# ============================================
# FastapiAdmin Nginx 配置文件
# ============================================

# 自动检测 CPU 核心数,多核服务器自动利用所有核心
worker_processes auto;

# 错误日志输出到 stdout(Docker 容器日志最佳实践)
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
 accept_mutex on; # 设置网络连接序列化,防止惊群现象发生,默认为on
 multi_accept on; # 设置一个进程是否同时接受多个网络连接,默认为off
 use epoll; # 事件驱动模型,select|poll|kqueue|epoll|resig|/dev/poll|eventport
 worker_connections 1024; # 最大连接数,默认为512
}

http {
 include mime.types; # 文件扩展名与文件类型映射表
 default_type application/octet-stream; # 默认文件类型,默认为text/plain

 # ==================== 基础优化 ====================
 sendfile on;
 tcp_nopush on;
 tcp_nodelay on;
 keepalive_timeout 65;
 keepalive_requests 1000;
 types_hash_max_size 2048;
 client_max_body_size 50m;
 server_tokens off;

 # ==================== 日志格式 ====================
 log_format main '$remote_addr - $remote_user [$time_local] "$request" '
 '$status $body_bytes_sent "$http_referer" '
 '"$http_user_agent" "$http_x_forwarded_for" '
 '$request_time $upstream_response_time';

 access_log /var/log/nginx/access.log main buffer=32k flush=5s;

 # ==================== Gzip 压缩 ====================
 gzip on;
 gzip_vary on;
 gzip_proxied any;
 gzip_comp_level 6;
 gzip_min_length 256;
 gzip_types
 text/plain
 text/css
 text/javascript
 application/javascript
 application/json
 application/xml
 application/x-javascript
 image/svg+xml
 image/x-icon;

 # ==================== 安全头 ====================
 # 全局安全头,默认被所有 server 块继承
 add_header X-Frame-Options "SAMEORIGIN" always;
 add_header X-Content-Type-Options "nosniff" always;
 add_header X-XSS-Protection "1; mode=block" always;
 add_header Referrer-Policy "strict-origin-when-cross-origin" always;

 # ==================== 速率限制 ====================
 # API 请求速率限制: 每 IP 每秒 30 个请求
 limit_req_zone $binary_remote_addr zone=api_limit:10m rate=30r/s;
 # 连接数限制: 每 IP 最多 100 个并发连接
 limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

 # ==================== HTTP -> HTTPS 重定向 ====================
 # HTTP server块 - 重定向到HTTPS
 server {
 listen 80;
 server_name service.fastapiadmin.com;
 return 301 https://$server_name$request_uri;
 }

 # ==================== HTTPS Server ====================
 server {
 listen 443 ssl http2;
 server_name service.fastapiadmin.com;
 
 # ==================== SSL 配置 ====================
 ssl_certificate /etc/nginx/ssl/server.pem;
 ssl_certificate_key /etc/nginx/ssl/server.key;
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384;
 ssl_prefer_server_ciphers on;
 ssl_session_cache shared:SSL:10m;
 ssl_session_timeout 10m;

 # ==================== 官网(根路径) ====================
 # 已禁用:docs 不开源,如需使用请取消注释
 location / {
 root /usr/share/nginx/html/docs/dist;
 index index.html index.htm;
 try_files $uri $uri/ /index.html; #解决页面刷新404问题
 }

 # ==================== 前端(/web) ====================
 location /web {
 alias /usr/share/nginx/html/web/dist;
 try_files $uri $uri/ /web/index.html; #解决页面刷新404问题
 }

 # ==================== 小程序 H5(/app) ====================
 # 已禁用:app 不开源,如需使用请取消注释
 location /app {
 alias /usr/share/nginx/html/app/dist/build/h5;
 try_files $uri $uri/ /app/index.html; #解决页面刷新404问题
 }

 # ==================== 后端 API 代理 ====================
 location /api/v1 {
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 proxy_set_header X-NginX-Proxy true;
 proxy_connect_timeout 300s;
 proxy_send_timeout 300s;
 proxy_read_timeout 300s;
 proxy_pass http://backend:8001;

 # WebSocket 支持
 proxy_http_version 1.1;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection "upgrade";
 }

 # ==================== 错误页面 ====================
 error_page 500 502 503 504 /50x.html;
 location = /50x.html {
 root /usr/share/nginx/html;
 }
 }
}