好，下面这份是 「宝塔环境 · PHP + Nginx · 多子域后台 · /api 反代」
生产可用、可直接复制，我已经帮你把坑都避掉了。

适用域名www.crmeb.commd.crmeb.comgys.crmeb.com后端PHP（ThinkPHP / Laravel / CRMEB）HTTPS 已开启

宝塔 Nginx 完整配置（单站点版）

路径：宝塔 → 网站 → 对应站点 → 设置 → Nginx 配置

3 个站点配置内容完全一样，只改 root

server {
    listen 443 ssl http2;
    server_name www.crmeb.com;

    # ===== SSL（宝塔自动生成即可）=====
    ssl_certificate     /www/server/panel/vhost/cert/www.crmeb.com/fullchain.pem;
    ssl_certificate_key /www/server/panel/vhost/cert/www.crmeb.com/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # ===== 前端目录 =====
    root /www/wwwroot/www.crmeb.com;
    index index.html index.htm;

    # ===== 解决 history 模式 =====
    location / {
        try_files $uri $uri/ /index.html;
    }

    # =================================================
    # 🔥 关键：API 反向代理（同源）
    # =================================================
    location /api/ {

        # 👉 PHP 项目入口（改成你的）
        proxy_pass http://127.0.0.1:9000/;

        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # ===== Cookie 主域共享 =====
        proxy_cookie_domain localhost .crmeb.com;
        proxy_cookie_path / /;

        # ===== 超时设置 =====
        proxy_connect_timeout 60s;
        proxy_send_timeout    60s;
        proxy_read_timeout    60s;

        # ===== 预检请求直接返回 =====
        if ($request_method = OPTIONS) {
            return 204;
        }
    }

    # ===== 静态资源缓存 =====
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?)$ {
        expires 30d;
        access_log off;
    }

    # ===== 安全 =====
    location ~ /\. {
        deny all;
    }

    access_log  /www/wwwlogs/www.crmeb.com.log;
    error_log   /www/wwwlogs/www.crmeb.com.error.log;
}

md / gys 站点怎么改？

md.crmeb.com

server_name md.crmeb.com;
root /www/wwwroot/md.crmeb.com;

ssl_certificate     /www/server/panel/vhost/cert/md.crmeb.com/fullchain.pem;
ssl_certificate_key /www/server/panel/vhost/cert/md.crmeb.com/privkey.pem;

gys.crmeb.com

server_name gys.crmeb.com;
root /www/wwwroot/gys.crmeb.com;

ssl_certificate     /www/server/panel/vhost/cert/gys.crmeb.com/fullchain.pem;
ssl_certificate_key /www/server/panel/vhost/cert/gys.crmeb.com/privkey.pem;

其余一字不改

如果你的 PHP 是 Unix Socket（更推荐）

把 /api/ 改成下面这样（只改这一段）：

location /api/ {
    include fastcgi_params;
    fastcgi_pass unix:/tmp/php-cgi-80.sock;

    fastcgi_param SCRIPT_FILENAME /www/wwwroot/api/public/index.php;
    fastcgi_param SCRIPT_NAME /index.php;

    fastcgi_param HTTP_HOST $host;
    fastcgi_param HTTPS on;
}

php-cgi-80.sock 以你宝塔 PHP 版本为准

部署完成后你可以这样验证（必测）

打开

https://www.crmeb.com

登录一次

直接访问

https://md.crmeb.com
https://gys.crmeb.com

应自动登录

Chrome → DevTools → Application → Cookies

确认：

Domain = .crmeb.com
SameSite = None
Secure = true

最常见 3 个错误（对照排）