user  root;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    
    client_max_body_size 20M; #上传文件大小限制

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

server {
    listen 80;
    server_name your_domain www.your_domain;
    return 301 https://www.your_domain$request_uri;
}

server { 
    listen 443 ssl; 
    server_name your_domain;  # 仅匹配非 www 的域名
    ssl_certificate /etc/nginx/cert/your_domain.crt; # 证书公钥
    ssl_certificate_key /etc/nginx/cert/your_domain.key; # 证书私钥
    return 301 https://www.your_domain$request_uri;  # 强制跳转到 www.your_domain
}

server {
    gzip on;
    gzip_vary on;
    gzip_disable "MSIE [1-6]\.";
    gzip_static on;
    gzip_min_length 256;
    gzip_buffers 32 8k;
    gzip_http_version 1.1;
    gzip_comp_level 5;
    gzip_proxied any;
    gzip_types text/plain text/css text/xml application/javascript application/x-javascript application/xml application/xml+rss application/emacscript application/json image/svg+xml;

    listen 443 ssl;
    server_name www.your_domain; # 多个域名⽤空格分开 
    ssl_certificate /etc/nginx/cert/your_domain.crt; # 证书公钥
    ssl_certificate_key /etc/nginx/cert/your_domain.key; # 证书私钥
    ssl_session_timeout 5m; 
    ssl_session_cache shared:MozSSL:10m;  # 设置会话缓存以提⾼性能 
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;  # 配置加密算法 
    ssl_protocols TLSv1.2 TLSv1.3;  # 配置加密协议 
    ssl_prefer_server_ciphers on;

    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; #可选配置，开启HSTS 
    add_header X-Frame-Options DENY; # 可选配置，防⽌点击劫持 
    add_header X-Content-Type-Options nosniff; # 可选配置，防⽌MIME类型嗅探 
    add_header X-XSS-Protection "1; mode=block"; # 可选配置，防⽌XSS攻击

    location / {
        try_files $uri $uri/ /index.html;
        root   /opt/go_blog/web/dist;
        index  index.html index.htm;
    }

    location /api/ {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header REMOTE-HOST $remote_addr;
        proxy_pass http://127.0.0.1:8080/api/;
    }

    location /image {
        alias /opt/go_blog/web/dist/image;
    }

    location /emoji {
        alias /opt/go_blog/web/dist/emoji;
    }

    location /uploads/ {
        alias /opt/go_blog/server/uploads/;
    }
}