HK中转绕阿里云备案

User Browser
     |
     | HTTPS (443)
     | www.downly.cn
     v
+---------------------------+
| 123.45.67.123 (HK)        |
| - SSL Termination         |
| - Nginx Reverse Proxy     |
+---------------------------+
     |
     | HTTP (50001)
     | Domain: www.downly.cn
     v
+---------------------------+
| 12.213.230.14 (Mainland)  |
| - Nginx Proxy             |
| - Host Header Rebuild     |
+---------------------------+
     |
     | HTTP (5173)
     | Host: www.downly.cn
     v
+---------------------------+
| Vite Dev Server           |
| 127.0.0.1:5173            |
+---------------------------+

server {
    listen 80;
    listen [::]:80;
    server_name www.downly.cn;
    return 301 https://www.downly.cn$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.downly.cn;

    # SSL 证书路径
    ssl_certificate /etc/letsencrypt/live/www.downly.cn/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.downly.cn/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    location / {
        proxy_pass http://12.213.230.14:50001;
        # 关键：通过自定义头传递域名，避免触发大陆服务器的 Host 备案检测
        proxy_set_header Domain $host; 
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 50001;
    listen [::]:50001;
    server_name _; # 匹配所有来源
    
    location / {
        proxy_pass http://127.0.0.1:5173;
        # 从自定义 Domain 头中还原 Host 给后端应用
        proxy_set_header Host $http_Domain;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

certbot certonly --nginx -d www.downly.cn
nginx -t && systemctl reload nginx

nc -vv -l 5173