Tolan/nginx.conf

user root;

worker_processes auto; # 自动匹配 CPU 核数

events {
    worker_connections 8192;  # 每进程最大连接数
    use epoll; # 使用高效事件模型
    multi_accept on; # 批量接受新连接
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    # 启用gzip压缩
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types
        text/plain
        text/css
        text/js
        text/xml
        text/javascript
        application/javascript
        application/xml+rss
        application/json;

    # HTTP 端口 80 配置（支持 HTTP 访问）
    server {
        listen       80;
        server_name  www.chengyantek.cn;

        # 处理favicon.ico请求
        location = /favicon.ico {
            root /root/Lyrria/frontend/dist;
            access_log off;
            log_not_found off;
            expires 1y;
            add_header Cache-Control "public, immutable";
        }

        # 处理robots.txt请求
        location = /robots.txt {
            access_log off;
            log_not_found off;
            return 200 "User-agent: *\nDisallow:\n";
        }

        # WebSocket连接代理（使用WS端口8766）
        location /ws {
            proxy_pass http://127.0.0.1:8766;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            proxy_connect_timeout 10s;
        }

        # API接口代理（如果有REST API需求）
        location ^~ /api/ {
            proxy_pass http://127.0.0.1:8766$request_uri;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
            proxy_connect_timeout 10s;
        }

        # 客户端指标上报接口代理
        location = /metrics/client {
            proxy_pass http://127.0.0.1:8766/metrics/client;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
            proxy_connect_timeout 10s;
        }

        # 静态资源缓存配置（支持跨域）
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
            # 处理 OPTIONS 预检请求
            if ($request_method = 'OPTIONS') {
                add_header Access-Control-Allow-Origin '*' always;
                add_header Access-Control-Allow-Methods 'GET, OPTIONS' always;
                add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
                add_header Access-Control-Max-Age 1728000 always;
                add_header Content-Type 'text/plain; charset=utf-8' always;
                add_header Content-Length 0 always;
                return 204;
            }

            root /root/Lyrria/frontend/dist;
            expires 1y;
            add_header Cache-Control "public, immutable" always;
            add_header X-Content-Type-Options nosniff always;
            # CORS 响应头
            add_header Access-Control-Allow-Origin '*' always;
            add_header Access-Control-Allow-Methods 'GET, OPTIONS' always;
        }

        # 前端静态文件服务
        location / {
            # 处理 OPTIONS 预检请求
            if ($request_method = 'OPTIONS') {
                add_header Access-Control-Allow-Origin '*' always;
                add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
                add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
                add_header Access-Control-Max-Age 1728000 always;
                add_header Content-Type 'text/plain; charset=utf-8' always;
                add_header Content-Length 0 always;
                return 204;
            }

            root /root/Lyrria/frontend/dist;
            try_files $uri $uri/ /index.html;
            
            # 安全头设置
            add_header X-Frame-Options "SAMEORIGIN" always;
            add_header X-Content-Type-Options "nosniff" always;
            add_header X-XSS-Protection "1; mode=block" always;
            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
            # CORS 响应头
            add_header Access-Control-Allow-Origin '*' always;
            add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
            add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
            
            # HTML文件不缓存
            location ~* \.html$ {
                add_header Cache-Control "no-cache, no-store, must-revalidate";
                add_header Pragma "no-cache";
                add_header Expires "0";
            }
        }
    }

    # HTTPS 端口 443 配置（支持 HTTPS 访问）
    server {
        listen       443 ssl;
        server_name  www.chengyantek.cn;

        # SSL证书配置
        ssl_certificate "/root/.acme.sh/chengyantek.cn_ecc/fullchain.cer";  # SSL证书位置
        ssl_certificate_key "/root/.acme.sh/chengyantek.cn_ecc/chengyantek.cn.key";  # SSL私钥位置

        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout  1h;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        # 处理favicon.ico请求
        location = /favicon.ico {
            root /root/Lyrria/frontend/dist;
            access_log off;
            log_not_found off;
            expires 1y;
            add_header Cache-Control "public, immutable";
        }

        # 处理robots.txt请求
        location = /robots.txt {
            access_log off;
            log_not_found off;
            return 200 "User-agent: *\nDisallow:\n";
        }

        # WebSocket连接代理（使用WSS端口8766）
        location /ws {
            proxy_pass http://127.0.0.1:8766;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            proxy_connect_timeout 10s;
        }

        # API接口代理（如果有REST API需求）
        location ^~ /api/ {
            proxy_pass http://127.0.0.1:8766$request_uri;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
            proxy_connect_timeout 10s;
        }

        # 客户端指标上报接口代理
        location = /metrics/client {
            proxy_pass http://127.0.0.1:8766/metrics/client;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
            proxy_connect_timeout 10s;
        }

        # 静态资源缓存配置（支持跨域）
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
            # 处理 OPTIONS 预检请求
            if ($request_method = 'OPTIONS') {
                add_header Access-Control-Allow-Origin '*' always;
                add_header Access-Control-Allow-Methods 'GET, OPTIONS' always;
                add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
                add_header Access-Control-Max-Age 1728000 always;
                add_header Content-Type 'text/plain; charset=utf-8' always;
                add_header Content-Length 0 always;
                return 204;
            }

            root /root/Lyrria/frontend/dist;
            expires 1y;
            add_header Cache-Control "public, immutable" always;
            add_header X-Content-Type-Options nosniff always;
            # CORS 响应头
            add_header Access-Control-Allow-Origin '*' always;
            add_header Access-Control-Allow-Methods 'GET, OPTIONS' always;
        }

        # 前端静态文件服务
        location / {
            # 处理 OPTIONS 预检请求
            if ($request_method = 'OPTIONS') {
                add_header Access-Control-Allow-Origin '*' always;
                add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
                add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
                add_header Access-Control-Max-Age 1728000 always;
                add_header Content-Type 'text/plain; charset=utf-8' always;
                add_header Content-Length 0 always;
                return 204;
            }

            root /root/Lyrria/frontend/dist;
            try_files $uri $uri/ /index.html;
            
            # 安全头设置
            add_header X-Frame-Options "SAMEORIGIN" always;
            add_header X-Content-Type-Options "nosniff" always;
            add_header X-XSS-Protection "1; mode=block" always;
            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
            # CORS 响应头
            add_header Access-Control-Allow-Origin '*' always;
            add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
            add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
            
            # HTML文件不缓存
            location ~* \.html$ {
                add_header Cache-Control "no-cache, no-store, must-revalidate";
                add_header Pragma "no-cache";
                add_header Expires "0";
            }
        }
    }
}