ewoooc/docker/nginx-monitor/conf.d/monitor.conf

# =============================================================================
# WOOO TECH - Monitoring Services Nginx Configuration (HTTP Only)
# 所有監控服務統一入口
# 使用動態 DNS 解析，避免服務不存在時 nginx 無法啟動
# =============================================================================

# HTTP 監控服務入口
server {
    listen 80;
    server_name mon.wooo.work localhost;

    # Docker 內部 DNS resolver
    resolver 127.0.0.11 valid=30s ipv6=off;

    # 從上游 nginx 獲取真實客戶端 IP
    set_real_ip_from 172.16.0.0/12;
    set_real_ip_from 10.0.0.0/8;
    set_real_ip_from 192.168.0.0/24;
    real_ip_header X-Real-IP;
    real_ip_recursive on;

    # 安全標頭
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;

    # 日誌
    access_log /var/log/nginx/monitor-access.log;
    error_log /var/log/nginx/monitor-error.log;

    # 靜態檔案 (Logo 等)
    location /static/ {
        alias /usr/share/nginx/html/static/;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    # 根路徑 - 顯示服務列表 (使用靜態 HTML 檔案)
    location = / {
        root /usr/share/nginx/html;
        try_files /index.html =404;
    }

    # =========================================
    # 視覺化與分析
    # =========================================

    # Grafana (代理到 Grafana 的 /grafana/ 路徑，因為 Grafana 配置了 SERVE_FROM_SUB_PATH)
    location /grafana/ {
        set $grafana_backend "http://momo-grafana:3000";
        proxy_pass $grafana_backend$request_uri;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket 支援 (Grafana Live)
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
        proxy_buffering off;
    }

    # Prometheus (route-prefix=/ 所以要 rewrite 掉 /prometheus 前綴)
    location /prometheus/ {
        set $prometheus_backend "http://momo-prometheus:9090";
        rewrite ^/prometheus/(.*) /$1 break;
        proxy_pass $prometheus_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # Prometheus 根路徑重定向
    location = /prometheus {
        return 301 /prometheus/;
    }

    # Loki API (僅供 Grafana 使用，無 Web UI)
    location /loki/ {
        set $loki_backend "http://momo-loki:3100";
        rewrite ^/loki/(.*) /$1 break;
        proxy_pass $loki_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # Loki ready 健康檢查
    location = /loki/ready {
        set $loki_backend "http://momo-loki:3100";
        proxy_pass $loki_backend/ready;
        proxy_http_version 1.1;
    }

    # =========================================
    # 系統管理
    # =========================================

    # Portainer (無法正常使用子路徑，建議直接訪問)
    location /portainer/ {
        set $portainer_backend "http://momo-portainer:9000";
        rewrite ^/portainer/(.*) /$1 break;
        proxy_pass $portainer_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket 支援
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # SQLite Web (僅限內網訪問 - 資料庫安全考量)
    location /sqlite/ {
        # 內網 IP 白名單
        allow 192.168.0.0/24;
        allow 10.0.0.0/8;
        allow 172.16.0.0/12;
        allow 127.0.0.1;
        deny all;

        set $sqlite_backend "http://momo-sqlite-web:8080";
        # 移除 /sqlite 前綴後代理到後端
        rewrite ^/sqlite/(.*) /$1 break;
        proxy_pass $sqlite_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Script-Name /sqlite;

        # 重寫內部連結路徑 (順序重要：具體規則在前)
        sub_filter 'href="/static/' 'href="/sqlite/static/';
        sub_filter 'src="/static/' 'src="/sqlite/static/';
        sub_filter 'action="/' 'action="/sqlite/';
        sub_filter 'href="/' 'href="/sqlite/';
        sub_filter_once off;
        sub_filter_types text/html text/css application/javascript;

        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # SQLite Web 靜態資源 (僅限內網)
    location /sqlite/static/ {
        allow 192.168.0.0/24;
        allow 10.0.0.0/8;
        allow 172.16.0.0/12;
        allow 127.0.0.1;
        deny all;

        set $sqlite_backend "http://momo-sqlite-web:8080";
        rewrite ^/sqlite/static/(.*) /static/$1 break;
        proxy_pass $sqlite_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        expires 7d;
    }

    # =========================================
    # Exporters
    # =========================================

    # cAdvisor
    location /cadvisor/ {
        set $cadvisor_backend "http://momo-cadvisor:8080";
        proxy_pass $cadvisor_backend/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # Node Exporter
    location /node-exporter/ {
        set $node_exporter_backend "http://momo-node-exporter:9100";
        proxy_pass $node_exporter_backend/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # Blackbox Exporter
    location /blackbox/ {
        set $blackbox_backend "http://momo-blackbox-exporter:9115";
        proxy_pass $blackbox_backend/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    # 健康檢查
    location /health {
        access_log off;
        return 200 'OK';
        add_header Content-Type text/plain;
    }

    # 服務不可用時的友善錯誤頁面
    error_page 502 503 504 @service_unavailable;
    location @service_unavailable {
        default_type 'text/html; charset=utf-8';
        return 503 '<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Service Unavailable</title>
    <style>
        body { font-family: -apple-system, sans-serif; background: linear-gradient(135deg, #1e3c72, #2a5298); min-height: 100vh; margin: 0; display: flex; align-items: center; justify-content: center; color: white; }
        .container { text-align: center; padding: 40px; }
        h1 { margin-bottom: 20px; }
        p { opacity: 0.8; }
        a { color: #fff; }
    </style>
</head>
<body>
    <div class="container">
        <h1>Service Unavailable</h1>
        <p>The requested monitoring service is not running.</p>
        <p>Please start monitoring services with:</p>
        <p><code>docker-compose --profile monitoring up -d</code></p>
        <p><a href="/">Back to Service List</a></p>
    </div>
</body>
</html>';
    }
}