# ============================================================
# Nginx 反向代理站点配置模板
# 替换 __DOMAIN__ 与 __PORT__ 后即可使用
# ============================================================

server {
    listen 80;
    server_name __DOMAIN__;

    # Let's Encrypt HTTP-01 续期验证目录，必须放行
    location /.well-known/acme-challenge/ {
        root /www/wwwroot/__DOMAIN__;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    http2 on;
    server_name __DOMAIN__;

    ssl_certificate     /www/server/nginx/conf/ssl/__DOMAIN__/fullchain.cer;
    ssl_certificate_key /www/server/nginx/conf/ssl/__DOMAIN__/__DOMAIN__.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    # 安全响应头
    add_header Strict-Transport-Security "max-age=63072000" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    client_max_body_size 120m;
    access_log /www/wwwlogs/__DOMAIN__.log;
    error_log  /www/wwwlogs/__DOMAIN__.error.log;

    # 反代到本机 Node 服务
    location / {
        proxy_pass http://127.0.0.1:__PORT__;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;
        proxy_read_timeout 120s;
        proxy_connect_timeout 15s;
    }

    # 附件目录：禁止任何脚本被解析执行
    location ^~ /uploads/ {
        alias /www/wwwroot/blog/public/uploads/;
        location ~* \.(php|phtml|jsp|asp|aspx|cgi|pl|sh|py)$ {
            deny all;
        }
    }

    # 静态资源长缓存
    location ~* \.(css|js|png|jpg|jpeg|gif|svg|webp|ico|woff2?)$ {
        proxy_pass http://127.0.0.1:__PORT__;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }
}