From 3178a2cc31f7d442809da46482534e3198989d6e Mon Sep 17 00:00:00 2001 From: eezd Date: Mon, 26 Oct 2026 12:04:44 +0800 Subject: [PATCH] Align deployment ports and trusted proxy configuration Run the dedicated calendar worker, bind the web service to loopback port 21005, and match the host nginx upstream. Trust forwarded headers only from the Docker subnet and replace untrusted forwarded client chains at the public proxy. Validate Compose without resolving production environment files; do not restart services. --- deploy/docker-compose.yml | 8 ++++++-- deploy/nginx/alpha.134333.xyz.conf | 6 +++--- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml index e7c81cd..147e150 100644 --- a/deploy/docker-compose.yml +++ b/deploy/docker-compose.yml @@ -12,7 +12,7 @@ x-backend: &backend services: api: <<: *backend - command: [uvicorn, alphapulse.api.main:app, --host, 0.0.0.0, --port, "8000", --proxy-headers, --forwarded-allow-ips, "*"] + command: [uvicorn, alphapulse.api.main:app, --host, 0.0.0.0, --port, "8000", --proxy-headers, --forwarded-allow-ips, "172.18.0.0/16"] crawler: <<: *backend @@ -28,6 +28,10 @@ services: <<: *backend command: [python, -m, alphapulse.trading.engine] + calendar: + <<: *backend + command: [python, -m, alphapulse.calendar.worker] + web: build: context: ../web @@ -35,7 +39,7 @@ services: restart: unless-stopped depends_on: [api] ports: - - 127.0.0.1:21030:80 + - 127.0.0.1:21005:80 networks: [dev_default] networks: diff --git a/deploy/nginx/alpha.134333.xyz.conf b/deploy/nginx/alpha.134333.xyz.conf index b1d645d..af8acef 100644 --- a/deploy/nginx/alpha.134333.xyz.conf +++ b/deploy/nginx/alpha.134333.xyz.conf @@ -1,4 +1,4 @@ -# alpha.134333.xyz -> AlphaPulse web 容器（127.0.0.1:21030） +# alpha.134333.xyz -> AlphaPulse web 容器（127.0.0.1:21005） server { listen 80; @@ -16,7 +16,7 @@ server { error_log /var/log/nginx/alpha.134333.xyz.error.log warn; location / { - proxy_pass http://127.0.0.1:21030; + proxy_pass http://127.0.0.1:21005; proxy_http_version 1.1; # SSE 不缓冲；WebSocket 需要升级头 proxy_buffering off; @@ -25,7 +25,7 @@ server { proxy_set_header Host $http_host; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-For $remote_addr; proxy_read_timeout 1h; } }