提交

nginx.conf

@@ -0,0 +1,143 @@
+worker_processes auto; # 自动匹配 CPU 核数
+
+events {
+    worker_connections 8192;  # 每进程最大连接数
+    use epoll; # 使用高效事件模型
+    multi_accept on; # 批量接受新连接
+}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    # 启用gzip压缩
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_types
+        text/plain
+        text/css
+        text/js
+        text/xml
+        text/javascript
+        application/javascript
+        application/xml+rss
+        application/json;
+
+    # HTTP 端口 80 配置，自动重定向到 HTTPS
+    server {
+        listen       80;
+        server_name  www.hikelly.chat;
+# verification.html 可以直接通过HTTP访问
+    location = /verification.html {
+        root /root/Lyrria/frontend/build;
+        try_files $uri =404;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+        add_header Expires "0";
+    }
+
+    # 其他所有路径重定向到HTTPS
+    location / {
+        return 301 https://$host$request_uri;
+    }
+    }
+
+    server {
+        listen       443 ssl;
+        server_name  www.hikelly.chat;
+
+        ssl_certificate "/etc/nginx/cert/www.hikelly.chat.pem";  # SSL证书位置
+        ssl_certificate_key "/etc/nginx/cert/www.hikelly.chat.key";  # SSL证书位置
+
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_timeout  1h;
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_ciphers HIGH:!aNULL:!MD5;
+        ssl_prefer_server_ciphers on;
+
+        # 处理favicon.ico请求
+        location = /favicon.ico {
+            root /root/Lyrria/frontend/build;
+            access_log off;
+            log_not_found off;
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+        }
+
+        # 处理robots.txt请求
+        location = /robots.txt {
+            access_log off;
+            log_not_found off;
+            return 200 "User-agent: *\nDisallow:\n";
+        }
+
+        # WebSocket连接代理（使用WSS端口8766）
+        location /ws {
+            proxy_pass http://127.0.0.1:8766;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
+            proxy_connect_timeout 10s;
+        }
+
+        # API接口代理（如果有REST API需求）
+        location ^~ /api/ {
+            proxy_pass http://127.0.0.1:8766/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 60s;
+            proxy_send_timeout 60s;
+            proxy_connect_timeout 10s;
+        }
+
+        # 客户端指标上报接口代理
+        location = /metrics/client {
+            proxy_pass http://127.0.0.1:8766/metrics/client;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 60s;
+            proxy_send_timeout 60s;
+            proxy_connect_timeout 10s;
+        }
+
+        # 静态资源缓存配置
+        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+            root /root/Lyrria/frontend/build;
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+            add_header X-Content-Type-Options nosniff;
+        }
+
+        # 前端静态文件服务
+        location / {
+            root /root/Lyrria/frontend/build;
+            try_files $uri $uri/ /index.html;
+            
+            # 安全头设置
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header X-XSS-Protection "1; mode=block" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+            
+            # HTML文件不缓存
+            location ~* \.html$ {
+                add_header Cache-Control "no-cache, no-store, must-revalidate";
+                add_header Pragma "no-cache";
+                add_header Expires "0";
+            }
+        }
+    }
+}