From 6259018062d04317c10abf9e0eb87c586a615fd8 Mon Sep 17 00:00:00 2001 From: hellcat Date: Sun, 11 Oct 2026 16:06:44 +0800 Subject: [PATCH] ops: version isolated subscription gateway configuration --- gateway-admin.conf | 29 ++++++++++++++++++++++++++ gateway-http.conf | 6 ++++++ gateway-nginx.conf | 34 ++++++++++++++++++++++++++++++ gateway-proxy.conf | 15 ++++++++++++++ gateway-site.conf | 26 +++++++++++++++++++++++ gateway.compose.yml | 50 +++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 160 insertions(+) create mode 100644 gateway-admin.conf create mode 100644 gateway-http.conf create mode 100644 gateway-nginx.conf create mode 100644 gateway-proxy.conf create mode 100644 gateway-site.conf create mode 100644 gateway.compose.yml diff --git a/gateway-admin.conf b/gateway-admin.conf new file mode 100644 index 0000000..e695226 --- /dev/null +++ b/gateway-admin.conf @@ -0,0 +1,29 @@ +user nginx; +worker_processes 1; +pid /var/run/nginx.pid; +events { worker_connections 256; } +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + server_tokens off; + server { + listen 64444 ssl; + ssl_certificate /etc/letsencrypt/live/c2.deeplink-subscribe.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/c2.deeplink-subscribe.com/privkey.pem; + root /var/www/html; + index index.php; + location / { try_files $uri /index.php$is_args$args; } + location ~ ^/api/[a-z_]+\.php$ { + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_pass 127.0.0.1:9000; + } + location ~ \.php$ { + try_files $uri /index.php$is_args$args; + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_pass 127.0.0.1:9000; + } + location ~ /\. { deny all; } + } +} diff --git a/gateway-http.conf b/gateway-http.conf new file mode 100644 index 0000000..99f617a --- /dev/null +++ b/gateway-http.conf @@ -0,0 +1,6 @@ +server { + listen 80; + server_name c2.deeplink-subscribe.com; + location ^~ /.well-known/acme-challenge/ { root /var/lib/dpl-sgw/acme; } + location / { return 404; } +} diff --git a/gateway-nginx.conf b/gateway-nginx.conf new file mode 100644 index 0000000..fa602ab --- /dev/null +++ b/gateway-nginx.conf @@ -0,0 +1,34 @@ +user nginx; +worker_processes 1; +error_log /var/log/nginx/error.log warn; +pid /var/run/nginx.pid; +events { worker_connections 1024; } +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + include /etc/nginx/subscribe/real_ip.conf; + # Do not record subscription credentials in access logs. + log_format main '$remote_addr [$time_local] "$request_method subscription" $status $body_bytes_sent "$http_user_agent"'; + access_log /var/log/subscribe/access.log main; + error_log /var/log/subscribe/error.log crit; + sendfile on; + keepalive_timeout 65; + server_tokens off; + resolver 1.1.1.1 valid=60s ipv6=off; + resolver_timeout 5s; + map $http_upgrade $connection_upgrade { default upgrade; '' close; } + include /etc/nginx/subscribe/cloud_geo.conf; + include /etc/nginx/subscribe/whitelist.conf; + include /etc/nginx/subscribe/ua_custom.conf; + include /etc/nginx/subscribe/ua_whitelist.conf; + server { listen 80 default_server; return 444; } + server { + listen 443 ssl; + ssl_certificate /etc/nginx/ssl/cert.pem; + ssl_certificate_key /etc/nginx/ssl/key.pem; + ssl_protocols TLSv1.2 TLSv1.3; + include /etc/nginx/subscribe/blacklist.conf; + include /etc/nginx/subscribe/protect.conf; + location / { return 404; } + } +} diff --git a/gateway-proxy.conf b/gateway-proxy.conf new file mode 100644 index 0000000..a14a030 --- /dev/null +++ b/gateway-proxy.conf @@ -0,0 +1,15 @@ +proxy_set_header Host c2.deeplink-subscribe.com; +proxy_set_header X-Real-IP $remote_addr; +proxy_set_header X-Forwarded-For $remote_addr; +proxy_set_header X-Forwarded-Proto https; +proxy_http_version 1.1; +proxy_ssl_server_name on; +proxy_ssl_name c2.deeplink-subscribe.com; +proxy_ssl_verify on; +proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt; +proxy_connect_timeout 10s; +proxy_read_timeout 60s; +proxy_hide_header Cache-Control; +add_header Cache-Control "private, no-store" always; +proxy_no_cache 1; +proxy_cache_bypass 1; diff --git a/gateway-site.conf b/gateway-site.conf new file mode 100644 index 0000000..c493620 --- /dev/null +++ b/gateway-site.conf @@ -0,0 +1,26 @@ +server { + listen 80; + server_name c2.deeplink-subscribe.com; + location ^~ /.well-known/acme-challenge/ { root /var/lib/dpl-sgw/acme; } + location / { return 301 https://$host$request_uri; } +} +server { + listen 443 ssl; + server_name c2.deeplink-subscribe.com; + ssl_certificate /etc/letsencrypt/live/c2.deeplink-subscribe.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/c2.deeplink-subscribe.com/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + # Public gateway serves subscriptions only; administration stays on loopback. + access_log off; + error_log /var/log/nginx/dpl-subscribe-error.log crit; + location ~ ^/s/([^/]+)/?$ { + rewrite ^/s/([^/]+)/?$ /api/v1/client/subscribe?token=$1 break; + proxy_pass https://127.0.0.1:18443; + include /etc/nginx/dpl-subscribe-proxy.conf; + } + location = /api/v1/client/subscribe { + proxy_pass https://127.0.0.1:18443; + include /etc/nginx/dpl-subscribe-proxy.conf; + } + location / { return 404; } +} diff --git a/gateway.compose.yml b/gateway.compose.yml new file mode 100644 index 0000000..5e58667 --- /dev/null +++ b/gateway.compose.yml @@ -0,0 +1,50 @@ +name: dpl-sgw +services: + gateway: + image: sha256:d8807a5b2442bc25ce4fbc1312354b9dcbb0f538d75181ef735f4ea980760e70 + pull_policy: never + container_name: dpl-subscribe-gateway + restart: unless-stopped + mem_limit: 160m + cpus: 0.5 + ports: + - "127.0.0.1:18080:80" + - "127.0.0.1:18443:443" + environment: + V2B_BACKEND: https://dp-link.net + V2B_HOST: dp-link.net + REAL_IP_HEADER: X-Real-IP + AXISNOW_TRUSTED_IPS: 172.28.31.1 + volumes: + - config:/etc/nginx/subscribe + - logs:/var/log/subscribe + - /etc/letsencrypt:/etc/letsencrypt:ro + - /var/lib/dpl-sgw/ssl:/etc/nginx/ssl:ro + - ./gateway-nginx.conf:/etc/nginx/templates-src/nginx.conf:ro + networks: [dpl] + logging: {driver: json-file, options: {max-size: "5m", max-file: "2"}} + admin: + image: sha256:31ff8ea3e8f958a835edbd1579709017da75b742ff3a5984ea59d12ea0775577 + pull_policy: never + container_name: dpl-subscribe-admin + restart: unless-stopped + mem_limit: 128m + cpus: 0.5 + ports: + - "127.0.0.1:16444:64444" + env_file: /var/lib/dpl-sgw/admin.env + volumes: + - config:/etc/nginx/subscribe + - logs:/var/log/subscribe + - /etc/letsencrypt:/etc/letsencrypt:ro + - ./gateway-admin.conf:/etc/nginx/nginx.conf:ro + networks: [dpl] + logging: {driver: json-file, options: {max-size: "5m", max-file: "2"}} +volumes: + config: {name: dpl_sgw_config} + logs: {name: dpl_sgw_logs} +networks: + dpl: + name: dpl_sgw_net + ipam: + config: [{subnet: 172.28.31.0/24}]