支持免登录游客聊天并隔离历史与附件

deploy/nginx.conf.example

@@ -24,28 +24,32 @@ server {
     ssl_certificate_key /etc/letsencrypt/live/chat.example.com/privkey.pem;
     ssl_protocols TLSv1.2 TLSv1.3;
 
-    # Guard all pages, API routes, attachments and history/export operations.
+    # Staff and unknown routes remain protected; guest APIs check their own visitor owner.
     auth_basic "Baiyue private acceptance";
     auth_basic_user_file /etc/nginx/.baiyue-preview.htpasswd;
 
     # Allow multipart overhead around the application's 10 MiB file limit.
     client_max_body_size 12m;
 
-    location / {
-        proxy_pass http://127.0.0.1:5000;
-        proxy_http_version 1.1;
-        proxy_set_header Connection "";
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $remote_addr;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Authorization "";
+    proxy_http_version 1.1;
+    proxy_set_header Connection "";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Authorization "";
+    proxy_buffering off;
+    proxy_cache off;
+    gzip off;
+    proxy_read_timeout 300s;
+    proxy_send_timeout 300s;
 
-        # SSE must reach the browser as chunks arrive.
-        proxy_buffering off;
-        proxy_cache off;
-        gzip off;
-        proxy_read_timeout 300s;
-        proxy_send_timeout 300s;
+    location = / { auth_basic off; proxy_pass http://127.0.0.1:5000; }
+    location ^~ /static/ { auth_basic off; proxy_pass http://127.0.0.1:5000; }
+    location ^~ /uploads/ { auth_basic off; proxy_pass http://127.0.0.1:5000; }
+    location ~ ^/(?:healthz|stream_chat|api/(?:visitor/(?:session|human/(?:request|poll|send|close))|new_chat|get_history|get_messages|del_history|clear_all|upload|ticket|rate|feedback|speech/(?:config|transcribe)))$ {
+        auth_basic off;
+        proxy_pass http://127.0.0.1:5000;
     }
+    location / { proxy_pass http://127.0.0.1:5000; }
 }