feat(observe): 生产部署(单机)—— 硬化 compose + nginx 反代 + README(SSH隧道/保留期/专用账号)

- docker-compose.prod.yml: 只绑 127.0.0.1、命名卷、mem 1g、密码走 .env(:? 守卫) - nginx/observe.shaguabijia.com.conf: 子域名反代 + IP白名单 + TLS + WS 透传 - .gitignore: 忽略 prod 密码 .env - README: 生产部署步骤 + UI 访问两方案(SSH隧道推荐) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-06 14:38:26 +08:00
parent 964032d16f
commit 00404c8b45
4 changed files with 121 additions and 1 deletions
@@ -0,0 +1,47 @@
+# OpenObserve 监控台反代(单独子域名)。前提:
+#   - DNS: observe.shaguabijia.com A 记录 → 本机公网 IP
+#   - 证书: /etc/nginx/ssl/observe.shaguabijia.com.pem|.key(同现有域名放法)
+#   - OpenObserve 只绑 127.0.0.1:5080(见 docker-compose.prod.yml)
+# 三重防护:IP 白名单 + nginx TLS + OpenObserve 自身登录。
+# 只你/少数人看的话,更省事的是 SSH 隧道(README「UI 访问」方案 A),不用域名/证书。
+
+# 80 → 301 → 443
+server {
+    listen 80;
+    listen [::]:80;
+    server_name observe.shaguabijia.com;
+    return 301 https://$host$request_uri;
+}
+
+# 443 SSL 反代到本地 OpenObserve (127.0.0.1:5080)
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name observe.shaguabijia.com;
+
+    ssl_certificate     /etc/nginx/ssl/observe.shaguabijia.com.pem;
+    ssl_certificate_key /etc/nginx/ssl/observe.shaguabijia.com.key;
+
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
+    ssl_session_cache   shared:SSL:10m;
+
+    # ★ 只放行你的固定出口 IP(办公/家宽)。监控台不必对全网开。
+    allow 1.2.3.4;      # ← 换成真实 IP,可多行
+    deny  all;
+
+    client_max_body_size 10m;
+
+    location / {
+        proxy_pass http://127.0.0.1:5080;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # OpenObserve 有实时/流式,需透传 WebSocket
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 300s;
+    }
+}