From: root <root@localhost.localdomain>
Date: Tue, 18 Aug 2026 23:24:04 +0000 (+0800)
Subject: chore: 更新 nginx 跟踪副本, 补上 80/443 备案核验 server 块(与线上一致)
X-Git-Url: http://acesimba.cloud/gitweb/?a=commitdiff_plain;h=2ef78460d2b64b031ee36a6a32144f1db626a490;p=words.git

chore: 更新 nginx 跟踪副本, 补上 80/443 备案核验 server 块(与线上一致)
---

diff --git a/deploy/nginx-words-https.conf b/deploy/nginx-words-https.conf
index b53cc6d..f7a22e5 100644
--- a/deploy/nginx-words-https.conf
+++ b/deploy/nginx-words-https.conf
@@ -1,4 +1,4 @@
-# Words HTTPS 反向代理（方案 B：仅监听 8443，绝不占用 :55）
+# Words HTTPS 反向代理（方案 B：监听 8443 + 标准端口 80/443）
 # /            -> 同源前端 build-https (:8444)
 # /api/        -> 后端 FastAPI (:1060)
 server {
@@ -32,3 +32,60 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 }
+
+# Words HTTP 站点（仅 :80，供备案核验访问；同源前端 + /api 代理）
+# 注意：HTTP 非安全上下文，Service Worker 不激活，离线功能在 :80 不可用；
+#       实际学习与离线仍走 :8443（HTTPS）。
+server {
+    listen 80;
+    server_name acesimba.cloud;
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:1060;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:8444;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Words HTTPS 标准端口（:443，供备案核验；证书同 :8443，确保默认 HTTPS 可达）
+server {
+    listen 443 ssl;
+    server_name acesimba.cloud;
+
+    ssl_certificate     /etc/letsencrypt/live/acesimba.cloud/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/acesimba.cloud/privkey.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
+    ssl_session_cache   shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:1060;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:8444;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}