feat(rednote): add isolated persistent browser H5 entry

2026-10-19 22:59:10 +08:00
parent 9eec4369da
commit 4af825a5e4
24 changed files with 707 additions and 45 deletions
@@ -0,0 +1,27 @@
+[Unit]
+Description=1me rednote H5 - isolated browser identities
+After=network.target
+
+[Service]
+Type=simple
+User=ubuntu
+WorkingDirectory=/home/ubuntu/juzi-rednote/current/h5
+Environment=JUZI_ENTRY_MODE=rednote
+Environment=NODE_ENV=production
+Environment=HOST=127.0.0.1
+Environment=PORT=8081
+Environment=PUBLIC_BASE_URL=https://1me.xajuzi.com/rednote/
+Environment=JUZI_DATA_ROOT=/home/ubuntu/juzi-rednote-data
+Environment=JUZI_PROTECTED_DATA_ROOT=/home/ubuntu/juzi/h5/data
+Environment=TRUST_LOOPBACK_PROXY=1
+EnvironmentFile=/etc/juzi/rednote.env
+ExecStart=/usr/bin/node /home/ubuntu/juzi-rednote/current/h5/server.js
+Restart=on-failure
+RestartSec=3
+NoNewPrivileges=true
+PrivateTmp=true
+ReadOnlyPaths=/home/ubuntu/juzi
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,42 @@
+# Insert into the EXISTING HTTPS server during an authorized deployment.
+# Retain all /state/, /api/, TLS and WeChat verification locations unchanged.
+location = /rednote {
+    return 301 /rednote/;
+}
+location = /rednote/admin.html {
+    auth_basic "juzi admin";
+    auth_basic_user_file /etc/nginx/.htpasswd-juzi;
+    proxy_pass http://127.0.0.1:8081/admin.html;
+    proxy_set_header Host $host;
+}
+location = /rednote/css/admin.css {
+    auth_basic "juzi admin";
+    auth_basic_user_file /etc/nginx/.htpasswd-juzi;
+    proxy_pass http://127.0.0.1:8081/css/admin.css;
+}
+location = /rednote/js/admin.js {
+    auth_basic "juzi admin";
+    auth_basic_user_file /etc/nginx/.htpasswd-juzi;
+    proxy_pass http://127.0.0.1:8081/js/admin.js;
+}
+location ^~ /rednote/api/admin/ {
+    auth_basic "juzi admin";
+    auth_basic_user_file /etc/nginx/.htpasswd-juzi;
+    proxy_pass http://127.0.0.1:8081/api/admin/;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 150s;
+}
+location ^~ /rednote/data/ {
+    return 404;
+}
+location /rednote/ {
+    client_max_body_size 20m;
+    proxy_pass http://127.0.0.1:8081/;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 150s;
+}