GithubBackup/BackupX
1
0
Fork 0
mirror of https://github.com/Awuqing/BackupX.git synced 2026-08-21 16:23:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs: 完善部署与运维文档 (#107)

Browse Source 
新增中英文升级恢复、安全加固、监控告警与故障排查手册，校正安装部署、CLI 与 API 参考，并修复安全密钥环境变量注入及其回归测试。
This commit is contained in:
Wu Qing
2026-08-09 13:51:38 +08:00
committed by GitHub
parent 5827074334
commit bdd16dafa8
35 changed files with 1844 additions and 317 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
docs-site/docs/deployment/nginx.md
View File

@@ -29,6 +29,7 @@ server {
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header Connection "";
# Large uploads (restore flow)
client_max_body_size 0;
@@ -36,9 +37,28 @@ server {
# Live log stream uses SSE — buffering must be off
proxy_buffering off;
proxy_cache off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
# Compatibility route for installers generated by older releases.
# Current installers use /api/install/ through the API block above.
location /install/ {
proxy_pass http://127.0.0.1:8340/install/;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Port $server_port;
}
# Keep probes and metrics out of the SPA fallback.
location = /health { proxy_pass http://127.0.0.1:8340/health; }
location = /ready { proxy_pass http://127.0.0.1:8340/ready; }
location = /metrics { proxy_pass http://127.0.0.1:8340/metrics; }
}
```
@@ -46,6 +66,8 @@ server {
If Nginx runs on another host or in another container, add only that proxy IP or subnet to `server.trusted_proxies`. Do not use `0.0.0.0/0`; BackupX uses the trusted client address for login throttling, install-token throttling, and audit records.
`/health`, `/ready`, and `/metrics` do not require BackupX authentication. Allow probe and Prometheus source networks explicitly, or keep these locations on an internal listener instead of exposing them to the Internet.
## HTTPS with certbot
```bash
@@ -56,5 +78,5 @@ sudo certbot --nginx -d backup.example.com
Certbot rewrites the config to listen on 443 with auto-renewal.
:::caution Agent needs a stable URL
If Master is behind HTTPS, remote Agent deployments must use the public HTTPS URL for `--master`. Self-signed certs require `--insecure-tls` (testing only).
If Master is behind HTTPS, remote Agent deployments must use the final HTTPS URL for `--master`; redirects are not followed. For a private CA, pre-provision its PEM certificate and use `--ca-cert /path/to/ca.pem`. Reserve `--insecure-tls` for short-lived testing.
:::