chore: CRM-NEW baseline

2026-10-23 10:35:28 +08:00
commit aa499f6dbf
111 changed files with 15126 additions and 0 deletions
@@ -0,0 +1,65 @@
+'use strict';
+
+/**
+ * 公网网关：只把 WhatsApp webhook 和帮助中心暴露给 Cloudflare Tunnel，
+ * 其余路径（尤其 /api/v1/* 管理接口、admin UI）一律 404，避免整站公网裸奔。
+ *
+ * cloudflared (quick tunnel) -> public-gateway:9001 -> libredesk:9000
+ */
+const http = require('http');
+
+const PORT = Number(process.env.PORT || 9001);
+const UPSTREAM = new URL(process.env.UPSTREAM || 'http://libredesk:9000');
+
+// 公网允许的路径前缀
+const ALLOW = [
+  '/webhooks/whatsapp/', // Meta 回调
+  '/hc/', // 帮助中心（AI 引用链接）
+  '/widget.js',
+  '/widget', // widget iframe 页面
+  '/static/public/', // widget 静态资源
+];
+
+function allowed(pathname) {
+  return ALLOW.some((p) => pathname === p || pathname.startsWith(p));
+}
+
+const server = http.createServer((req, res) => {
+  const pathname = (req.url || '/').split('?')[0];
+  if (!allowed(pathname)) {
+    res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
+    res.end('not found');
+    return;
+  }
+
+  const headers = { ...req.headers };
+  delete headers.host;
+  headers.host = UPSTREAM.host;
+
+  const proxy = http.request(
+    {
+      protocol: UPSTREAM.protocol,
+      hostname: UPSTREAM.hostname,
+      port: UPSTREAM.port || 80,
+      method: req.method,
+      path: req.url,
+      headers,
+    },
+    (upRes) => {
+      res.writeHead(upRes.statusCode || 502, upRes.headers);
+      upRes.pipe(res);
+    }
+  );
+
+  proxy.on('error', (err) => {
+    console.error('[public-gateway] upstream error', pathname, err.message);
+    if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
+    res.end('bad gateway');
+  });
+
+  req.pipe(proxy);
+});
+
+server.listen(PORT, '0.0.0.0', () => {
+  console.log(`[public-gateway] listening :${PORT} -> ${UPSTREAM.origin} (allow: ${ALLOW.join(', ')})`);
+});