eezd/AlphaPulse
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Align deployment ports and trusted proxy configuration

Browse Source 
Run the dedicated calendar worker, bind the web service to loopback port 21005, and match the host nginx upstream.

Trust forwarded headers only from the Docker subnet and replace untrusted forwarded client chains at the public proxy. Validate Compose without resolving production environment files; do not restart services.
This commit is contained in:
eezd committed 2026-10-26 12:04:44 +08:00
1 parent f67a8ca402
commit 3178a2cc31
2 files changed
+9 -5
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

deploy/docker-compose.yml
+6 -2
View File
@@ -12,7 +12,7 @@ x-backend: &backend
services: services:
api: api:
<<: *backend <<: *backend
command: [uvicorn, alphapulse.api.main:app, --host, 0.0.0.0, --port, "8000", --proxy-headers, --forwarded-allow-ips, "*"] command: [uvicorn, alphapulse.api.main:app, --host, 0.0.0.0, --port, "8000", --proxy-headers, --forwarded-allow-ips, "172.18.0.0/16"]
crawler: crawler:
<<: *backend <<: *backend
@@ -28,6 +28,10 @@ services:
<<: *backend <<: *backend
command: [python, -m, alphapulse.trading.engine] command: [python, -m, alphapulse.trading.engine]
calendar:
<<: *backend
command: [python, -m, alphapulse.calendar.worker]
web: web:
build: build:
context: ../web context: ../web
@@ -35,7 +39,7 @@ services:
restart: unless-stopped restart: unless-stopped
depends_on: [api] depends_on: [api]
ports: ports:
- 127.0.0.1:21030:80 - 127.0.0.1:21005:80
networks: [dev_default] networks: [dev_default]
networks: networks:
deploy/nginx/alpha.134333.xyz.conf
+3 -3
View File
@@ -1,4 +1,4 @@
# alpha.134333.xyz -> AlphaPulse web 容器（127.0.0.1:21030） # alpha.134333.xyz -> AlphaPulse web 容器（127.0.0.1:21005）
server { server {
listen 80; listen 80;
@@ -16,7 +16,7 @@ server {
error_log /var/log/nginx/alpha.134333.xyz.error.log warn; error_log /var/log/nginx/alpha.134333.xyz.error.log warn;
location / { location / {
proxy_pass http://127.0.0.1:21030; proxy_pass http://127.0.0.1:21005;
proxy_http_version 1.1; proxy_http_version 1.1;
# SSE 不缓冲；WebSocket 需要升级头 # SSE 不缓冲；WebSocket 需要升级头
proxy_buffering off; proxy_buffering off;
@@ -25,7 +25,7 @@ server {
proxy_set_header Host $http_host; proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $remote_addr;
proxy_read_timeout 1h; proxy_read_timeout 1h;
} }
} }