# HTTP → HTTPS 重定向
server {
    listen 80;
    server_name localhost;

    # 仅用于健康检查
    location /health {
        return 200 "OK";
    }

    # 其他全部重定向到 HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS 主配置
server {
    listen 443 ssl http2;
    server_name localhost;
    root /usr/share/nginx/html;
    index index.html;

    # ─── SSL 配置 ────────────────────────────────────────
    ssl_certificate     /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_tickets off;

    # 仅启用 TLS 1.2 / 1.3
    ssl_protocols TLSv1.2 TLSv1.3;

    # 强密码套件
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers on;

    # ─── 安全头 ─────────────────────────────────────────
    # HSTS (max-age=1 year, includeSubDomains)
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # 防点击劫持
    add_header X-Frame-Options "SAMEORIGIN" always;

    # MIME 类型嗅探防护
    add_header X-Content-Type-Options "nosniff" always;

    # XSS 过滤器
    add_header X-XSS-Protection "1; mode=block" always;

    # Referrer Policy
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Permissions Policy (限制敏感 API)
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

    # Content-Security-Policy
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https: wss:; frame-ancestors 'self'" always;

    # 隐藏 Nginx 版本
    server_tokens off;

    # 请求体大小限制（防大 payload 攻击）
    client_max_body_size 20m;
    client_body_timeout 60s;
    client_header_timeout 30s;

    # ─── 前端静态资源 ───────────────────────────────────
    location / {
        try_files $uri $uri/ /index.html;
    }

    # ─── API 代理 ───────────────────────────────────────
    location /api/ {
        proxy_pass http://backend:8037;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
        proxy_connect_timeout 60s;

        # 隐藏后端版本信息
        proxy_hide_header X-Powered-By;
        proxy_hide_header Server;
    }

    # ─── WebSocket 代理 ─────────────────────────────────
    location /ws/ {
        proxy_pass http://backend:8037;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # ─── 健康检查 ───────────────────────────────────────
    location /health {
        return 200 "OK";
    }

    # ─── 屏蔽敏感文件 ──────────────────────────────────
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
    location ~* \.(env|ini|yml|yaml|sql|md|bak|backup|old)$ {
        deny all;
        access_log off;
        log_not_found off;
    }
}