert;
+        ssl_certificate_key  server.key;
+
+        ssl_session_cache    shared:SSL:1m;
+        ssl_session_timeout  5m;
+
+        ssl_ciphers  HIGH:!aNULL:!MD5;
+        ssl_prefer_server_ciphers  on;
+
+        # 安全响应头
+        add_header X-Frame-Options "SAMEORIGIN";
+        add_header X-XSS-Protection "1; mode=block";
+        add_header X-Content-Type-Options "nosniff";
+
+        # 1. 前端静态资源 (React)
+        # 直接由 Nginx 提供服务，性能更高
+        location / {
+            # 安全策略：拦截移动端访问，重定向到提示页
+            if ($http_user_agent ~* "(mobile|android|iphone|ipad|phone)") {
+                return 302 /mobile_forbidden.html;
+            }
+
+            root   c:/Users/16216/Desktop/STsystem/client/build;
+            index  index.html index.htm;
+            try_files $uri $uri/ /index.html;
+        }
+
+        # 移动端禁止访问提示页
+        location = /mobile_forbidden.html {
+            root c:/Users/16216/Desktop/STsystem/static;
+        }
+
+        # 2. 后端 API 接口
+        location /api/ {
+            proxy_pass http://st_backend;
+            
+            # 传递真实 IP (配合后端 app.set('trust proxy', 1))
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # 支持 WebSocket
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+
+        # 3. 上传文件访问
+        location /uploads/ {
+            alias c:/Users/16216/Desktop/STsystem/server/uploads/;
+            expires 30d;
+            add_header Cache-Control "public, no-transform";
+            
+            # 安全加固：禁止目录列表和脚本执行
+            autoindex off;
+            # 确保不解析 PHP 等脚本 (如果服务器安装了 PHP)
+            location ~ \.(php|jsp|asp|aspx|py|pl|sh|cgi)$ {
+                deny all;
+                return 403;
+            }
+        }
+    }
+
+    # HTTP 自动跳转 HTTPS
+    server {
+        listen       80;
+        server_name  localhost;
+        return 301 https://$host$request_uri;
+    }
+}