Tolan/nginx.conf

worker_processes auto; # 自动匹配 CPU 核数

events {
    worker_connections 8192;  # 每进程最大连接数
    use epoll; # 使用高效事件模型
    multi_accept on; # 批量接受新连接
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    # 错误日志
    error_log /var/log/nginx/error.log warn;

    # 隐藏 Nginx 版本信息
    server_tokens off;

    # 文件 I/O 性能优化
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;

    # 文件描述符缓存（减少系统调用）
    open_file_cache max=10000 inactive=30s;
    open_file_cache_valid 60s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;

    # Keepalive 连接优化
    keepalive_timeout 65;
    keepalive_requests 100;

    # 客户端请求限制
    client_max_body_size 10m;
    client_body_buffer_size 128k;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 8k;

    # 日志缓冲（提升高并发性能）
    access_log off;  # 生产环境可关闭访问日志，或使用缓冲
    # access_log /var/log/nginx/access.log combined buffer=32k flush=5s;

    # 限流配置
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=ws_limit:10m rate=5r/s;
    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

    # 启用gzip压缩（优化压缩级别）
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_comp_level 5;  # 降低压缩级别，平衡 CPU 和压缩比
    gzip_types
        text/plain
        text/css
        text/js
        text/xml
        text/javascript
        application/javascript
        application/xml+rss
        application/json
        application/wasm
        image/svg+xml;

    # HTTP 端口 80 配置，自动重定向到 HTTPS
    server {
        listen       80;
        server_name  www.lyrria.com;
        #verification.html 可以直接通过HTTP访问
        location = /verification.html {
         root /root/Lyrria/frontend/build;
         try_files $uri =404;
         add_header Cache-Control "no-cache, no-store, must-revalidate";
         add_header Pragma "no-cache";
         add_header Expires "0";
        }

        # 其他所有路径重定向到HTTPS
        location / {
          return 301 https://$host$request_uri;
        }
    }

    server {
        listen       443 ssl http2;  # 启用 HTTP/2
        server_name  www.lyrria.com;

        ssl_certificate "/etc/nginx/cert/lyrria.com.pem";  # SSL证书位置
        ssl_certificate_key "/etc/nginx/cert/lyrria.com.key";  # SSL证书位置
        
        # SSL/TLS 优化
        ssl_session_cache shared:SSL:50m;  # 增加会话缓存大小
        ssl_session_timeout 1h;
        ssl_session_tickets off;  # 禁用 session tickets，使用共享缓存
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-
POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
        ssl_prefer_server_ciphers off;  # TLS 1.3 不需要此选项
        # ssl_dhparam /etc/nginx/cert/dhparam.pem;  # 如果存在 DH 参数文件，取消注释

        # 处理favicon.ico请求
        location = /favicon.ico {
            root /root/Lyrria/frontend/build;
            access_log off;
            log_not_found off;
            expires 1y;
            add_header Cache-Control "public, immutable";
        }

        # 处理robots.txt请求
        location = /robots.txt {
            access_log off;
            log_not_found off;
            return 200 "User-agent: *\nDisallow:\n";
        }

        # WebSocket连接代理（使用WSS端口8766）
        location /ws {
            limit_req zone=ws_limit burst=10 nodelay;
            limit_conn conn_limit 10;
            
            proxy_pass http://127.0.0.1:8766;
            proxy_http_version 1.1;
            
            # WebSocket 必需头部
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            
            # 标准代理头部
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            
            # WebSocket 优化：禁用缓冲
            proxy_buffering off;
            proxy_cache off;
            
            # 超时设置
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            proxy_connect_timeout 10s;
        }

        # API接口代理（如果有REST API需求）
        location ^~ /api/ {
            limit_req zone=api_limit burst=20 nodelay;
            
            proxy_pass http://127.0.0.1:8766$request_uri;
            
            # 代理头部
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            
            # 代理缓冲优化
            proxy_buffering on;
            proxy_buffer_size 4k;
            proxy_buffers 8 4k;
            proxy_busy_buffers_size 8k;
            proxy_temp_file_write_size 8k;
            
            # 超时设置
            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
            proxy_connect_timeout 10s;
        }
        # 客户端指标上报接口代理
        location = /metrics/client {
            limit_req zone=api_limit burst=10 nodelay;
            
            proxy_pass http://127.0.0.1:8766/metrics/client;
            
            # 代理头部
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            
            # 代理缓冲
            proxy_buffering on;
            proxy_buffer_size 4k;
            proxy_buffers 4 4k;
            
            # 超时设置
            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
            proxy_connect_timeout 10s;
        }

        # HTML 文件处理（独立 location，修复嵌套问题）
        location ~* \.html$ {
            root /root/Lyrria/frontend/build;
            try_files $uri =404;
            
            # 处理 OPTIONS 预检请求
            if ($request_method = 'OPTIONS') {
                add_header Access-Control-Allow-Origin '*' always;
                add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
                add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
                add_header Access-Control-Max-Age 1728000 always;
                add_header Content-Type 'text/plain; charset=utf-8' always;
                add_header Content-Length 0 always;
                return 204;
            }
            
            # HTML 文件不缓存
            add_header Cache-Control "no-cache, no-store, must-revalidate" always;
            add_header Pragma "no-cache" always;
            add_header Expires "0" always;
            
            # 安全头设置
            add_header X-Frame-Options "SAMEORIGIN" always;
            add_header X-Content-Type-Options "nosniff" always;
            add_header X-XSS-Protection "1; mode=block" always;
            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
            
            # CORS 响应头
            add_header Access-Control-Allow-Origin '*' always;
            add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
            add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
        }

        # 静态资源缓存配置（支持跨域）
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|webp|avif)$ {
            # 处理 OPTIONS 预检请求
            if ($request_method = 'OPTIONS') {
                add_header Access-Control-Allow-Origin '*' always;
                add_header Access-Control-Allow-Methods 'GET, OPTIONS' always;
                add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
                add_header Access-Control-Max-Age 1728000 always;
                add_header Content-Type 'text/plain; charset=utf-8' always;
                add_header Content-Length 0 always;
                return 204;
            }

            root /root/Lyrria/frontend/build;
            expires 1y;
            add_header Cache-Control "public, max-age=31536000, immutable" always;
            add_header X-Content-Type-Options nosniff always;
            
            # CORS 响应头
            add_header Access-Control-Allow-Origin '*' always;
            add_header Access-Control-Allow-Methods 'GET, OPTIONS' always;
        }

        # 前端静态文件服务（SPA 路由）
        location / {
            # 处理 OPTIONS 预检请求
            if ($request_method = 'OPTIONS') {
                add_header Access-Control-Allow-Origin '*' always;
                add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
                add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
                add_header Access-Control-Max-Age 1728000 always;
                add_header Content-Type 'text/plain; charset=utf-8' always;
                add_header Content-Length 0 always;
                return 204;
            }
            
            root /root/Lyrria/frontend/build;
            try_files $uri $uri/ /index.html;
            
            # 安全头设置
            add_header X-Frame-Options "SAMEORIGIN" always;
            add_header X-Content-Type-Options "nosniff" always;
            add_header X-XSS-Protection "1; mode=block" always;
            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
            
            # CORS 响应头
            add_header Access-Control-Allow-Origin '*' always;
            add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
            add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
        }
    }

    # Web Admin 8522 HTTP -> HTTPS
    server {
        listen       8522;
        server_name  www.lyrria.com;
        return 301 https://$host:8522$request_uri;
    }

    # Web Admin 独立站点（生产）
    server {
        listen       8522 ssl;
        server_name  www.lyrria.com;

        ssl_certificate "/etc/nginx/cert/lyrria.com.pem";
        ssl_certificate_key "/etc/nginx/cert/lyrria.com.key";

        ssl_session_cache shared:SSL_WEB_ADMIN:10m;
        ssl_session_timeout 1h;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
        ssl_prefer_server_ciphers off;

        # Web Admin 打包目录
        root /root/Lyrria/web-admin/dist;
        index index.html;

        # Web Admin API 代理到后端服务
        location ^~ /api/ {
            limit_req zone=api_limit burst=40 nodelay;
            proxy_pass http://127.0.0.1:8766$request_uri;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
            proxy_connect_timeout 10s;
        }

        # 如 Web Admin 需要 WebSocket，可直接复用
        location /ws {
            limit_req zone=ws_limit burst=20 nodelay;
            proxy_pass http://127.0.0.1:8766;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_buffering off;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            proxy_connect_timeout 10s;
        }

        # Web Admin 静态资源缓存
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|webp|avif)$ {
            expires 1y;
            add_header Cache-Control "public, max-age=31536000, immutable" always;
            add_header X-Content-Type-Options nosniff always;
            try_files $uri =404;
        }

        # SPA 路由回退
        location / {
            try_files $uri $uri/ /index.html;
            add_header X-Frame-Options "SAMEORIGIN" always;
            add_header X-Content-Type-Options "nosniff" always;
            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        }
    }
}