chore: 更新 nginx 跟踪副本, 补上 80/443 备案核验 server 块(与线上一致)

diff --git a/deploy/nginx-words-https.conf b/deploy/nginx-words-https.conf
index b53cc6dfbac981b9771fd3e338edf376133d4e15..f7a22e5af48680e3cb617cf1f18200302d70ea80 100644 (file)
--- a/deploy/nginx-words-https.conf
+++ b/deploy/nginx-words-https.conf
@@ -1,4 +1,4 @@
-# Words HTTPS 反向代理（方案 B：仅监听 8443，绝不占用 :55）
+# Words HTTPS 反向代理（方案 B：监听 8443 + 标准端口 80/443）
 # /            -> 同源前端 build-https (:8444)
 # /api/        -> 后端 FastAPI (:1060)
 server {
@@ -32,3 +32,60 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 }
+
+# Words HTTP 站点（仅 :80，供备案核验访问；同源前端 + /api 代理）
+# 注意：HTTP 非安全上下文，Service Worker 不激活，离线功能在 :80 不可用；
+#       实际学习与离线仍走 :8443（HTTPS）。
+server {
+    listen 80;
+    server_name acesimba.cloud;
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:1060;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:8444;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Words HTTPS 标准端口（:443，供备案核验；证书同 :8443，确保默认 HTTPS 可达）
+server {
+    listen 443 ssl;
+    server_name acesimba.cloud;
+
+    ssl_certificate     /etc/letsencrypt/live/acesimba.cloud/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/acesimba.cloud/privkey.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
+    ssl_session_cache   shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:1060;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:8444;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}