Merge pull request 'Tiananlin patch 1' (#1) from tiananlin-patch-1 into master

Reviewed-on: #1

Dockerfiles/Dockerfile-admin/Dockerfile

@@ -26,16 +26,16 @@ RUN pnpm install --frozen-lockfile --fetch-timeout 300000
 COPY . .
 
 # 构建项目
-RUN npm run build:pro
+RUN npm run build:admin
 
 # 部署阶段
 FROM registry-vpc.cn-chengdu.aliyuncs.com/zhixueli-prod/nginx:alpine
 
 # 复制构建产物到 Nginx 目录
-COPY --from=builder --chown=nginx:nginx /app/dist /usr/share/nginx/html
+COPY --from=builder --chown=nginx:nginx /app/dist-admin /usr/share/nginx/html
 
 # 复制 Nginx 配置
-COPY Dockerfiles/default.conf /etc/nginx/conf.d/default.conf
+COPY Dockerfiles/Dockerfile-admin/default.conf /etc/nginx/conf.d/default.conf
 
 # 暴露端口
 EXPOSE 80

Dockerfiles/Dockerfile-public/Dockerfile

@@ -0,0 +1,44 @@
+# 构建阶段
+FROM registry-vpc.cn-chengdu.aliyuncs.com/zhixueli-prod/node:18.20.3 AS builder 
+
+# 设置工作目录
+WORKDIR /app
+
+# 设置 npm 镜像源
+RUN npm config set registry https://registry.npmmirror.com/
+RUN npm config set fetch-retries 3
+RUN npm config set fetch-retry-mintimeout 5000
+RUN npm config set fetch-retry-maxtimeout 60000
+
+# 安装pnpm
+RUN npm install -g pnpm@10.16.1
+
+# 复制 package.json
+COPY package.json pnpm-lock.yaml ./
+
+# 设置 pnpm 下载源
+RUN pnpm config set registry https://registry.npmmirror.com/
+
+# 安装依赖
+RUN pnpm install --frozen-lockfile --fetch-timeout 300000
+
+# 复制源代码
+COPY . .
+
+# 构建项目
+RUN npm run build:public
+
+# 部署阶段
+FROM registry-vpc.cn-chengdu.aliyuncs.com/zhixueli-prod/nginx:alpine
+
+# 复制构建产物到 Nginx 目录
+COPY --from=builder --chown=nginx:nginx /app/dist-public /usr/share/nginx/html
+
+# 复制 Nginx 配置
+COPY Dockerfiles/Dockerfile-public/default.conf /etc/nginx/conf.d/default.conf
+
+# 暴露端口
+EXPOSE 80
+
+# 启动 Nginx
+CMD ["nginx", "-g", "daemon off;"]

Dockerfiles/Dockerfile-public/default.conf

@@ -0,0 +1,45 @@
+server {
+    listen 80;
+    server_name _;
+
+    client_max_body_size 100m;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    add_header X-Robots-Tag "noindex, nofollow" always;
+
+    # 公开构建中的 sw.js 只负责注销该域名历史遗留的后台 PWA。
+    location = /sw.js {
+        add_header Cache-Control "no-store, no-cache, must-revalidate";
+        try_files $uri =404;
+    }
+
+    location = /index.html {
+        add_header Cache-Control "no-store, no-cache, must-revalidate";
+        try_files $uri =404;
+    }
+
+    # 员工域名只允许入职公开接口。内部后端路由不包含外层 /api。
+    location ^~ /api/open/onboarding/ {
+        proxy_pass http://onboardx-api-svc:5566/open/onboarding/;
+        proxy_http_version 1.1;
+        proxy_request_buffering off;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 60s;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+
+    # 公开域名拒绝系统、后台业务及其他 API。
+    location ^~ /api/ {
+        return 404;
+    }
+
+    # Hash 路由的有效链接在服务器看来也是根路径，必须返回公开版 index.html。
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}