From 088a24c3a946973449cbba1728a8ea7c1197ae5e Mon Sep 17 00:00:00 2001 From: lunanting Date: Sat, 12 Sep 2026 16:11:05 +0800 Subject: [PATCH] fix: route bootstrap HTTPS through port 8443 --- .../src/services/remoteEnrollmentService.js | 2 +- backend/test/remoteEnrollmentService.test.js | 2 +- frontend/src/pages/Install/index.jsx | 4 ++-- remote-access/README.md | 4 ++-- remote-access/server/install.sh | 4 ++-- remote-access/server/nginx-bootstrap.conf | 20 +++---------------- scripts/setup-remote.mjs | 2 +- 7 files changed, 12 insertions(+), 26 deletions(-) diff --git a/backend/src/services/remoteEnrollmentService.js b/backend/src/services/remoteEnrollmentService.js index 020f368..d9aed7c 100644 --- a/backend/src/services/remoteEnrollmentService.js +++ b/backend/src/services/remoteEnrollmentService.js @@ -6,7 +6,7 @@ const { pathToFileURL } = require('url'); const REPOSITORY_ROOT = path.resolve(__dirname, '../../..'); const SETUP_MODULE_PATH = path.join(REPOSITORY_ROOT, 'scripts', 'setup-remote.mjs'); const RESTART_MARKER_PATH = path.join(REPOSITORY_ROOT, '.remote-access', 'restart-requested.json'); -const DEFAULT_BOOTSTRAP_ENDPOINT = 'https://ck.yydd.ai/v1/enroll'; +const DEFAULT_BOOTSTRAP_ENDPOINT = 'https://ck.yydd.ai:8443/v1/enroll'; function normalizeEndpoint(value) { const endpoint = new URL(String(value || DEFAULT_BOOTSTRAP_ENDPOINT).trim()); diff --git a/backend/test/remoteEnrollmentService.test.js b/backend/test/remoteEnrollmentService.test.js index 1f527c9..563e961 100644 --- a/backend/test/remoteEnrollmentService.test.js +++ b/backend/test/remoteEnrollmentService.test.js @@ -8,7 +8,7 @@ const { test('remote enrollment defaults to the managed HTTPS endpoint', () => { assert.equal(normalizeEndpoint(''), DEFAULT_BOOTSTRAP_ENDPOINT); - assert.equal(normalizeEndpoint('https://ck.yydd.ai/v1/enroll'), 'https://ck.yydd.ai/v1/enroll'); + assert.equal(normalizeEndpoint('https://ck.yydd.ai:8443/v1/enroll'), 'https://ck.yydd.ai:8443/v1/enroll'); }); test('remote enrollment refuses insecure or credential-bearing endpoints', () => { diff --git a/frontend/src/pages/Install/index.jsx b/frontend/src/pages/Install/index.jsx index ba8019c..30e6fce 100644 --- a/frontend/src/pages/Install/index.jsx +++ b/frontend/src/pages/Install/index.jsx @@ -332,7 +332,7 @@ const Install = () => {
{ { type: 'url', message: '请输入有效的 HTTPS 地址' }, ]} > - + /dev/null -ufw allow 443/tcp comment 'HTTPS' >/dev/null +ufw allow 8443/tcp comment 'Cangku bootstrap HTTPS' >/dev/null systemctl reload nginx for _ in {1..20}; do - if curl --silent --show-error --fail https://ck.yydd.ai/health >/dev/null; then + if curl --silent --show-error --fail https://ck.yydd.ai:8443/health >/dev/null; then exit 0 fi sleep 0.5 diff --git a/remote-access/server/nginx-bootstrap.conf b/remote-access/server/nginx-bootstrap.conf index 9f4f35b..ff30898 100644 --- a/remote-access/server/nginx-bootstrap.conf +++ b/remote-access/server/nginx-bootstrap.conf @@ -1,22 +1,8 @@ limit_req_zone $binary_remote_addr zone=cangku_bootstrap_limit:10m rate=5r/m; server { - listen 80; - listen [::]:80; - server_name ck.yydd.ai; - - location /.well-known/acme-challenge/ { - root /var/www/cangku-bootstrap-acme; - } - - location / { - return 301 https://ck.yydd.ai$request_uri; - } -} - -server { - listen 443 ssl; - listen [::]:443 ssl; + listen 8443 ssl; + listen [::]:8443 ssl; server_name ck.yydd.ai; ssl_certificate /etc/letsencrypt/live/ck.yydd.ai/fullchain.pem; @@ -40,7 +26,7 @@ server { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Proto https; proxy_read_timeout 20s; } diff --git a/scripts/setup-remote.mjs b/scripts/setup-remote.mjs index d0dda25..4771392 100644 --- a/scripts/setup-remote.mjs +++ b/scripts/setup-remote.mjs @@ -16,7 +16,7 @@ import { const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url)); const ROOT_DIR = path.resolve(SCRIPT_DIR, '..'); const ACCESS_DIR = path.join(ROOT_DIR, '.remote-access'); -export const DEFAULT_ENDPOINT = 'https://ck.yydd.ai/v1/enroll'; +export const DEFAULT_ENDPOINT = 'https://ck.yydd.ai:8443/v1/enroll'; const DEFAULT_LOCAL_DB_PORT = 13307; function parseArgs(args) {