From 53bbbf31955b70d871428a551ce4a46f617e3244 Mon Sep 17 00:00:00 2001
From: qihu-bot <bot@qihuyun.com>
Date: Tue, 11 Aug 2026 08:55:49 +0800
Subject: [PATCH] =?UTF-8?q?#957=20nginx=20=E5=AE=B9=E5=99=A8=20root=20?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20-=20ai.qihuyun.com=20=E6=98=BE=E7=A4=BA=20?=
 =?UTF-8?q?nginx=20=E9=BB=98=E8=AE=A4=E9=A1=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

aiflow.conf 缺 server 级 root 指令导致 SPA fallback 走 nginx 默认 /usr/share/nginx/html. 修复后容器 8080 / host 12888 / 外部 ai.qihuyun.com 全部正确返回 544 bytes 七虎AI 前端页.
---
 docs/security/nginx-container-root-fix.md | 60 +++++++++++++++++++++++
 nginx/aiflow.conf                         |  6 ++-
 2 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 docs/security/nginx-container-root-fix.md

diff --git a/docs/security/nginx-container-root-fix.md b/docs/security/nginx-container-root-fix.md
new file mode 100644
index 0000000..26ec617
--- /dev/null
+++ b/docs/security/nginx-container-root-fix.md
@@ -0,0 +1,60 @@
+# nginx 容器 root 配置修复 (#957)
+
+## 问题
+2026-08-11 用户访问 ai.qihuyun.com 时浏览器显示 "Welcome to nginx!" 默认欢迎页。
+
+## 根因诊断
+经过逐步排查:
+
+1. **架构真相**: 平台有**两层 nginx**
+   - **宿主宝塔 nginx** (`/www/server/nginx/sbin/nginx` v1.30.1) — 监听 80/443
+   - **容器内 nginx** (`qihu-aiflow` 主容器内 v1.26.3) — 监听 8080,通过 docker-proxy 暴露为 12888
+   - ai.qihuyun.com.conf 在宝塔层**已经正确配置** `location ^~ / { proxy_pass http://127.0.0.1:12888; }`
+
+2. **真正的 bug** 在容器内 aiflow.conf:
+   - `location /` SPA fallback 块缺少 `root` 指令
+   - `location ~* \\.(svg|...)$` 块**有** `root /app/frontend/dist;`
+   - 但 `location /` 块没有 → nginx 用默认 `/usr/share/nginx/html`
+   - `/usr/share/nginx/html/index.html` 是 nginx 包默认安装的 615 bytes "Welcome to nginx" 页(2025-02-05 创建)
+
+3. **症状**: 访问 `/` → `try_files $uri $uri/ /index.html` → 回退到 `/index.html` → nginx 用默认 root 找到 nginx 默认 welcome.html (615 bytes),而非真实的 `/app/frontend/dist/index.html` (544 bytes 的 QihuAI 前端)
+
+## 修复
+
+在 server 块(server 级,所有 location 继承)添加 `root /app/frontend/dist;`:
+
+```nginx
+server {
+    listen 8080 default_server;
+    server_name _;
+    root /app/frontend/dist;     # <-- 新增(server 级)
+    
+    # location 块继承 server 级 root:
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
+```
+
+## 验证
+
+| 测试 | 修复前 | 修复后 |
+|------|--------|--------|
+| 容器内 `curl http://127.0.0.1:8080/` | 615 bytes "Welcome to nginx" | **544 bytes 七虎AI** ✅ |
+| 宿主 `curl http://127.0.0.1:12888/` | 615 bytes | **544 bytes** ✅ |
+| 外部 `curl https://ai.qihuyun.com/` | Welcome 页 | **544 bytes 七虎AI** ✅ |
+| `/app/api/chat/conversations` | 403 | **403 Not authenticated** ✅ (API 正常) |
+
+## 额外坑:nginx 多 master 累积
+
+排查过程中发现容器内有多个 nginx master/worker 进程同时运行:
+- PID 14, 10329, 10553, 10687, 11855, 15571 — 历史多次 reload 累积
+- 部分已成为 zombie(`State: Z`)
+- `nginx -s reload` 信号只发送给一个 master,其它 master 继续服务
+- **解决方案**: `nginx -s stop` (发送 TERM),kill -9 残留进程,清 `/var/run/nginx.pid`,然后 `nginx` 启动单一 master
+
+## safe-align
+- 修改文件: `/etc/nginx/conf.d/aiflow.conf` (容器内)
+- host git: `/www/wwwroot/qihuaiflow/nginx/aiflow.conf`
+- commit: #957
+
diff --git a/nginx/aiflow.conf b/nginx/aiflow.conf
index 7b68995..38a51cb 100644
--- a/nginx/aiflow.conf
+++ b/nginx/aiflow.conf
@@ -14,6 +14,7 @@ include /etc/nginx/blocked_ips.conf;
 server {
     listen 8080 default_server;
     server_name _;
+    root /app/frontend/dist;
 
     client_max_body_size 100m;
     client_body_timeout 30s;
@@ -53,8 +54,9 @@ server {
         add_header Cache-Control "public, max-age=2592000";
     }
 
-    # SPA fallback
+    # SPA fallback (root 是必须的,否则 nginx 会用默认 /usr/share/nginx/html 给出 welcome 页)
     location / {
+        root /app/frontend/dist;
         try_files $uri $uri/ /index.html;
     }
 
@@ -128,3 +130,5 @@ server {
 
 
 
+
+