# ============================================
# FastapiAdmin Nginx 配置文件
# ============================================

# 自动检测 CPU 核心数，多核服务器自动利用所有核心
worker_processes auto;

# 错误日志输出到 stdout（Docker 容器日志最佳实践）
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 2048;
    multi_accept on;
    use epoll;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    # ==================== 基础优化 ====================
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 1000;
    types_hash_max_size 2048;
    client_max_body_size 50m;
    server_tokens off;

    # ==================== 日志格式 ====================
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for" '
                    '$request_time $upstream_response_time';

    access_log /var/log/nginx/access.log main buffer=32k flush=5s;

    # ==================== Gzip 压缩 ====================
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_min_length 256;
    gzip_types
        text/plain
        text/css
        text/javascript
        application/javascript
        application/json
        application/xml
        application/x-javascript
        image/svg+xml
        image/x-icon;

    # ==================== 安全头 ====================
    # 全局安全头，默认被所有 server 块继承
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # ==================== 速率限制 ====================
    # API 请求速率限制: 每 IP 每秒 30 个请求
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=30r/s;
    # 连接数限制: 每 IP 最多 100 个并发连接
    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

    # ==================== HTTP -> HTTPS 重定向 ====================
    server {
        listen 80;
        listen [::]:80;
        server_name service.fastapiadmin.com;

        # Let's Encrypt ACME 验证支持
        location /.well-known/acme-challenge/ {
            root /var/www/html;
        }

        # 健康检查端点（HTTP 同样响应）
        location /health {
            access_log off;
            return 200 "OK";
            add_header Content-Type text/plain;
        }

        location / {
            return 301 https://$server_name$request_uri;
        }
    }

    # ==================== HTTPS Server ====================
    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        http2 on;
        server_name service.fastapiadmin.com;

        # ==================== SSL 配置 ====================
        ssl_certificate     /etc/nginx/ssl/server.pem;
        ssl_certificate_key /etc/nginx/ssl/server.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        ssl_session_tickets off;
        # HSTS (31536000 秒 = 1 年)
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        # ==================== 官网（根路径） ====================
        location / {
            root /usr/share/nginx/html/docs/dist;
            index index.html;
            try_files $uri $uri/ /index.html;
            expires 30d;
            add_header Cache-Control "public, no-transform";
        }

        # ==================== 前端（/web） ====================
        location /web {
            alias /usr/share/nginx/html/web/dist;
            index index.html;
            try_files $uri $uri/ /web/index.html;
            expires 30d;
            add_header Cache-Control "public, no-transform";
        }

        # ==================== 小程序 H5（/app） ====================
        location /app {
            alias /usr/share/nginx/html/app/dist/build/h5;
            index index.html;
            try_files $uri $uri/ /app/index.html;
            expires 30d;
            add_header Cache-Control "public, no-transform";
        }

        location /api/v1/common/health {
            access_log off;
            return 200 "OK";
            add_header Content-Type text/plain;
        }

        # ==================== 后端 API 代理 ====================
        location /api/v1/ {
            # 速率限制: 每 IP 每秒最多 30 个 API 请求
            limit_req zone=api_limit burst=20 nodelay;
            limit_conn conn_limit 100;

            # 后端服务器地址（结尾 / 会去掉 /api/v1 前缀再转发）
            proxy_pass http://backend:8001/;

            # WebSocket 支持
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # 超时设置
            proxy_connect_timeout 30s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;

            # 代理缓存禁用
            proxy_buffering off;
            proxy_cache off;
        }

        # 不带 /api/v1/ 前缀的请求直接返回 404
        location = /api/v1 {
            return 404;
        }

        # ==================== Nginx 健康检查 ====================
        location /nginx-health {
            access_log off;
            return 200 "OK";
            add_header Content-Type text/plain;
        }

        # ==================== 错误页面 ====================
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /usr/share/nginx/html;
            internal;
        }
    }
}