From af74f2f242c53697175ec71e9cfad0c347f90e55 Mon Sep 17 00:00:00 2001
From: "tao.chen" <93983997+taochen-ct@users.noreply.github.com>
Date: Tue, 28 Jul 2026 11:32:06 +0800
Subject: [PATCH] update: optimize environment

---
 Makefile                    |  4 +++-
 backend/src/backend/main.py |  3 ++-
 default.conf                | 39 +++++++++++++++++++++++++++++++++++++
 docker-compose.yml          |  4 +++-
 4 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index 9849772..6ff8fbf 100644
--- a/Makefile
+++ b/Makefile
@@ -1,15 +1,17 @@
 # ==================== 环境变量配置 ====================
 # 设置默认值（如果命令行没传，就用这里的默认路径）
 WORKSPACES_ROOT ?= ./test/workspaces
-PUBLIC_BASE_URL ?= http://localhost
+PUBLIC_BASE_URL ?= http://192.168.139.3
 RUNTIME_HOST            ?= 0.0.0.0
 RUNTIME_PORT            ?= 8001
+RUNTIME_BASE_URL ?= http://127.0.0.1:8001
 BACKEND_HOST            ?= 0.0.0.0
 BACKEND_PORT            ?= 8000
 
 # 将变量导出给 Makefile 启动的所有子进程
 export WORKSPACES_ROOT
 export PUBLIC_BASE_URL
+export RUNTIME_BASE_URL
 
 .PHONY: runtime backend
 
diff --git a/backend/src/backend/main.py b/backend/src/backend/main.py
index b3aa627..0a474d5 100644
--- a/backend/src/backend/main.py
+++ b/backend/src/backend/main.py
@@ -134,6 +134,7 @@ async def verify_jupyter_access(
 
     target_port = ws_info.get("port")
     jupyter_token = ws_info.get("token")
+    jupyter_base_url = ws_info.get("base_url")
 
     if not target_port:
         raise HTTPException(
@@ -141,6 +142,6 @@ async def verify_jupyter_access(
         )
 
     # 通过 Response Header 返回 Upstream 地址与 Token 给 Nginx
-    response.headers["x-upstream-addr"] = f"http://192.168.139.3:{target_port}"
+    response.headers["x-upstream-addr"] = f"{jupyter_base_url}:{target_port}"
     response.headers["x-jupyter-internal-token"] = jupyter_token or ""
     return {"status": "ok"}
diff --git a/default.conf b/default.conf
index d85de95..4c86b73 100644
--- a/default.conf
+++ b/default.conf
@@ -3,10 +3,49 @@ map $http_upgrade $connection_upgrade {
     ''      close;
 }
 
+upstream rustfs_backend {
+    server 8.153.151.51:9000;
+    keepalive 64;
+}
+
 server {
     listen 80;
     server_name localhost;
+    # 全局或针对存储服务设置最大上传限制 (100G)
+    client_max_body_size 100G;
 
+    # =========================================================================
+    # 1. RustFS 对象存储服务转发 (/storage/)
+    # =========================================================================
+    location /storage/ {
+        # 核心：透传 Host，确保 RustFS 生成的 Presigned URL 包含公网地址
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # 转发至 RustFS
+        # 注意：如果 RustFS 内部接口也是 /storage/...，请把末尾的 / 去掉
+        proxy_pass http://rustfs_backend/;
+
+        # HTTP/1.1 长连接支持
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+
+        # 性能优化：关闭双向 Buffer，实现大文件流式传输
+        proxy_buffering off;
+        proxy_request_buffering off;
+
+        # 大文件传输超时设置
+        proxy_connect_timeout 300s;
+        proxy_read_timeout    3600s;
+        proxy_send_timeout    3600s;
+    }
+
+    # =========================================================================
+    # 2. Jupyter 服务配置
+    # =========================================================================
+    # 拒绝直接访问目录
     location ~ ^/jupyter/(?<workspace_id>[^/]+)/?$ {
         return 403 "Direct directory access is forbidden. Please specify a notebook path.";
     }
diff --git a/docker-compose.yml b/docker-compose.yml
index 31a6cca..b1c832c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -17,4 +17,6 @@ services:
       context: .
       dockerfile: runtime/Dockerfile
     ports:
-      - "8001:8001"
\ No newline at end of file
+      - "8001:8001"
+    environment:
+      - PUBLIC_BASE_URL=http://runtime
\ No newline at end of file