> For the complete documentation index, see [llms.txt](https://overleaf-pro.ayaka.space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://overleaf-pro.ayaka.space/on-premises/zh-tw/she-ding/overleaf-toolkit/tls-proxy.md).

# TLS 代理伺服器

使用 NGINX 的可選 TLS 代理，用於終止 HTTPS 連線。

執行 `bin/init --tls` 用 NGINX 代理設定初始化本機設定，或將 NGINX 代理設定新增至現有的本機設定。一 **範例** 私鑰建立於 `config/nginx/certs/overleaf_key.pem` 以及一個 **虛擬** 憑證位於 `config/nginx/certs/overleaf_certificate.pem`。你可以將它們替換為你實際的私鑰和憑證，或設定下列項目的值： `TLS_PRIVATE_KEY_PATH` 以及 `TLS_CERTIFICATE_PATH` 變數分別指向你實際私鑰和憑證的路徑。

NGINX 的預設設定檔位於 `config/nginx/nginx.conf` 可依你的需求自訂。設定檔路徑可透過下列項目變更： `NGINX_CONFIG_PATH` 變數。

{% hint style="success" %}
如果你有一個 **docker-compose.yml** 為基礎的部署，或自行管理你的 NGINX 反向代理，你可以查看範例 **nginx.conf** 檔案 [這裡](https://github.com/overleaf/toolkit/blob/master/lib/config-seed/nginx.conf).
{% endhint %}

請將下列區段加入你的 `config/overleaf.rc` 檔案中，如果尚未存在：

```
# TLS 代理設定（選用）
NGINX_ENABLED=false
NGINX_CONFIG_PATH=config/nginx/nginx.conf
NGINX_HTTP_PORT=80

# 請將這些 IP 位址替換為你主機的外部 IP 位址
NGINX_HTTP_LISTEN_IP=127.0.1.1 
NGINX_TLS_LISTEN_IP=127.0.1.1
TLS_PRIVATE_KEY_PATH=config/nginx/certs/overleaf_key.pem
TLS_CERTIFICATE_PATH=config/nginx/certs/overleaf_certificate.pem
TLS_PORT=443
```

{% hint style="danger" %}
如果你正在使用外部 TLS 代理（也就是不是由 Overleaf Toolkit 管理），請確保 `OVERLEAF_TRUSTED_PROXY_IPS=loopback,<ip-of-your-tls-proxy>` 已設定於你的 `config/variables.env`，例如 `OVERLEAF_TRUSTED_PROXY_IPS=loopback,192.168.13.37`.
{% endhint %}

{% hint style="danger" %}
如果你使用的是來自 `172.16.0.0/12` （Docker 網路的預設子網）作為你的本機網路，你將需要設定 `OVERLEAF_TRUSTED_PROXY_IPS=loopback,<network>` 在你的 `config/variables.env`中。此處 `<network>` 是 `IPAM -> Config -> Subnet` 中的值，例如 `docker inspect overleaf_default`，例如 `OVERLEAF_TRUSTED_PROXY_IPS=loopback,172.19.0.0/16`。這是為了防止偽造 `X-Forwarded` 標頭。
{% endhint %}

{% hint style="info" %}
如果 `OVERLEAF_TRUSTED_PROXY_IPS` 若未手動設定，預設為 `loopback`。如果手動設定，你必須確保包含以下其中一個： `loopback`, `localhost` 或 `127.0.0.1`，其信任 **nginx** 在其中執行的執行個體 **sharelatex** 容器內的 .log 檔案。
{% endhint %}

若要執行代理，請變更以下項目的值： `NGINX_ENABLED` 中的變數 `config/overleaf.rc` 寄件者 `false` 到 `true` ，然後重新執行 `bin/up`.

預設情況下，HTTPS 網頁介面將可透過以下位址存取： `https://127.0.1.1:443`。連線至 `http://127.0.1.1:80` 將重新導向至 `https://127.0.1.1:443`。若要變更 NGINX 監聽的 IP 位址，請設定 `NGINX_HTTP_LISTEN_IP` 以及 `NGINX_TLS_LISTEN_IP` 變數。連接埠可透過下列項目變更： `NGINX_HTTP_PORT` 以及 `TLS_PORT` 變數。

如果 NGINX 因以下錯誤訊息而無法啟動 `啟動 userland proxy 時發生錯誤：listen tcp4 ... bind: address already in use` 請確保 `OVERLEAF_LISTEN_IP:OVERLEAF_PORT` 不與 `NGINX_HTTP_LISTEN_IP:NGINX_HTTP_PORT`.

{% @mermaid/diagram content="sequenceDiagram
participant user as User
participant external as Host External
participant internal as Host Internal
participant nginx as nginx
participant sharelatex as sharelatex
participant git-bridge as git-bridge
%% User connects to external host HTTP
user->>+ external: HTTP
note over external: NGINX\_HTTP\_LISTEN\_IP:NGINX\_HTTP\_PORT
external->>+ nginx: HTTP
note over nginx: nginx:80
nginx-->>-external: 301
%% User connects to external host HTTPS
user->>+ external: HTTPS
note over external: NGINX\_TLS\_LISTEN\_IP:TLS\_PORT
external->>+ nginx: HTTPS
note over nginx: nginx:443
nginx->>+ sharelatex: HTTP
note over sharelatex: sharlatex:80
%% User connects to localhost HTTP
user->>+ internal: HTTP
note over internal: OVERLEAF\_LISTEN\_IP:OVERLEAF\_PORT
internal->>+sharelatex: HTTP
note over sharelatex: sharlatex:80
%% sharelatex connects to git-bridge
sharelatex->>+git-bridge: HTTP /git/
note over git-bridge: git-bridge:8000
note over sharelatex: GIT\_BRIDGE\_HOST:GIT\_BRIDGE\_PORT
git-bridge->>+sharelatex: WEB/WEB-API:3000
git-bridge->>+sharelatex: HISTORY-V1:3100" %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://overleaf-pro.ayaka.space/on-premises/zh-tw/she-ding/overleaf-toolkit/tls-proxy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.