2026-08-24Nginx跳板机配置，中转程序连接阿里云和本地程序

worker_processes  auto;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /usr/local/openresty/nginx/conf/mime.types;
    default_type  application/octet-stream;

    # ==================== 日志格式 ====================
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for" '
                    'upstream_addr=$upstream_addr upstream_status=$upstream_status '
                    'request_time=$request_time';

    access_log  /var/log/nginx/access.log  main;

    # ==================== 性能优化 ====================
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;

    # 海康ISC平台涉及视频/图片等资源传输，需要放大请求体限制
    client_max_body_size 500m;
    client_body_buffer_size 10m;
    client_body_temp_path /var/lib/nginx/tmp;

    # ==================== 上海海康ISC ====================
    upstream shanghai_isc {
        server 192.168.1.123;    # ← 替换为上海海康ISCIP
        keepalive 32;
    }

    server {
        listen 8081;
        server_name _;

        # 安全：只允许云端程序服务器 IP 访问
        #allow 云端程序服务器IP/32;    # ← 替换为云端程序的实际公网 IP
        #deny all;

        # 访问日志（单独文件，方便排查）
        access_log /var/log/nginx/shanghai_isc_access.log main;
        error_log  /var/log/nginx/shanghai_isc_error.log warn;

        location / {
            proxy_pass http://shanghai_isc;

            proxy_http_version 1.1;
            proxy_set_header Connection "";

            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # 海康ISC接口涉及视频流等大数据量传输，超时设置需充裕
            proxy_connect_timeout 30s;
            proxy_send_timeout    300s;
            proxy_read_timeout    300s;
        }
    }

    # ==================== 北京海康ISC ====================
    upstream beijing_isc {
        server 192.168.1.123;    # ← 替换为北京海康ISCIP
        keepalive 32;
    }

    server {
        listen 8082;
        server_name 127.0.0.1;

        # 安全：只允许云端程序服务器 IP 访问
        #allow 云端程序服务器IP/32;    # ← 替换为云端程序的实际公网 IP
        #deny all;

        # 访问日志（单独文件，方便排查）
        access_log /var/log/nginx/beijing_isc_access.log main;
        error_log  /var/log/nginx/beijing_isc_error.log warn;

        location / {
            proxy_pass http://beijing_isc;

            proxy_http_version 1.1;
            proxy_set_header Connection "";

            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # 海康ISC接口涉及视频流等大数据量传输，超时设置需充裕
            proxy_connect_timeout 30s;
            proxy_send_timeout    300s;
            proxy_read_timeout    300s;
        }
    }
}