P1-2 nginx 限流 + 扫描器拦截 (20260810-153624)

三档限流 (api 30r/s, admin 5r/s, login 1r/s) + UA / path 黑名单 (return 444) + 自动黑名单脚本 (5min cron, 24h TTL). 实测首跑封禁 222.128.55.233 (4xx=31) 和 120.55.61.72 (UA=zgrab).

nginx/aiflow.conf

@@ -0,0 +1,129 @@
+# 七虎 AI PaaS nginx site — enhanced with rate limiting + scanner defense
+# Owner: 七虎平台运维 (Senior Developer)
+# 维护: edit on host /app/backend/nginx/aiflow.conf, push to container /etc/nginx/conf.d/aiflow.conf
+# 重载: docker exec qihu-aiflow sh -c "nginx -t && nginx -s stop && nginx"
+
+# 三档速率限制
+limit_req_zone $binary_remote_addr zone=api_limit:10m rate=30r/s;
+limit_req_zone $binary_remote_addr zone=admin_limit:10m rate=5r/s;
+limit_req_zone $binary_remote_addr zone=login_limit:1m rate=1r/s;
+
+# 动态黑名单(由 /app/backend/nginx/block_ip.py 写入)
+include /etc/nginx/blocked_ips.conf;
+
+server {
+    listen 8080 default_server;
+    server_name _;
+
+    client_max_body_size 100m;
+    client_body_timeout 30s;
+    keepalive_timeout 75s;
+
+    gzip off;
+
+    # ===== 反扫描器: bad URI 直接 444 =====
+    if ($request_uri ~* "^/(wp-admin|wp-login|xmlrpc\.php|administrator/|sites/default|manager/html|server-status|server-info|elmah\.axd|web\.config|readme|license\.txt|install\.php|shell\.php)") {
+        return 444;
+    }
+    if ($request_uri ~* "^/(phpmyadmin|\.env|\.git/|actuator|actuator/|\.well-known/security)") {
+        return 444;
+    }
+    if ($http_user_agent ~* "(zgrab|nmap|masscan|nikto|sqlmap|acunetix|nessus|wpscan|dirbuster|gobuster|ffuf|hydra|metasploit|MJ12bot|AhrefsBot|SemrushBot|DotBot|PetalBot|Aspera|HTTrack|Scrapy|libwww|Havij|TSWeb)") {
+        return 444;
+    }
+    if ($http_user_agent ~* "(^curl/|^wget/|^python-requests)") {
+        return 444;
+    }
+
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log warn;
+
+    # 索引 HTML 不缓存
+    location = /index.html {
+        add_header Cache-Control "no-cache";
+        try_files /index.html =404;
+    }
+
+    # 静态资源永久缓存
+    location ~* \.(svg|png|jpg|jpeg|gif|ico|webp|woff2?|ttf|eot|css|js|map)$ {
+        root /app/frontend/dist;
+        try_files $uri =404;
+        access_log off;
+        expires 30d;
+        add_header Cache-Control "public, max-age=2592000";
+    }
+
+    # SPA fallback
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    # ===== 普通 API: 30r/s =====
+    location /app/ {
+        limit_req zone=api_limit burst=60 nodelay;
+        proxy_pass http://localhost:18080/app/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 600s;
+        proxy_connect_timeout 10s;
+    }
+
+    # ===== ADMIN API: 5r/s 严格 =====
+    location ~ ^/app/api/(admin/|market/admin/|internal/) {
+        limit_req zone=admin_limit burst=10 nodelay;
+        proxy_pass http://localhost:18080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+    }
+
+    # ===== AUTH: 1r/s 防爆破 =====
+    location ~ ^/app/api/(auth/login|auth/register|casdoor/) {
+        limit_req zone=login_limit burst=5 nodelay;
+        proxy_pass http://localhost:18080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 60s;
+        proxy_send_timeout 60s;
+    }
+
+    # ===== SSE STREAMING: 禁缓冲 长连接 =====
+    location ~ ^/app/(api/chat/events|api/pet/) {
+        proxy_pass http://localhost:18080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection "";
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_request_buffering off;
+        proxy_http_version 1.1;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+        chunked_transfer_encoding on;
+    }
+
+    # 健康检查
+    location = /health {
+        access_log off;
+        return 200 "ok\n";
+        add_header Content-Type text/plain;
+    }
+
+    # 405/413 nice error
+    error_page 413 /custom_413;
+    location = /custom_413 {
+        internal;
+        return 413 "Payload Too Large\n";
+    }
+}
+
+