feat(mobile,deploy): 接入安卓极光与华为通道并准备公网部署配置

客户端默认指向 jxd.jinniu.ink 的 HTTPS/WSS；登录后把 OpenIM userID 设为极光 alias。华为 agconnect-services.json 不伪造、不入库。Master Secret 只从服务器文件注入。 Co-authored-by: multica-agent <github@multica.ai>
2026-08-30 21:32:58 +08:00
parent f35e1f03d5
commit f1fe4a3928
35 changed files with 687 additions and 64 deletions
@@ -0,0 +1,120 @@
+# 公网测试：jxd.jinniu.ink 终止 TLS，反代到本机回环上的 OpenIM / 账号 / 对象存储 / LiveKit。
+worker_processes auto;
+error_log /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 4096;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    sendfile on;
+    server_tokens off;
+    client_max_body_size 100m;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+
+    upstream openim_api {
+        server 127.0.0.1:10002;
+    }
+    upstream openim_ws {
+        server 127.0.0.1:10001;
+    }
+    upstream account_api {
+        server 127.0.0.1:10010;
+    }
+    upstream minio_s3 {
+        server 127.0.0.1:10005;
+    }
+    upstream livekit_signal {
+        server 127.0.0.1:17880;
+    }
+
+    server {
+        listen 80;
+        listen [::]:80;
+        server_name jxd.jinniu.ink;
+
+        location /.well-known/acme-challenge/ {
+            root /var/www/acme;
+        }
+
+        location / {
+            return 301 https://$host$request_uri;
+        }
+    }
+
+    server {
+        listen 443 ssl http2;
+        listen [::]:443 ssl http2;
+        server_name jxd.jinniu.ink;
+
+        ssl_certificate /etc/letsencrypt/live/jxd.jinniu.ink/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/jxd.jinniu.ink/privkey.pem;
+        ssl_session_timeout 1d;
+        ssl_session_cache shared:SSL:10m;
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_prefer_server_ciphers off;
+
+        # OpenIM 消息长连接
+        location /msg_gateway {
+            proxy_pass http://openim_ws/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
+        }
+
+        # 公司账号服务（登录、管理页、rtc_token）
+        location /account/ {
+            proxy_pass http://account_api/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        # MinIO 对象（MINIO_EXTERNAL_ADDRESS=https://jxd.jinniu.ink/files）
+        location /files/ {
+            proxy_pass http://minio_s3/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_request_buffering off;
+        }
+
+        # LiveKit 信令（客户端 wss://jxd.jinniu.ink/livekit → 容器 /rtc 等）
+        location /livekit/ {
+            proxy_pass http://livekit_signal/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
+        }
+
+        # OpenIM REST API（catch-all，须放最后）
+        location / {
+            proxy_pass http://openim_api;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+}