chenlin
0d986f60bd
web-platform-ci / Standalone decision service (no cloud credentials) (push) Has been cancelled
web-platform-ci / TypeScript, lint, unit, build (push) Has been cancelled
web-platform-ci / Playwright E2E (push) Has been cancelled
lekiwi-compatibility / cpu-compatibility (push) Has been cancelled
集成服务器托管模型、自然语言移动与有界抓放、内置 LeKiwi URL 导入和双摄像头；同步部署契约与指定域名 iframe 白名单，保留原有物理安全、会话及调用预算防护。 更新 npm 包及锁文件版本、CHANGELOG 与发布文档。提交前 typecheck、120 项定向前端测试和 44 项后端测试通过（3 项可选跳过）；真实 v2 云模型抓放仍待单独验收，不包含运行密钥或构建产物。
64 lines
3.0 KiB
Plaintext
64 lines
3.0 KiB
Plaintext
# Managed by CADWorld deployment, not a replacement for 1Panel's main config.
|
|
limit_req_zone $binary_remote_addr zone=cadworld_api:10m rate=10r/s;
|
|
server {
|
|
listen 80;
|
|
server_name cadworld-sim.robotquan.com;
|
|
location ^~ /.well-known/acme-challenge/ {
|
|
root /www/acme/cadworld-sim.robotquan.com;
|
|
default_type text/plain;
|
|
}
|
|
location / { return 301 https://cadworld-sim.robotquan.com$request_uri; }
|
|
}
|
|
server {
|
|
listen 443 ssl http2;
|
|
server_name cadworld-sim.robotquan.com;
|
|
ssl_certificate /www/ssl/cadworld-sim.robotquan.com/live/cadworld-sim.robotquan.com/fullchain.pem;
|
|
ssl_certificate_key /www/ssl/cadworld-sim.robotquan.com/live/cadworld-sim.robotquan.com/privkey.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_session_cache shared:CADWorldTLS:10m;
|
|
ssl_session_timeout 1d;
|
|
root /www/sites/cadworld-sim.robotquan.com/current;
|
|
index index.html;
|
|
autoindex off;
|
|
client_max_body_size 64k;
|
|
client_body_timeout 15s;
|
|
keepalive_timeout 30s;
|
|
server_tokens off;
|
|
add_header Strict-Transport-Security "max-age=31536000" always;
|
|
add_header X-Content-Type-Options nosniff always;
|
|
add_header Referrer-Policy no-referrer always;
|
|
# CSP allowlist supports the approved sibling-origin iframe; X-Frame-Options
|
|
# DENY/SAMEORIGIN would block it in legacy clients (ALLOW-FROM is obsolete).
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; worker-src 'self' blob:; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'self' https://cadworld.robotquan.com; form-action 'none'" always;
|
|
# Hash assets cache; all headers remain inherited (no nested add_header).
|
|
set $cadworld_cache "no-cache";
|
|
if ($uri ~ ^/assets/) { set $cadworld_cache "public, max-age=31536000, immutable"; }
|
|
if ($uri ~ ^/pyodide/) { set $cadworld_cache "public, max-age=86400"; }
|
|
if ($uri ~ ^/api/) { set $cadworld_cache "no-store"; }
|
|
add_header Cache-Control $cadworld_cache always;
|
|
location ^~ /api/decision/v1/ {
|
|
access_log off;
|
|
limit_req zone=cadworld_api burst=20 nodelay;
|
|
limit_req_status 429;
|
|
proxy_pass http://127.0.0.1:8768;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host cadworld-sim.robotquan.com;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header Forwarded "";
|
|
proxy_set_header Connection "";
|
|
proxy_connect_timeout 5s;
|
|
proxy_read_timeout 70s;
|
|
proxy_send_timeout 15s;
|
|
proxy_buffering off;
|
|
proxy_hide_header Cache-Control;
|
|
}
|
|
location ^~ /api/ { return 404; }
|
|
location ^~ /physics/ { return 404; }
|
|
location = /tuning.html { return 404; }
|
|
location ~ /\. { return 404; }
|
|
location ~ \.wasm$ { types { application/wasm wasm; } try_files $uri =404; }
|
|
location / { try_files $uri $uri/ =404; }
|
|
}
|