公网访问加固

{
  "web_host": "127.0.0.1",
  "web_port": 9899,
  "web_password": "<强密码>"
}

location / {
    proxy_pass http://127.0.0.1:9899;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # WebSocket / 流式输出必须放行，否则"页面能开但对话不动"
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 600s;
    proxy_buffering off;

    client_max_body_size 32m;   # 上传文件、语音
}

location / {
    auth_request /portal/api/check;   # 401 则跳登录
    error_page 401 = @to_portal;
    proxy_pass http://127.0.0.1:9899;
}
location @to_portal { return 302 /portal/; }

# 只允许公司出口 IP 访问控制台
location / {
    allow 203.0.113.10;
    deny all;
    proxy_pass http://127.0.0.1:9899;
}