Tolan/nginx.conf

worker_processes auto; # 自动匹配 CPU 核数

events {
    worker_connections 8192;  # 每进程最大连接数
    use epoll; # 使用高效事件模型
    multi_accept on; # 批量接受新连接
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    # 启用gzip压缩
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types
        text/plain
        text/css
        text/js
        text/xml
        text/javascript
        application/javascript
        application/xml+rss
        application/json;

    # HTTP 端口 80 配置，自动重定向到 HTTPS
    server {
        listen       80;
        server_name  www.hikelly.chat;
# verification.html 可以直接通过HTTP访问
    location = /verification.html {
        root /root/Lyrria/frontend/build;
        try_files $uri =404;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Pragma "no-cache";
        add_header Expires "0";
    }

    # 其他所有路径重定向到HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
    }

    server {
        listen       443 ssl;
        server_name  www.hikelly.chat;

        ssl_certificate "/etc/nginx/cert/www.hikelly.chat.pem";  # SSL证书位置
        ssl_certificate_key "/etc/nginx/cert/www.hikelly.chat.key";  # SSL证书位置

        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout  1h;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        # 处理favicon.ico请求
        location = /favicon.ico {
            root /root/Lyrria/frontend/build;
            access_log off;
            log_not_found off;
            expires 1y;
            add_header Cache-Control "public, immutable";
        }

        # 处理robots.txt请求
        location = /robots.txt {
            access_log off;
            log_not_found off;
            return 200 "User-agent: *\nDisallow:\n";
        }

        # WebSocket连接代理（使用WSS端口8766）
        location /ws {
            proxy_pass http://127.0.0.1:8766;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            proxy_connect_timeout 10s;
        }

        # API接口代理（如果有REST API需求）
        location ^~ /api/ {
            proxy_pass http://127.0.0.1:8766/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
            proxy_connect_timeout 10s;
        }

        # 客户端指标上报接口代理
        location = /metrics/client {
            proxy_pass http://127.0.0.1:8766/metrics/client;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
            proxy_connect_timeout 10s;
        }

        # 静态资源缓存配置
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
            root /root/Lyrria/frontend/build;
            expires 1y;
            add_header Cache-Control "public, immutable";
            add_header X-Content-Type-Options nosniff;
        }

        # 前端静态文件服务
        location / {
            root /root/Lyrria/frontend/build;
            try_files $uri $uri/ /index.html;
            
            # 安全头设置
            add_header X-Frame-Options "SAMEORIGIN" always;
            add_header X-Content-Type-Options "nosniff" always;
            add_header X-XSS-Protection "1; mode=block" always;
            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
            
            # HTML文件不缓存
            location ~* \.html$ {
                add_header Cache-Control "no-cache, no-store, must-revalidate";
                add_header Pragma "no-cache";
                add_header Expires "0";
            }
        }
    }
}