初始提交：DSH 多租户平台（dshs）

src/nginx/generate.ts

@@ -0,0 +1,45 @@
+/**
+ * nginx `server {}` rendering and domain validation. (P6)
+ *
+ * `renderServerBlock` produces a per-custom-domain block that rewrites the
+ * domain root onto the orchestrator's `/u/<userId>/dsh/` subpath (see
+ * docs/domain-config.md §3.1).
+ * @module dshs/nginx/generate
+ */
+
+/** Render an nginx server block mapping a custom domain to a user's DSH. */
+export function renderServerBlock(domain: string, userId: string, upstreamPort: number): string {
+  return [
+    `# ${domain} -> user ${userId}`,
+    'server {',
+    '  listen 443 ssl;',
+    `  server_name ${domain};`,
+    '',
+    `  ssl_certificate     /etc/letsencrypt/live/${domain}/fullchain.pem;`,
+    `  ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;`,
+    '',
+    '  location / {',
+    `    proxy_pass http://127.0.0.1:${upstreamPort}/u/${userId}/dsh/;`,
+    '    proxy_http_version 1.1;',
+    '    proxy_set_header Host              $host;',
+    '    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;',
+    '    proxy_set_header X-Forwarded-Proto $scheme;',
+    '    proxy_set_header Upgrade    $http_upgrade;',
+    '    proxy_set_header Connection $connection_upgrade;',
+    '    proxy_read_timeout 3600s;',
+    '  }',
+    '}',
+  ].join('\n')
+}
+
+/**
+ * Validate an ASCII hostname: dot-separated labels of alnum/hyphen, no leading
+ * or trailing hyphen, no scheme/path/port.
+ */
+export function isValidDomain(domain: string): boolean {
+  if (domain.length === 0 || domain.length > 253) return false
+  return domain.split('.').every((label) => {
+    if (label.length === 0 || label.length > 63) return false
+    return /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(label)
+  })
+}