FastapiAdmin/docker/nginx/nginx.conf

# ============================================
# FastapiAdmin Nginx 配置文件
# ============================================

# 自动检测 CPU 核心数，多核服务器自动利用所有核心
worker_processes auto;

# 错误日志输出到 stdout（Docker 容器日志最佳实践）
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    accept_mutex on; # 设置网络连接序列化，防止惊群现象发生，默认为on
    multi_accept on; # 设置一个进程是否同时接受多个网络连接，默认为off
    use epoll; # 事件驱动模型，select|poll|kqueue|epoll|resig|/dev/poll|eventport
    worker_connections 1024; # 最大连接数，默认为512
}

http {
    include mime.types; # 文件扩展名与文件类型映射表
    default_type application/octet-stream; # 默认文件类型，默认为text/plain

    # ==================== 基础优化 ====================
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 1000;
    types_hash_max_size 2048;
    client_max_body_size 50m;
    server_tokens off;

    # ==================== 日志格式 ====================
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for" '
                    '$request_time $upstream_response_time';

    access_log /var/log/nginx/access.log main buffer=32k flush=5s;

    # ==================== Gzip 压缩 ====================
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_min_length 256;
    gzip_types
        text/plain
        text/css
        text/javascript
        application/javascript
        application/json
        application/xml
        application/x-javascript
        image/svg+xml
        image/x-icon;

    # ==================== 安全头 ====================
    # 全局安全头，默认被所有 server 块继承
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # ==================== 速率限制 ====================
    # API 请求速率限制: 每 IP 每秒 30 个请求
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=30r/s;
    # 连接数限制: 每 IP 最多 100 个并发连接
    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

    # ==================== HTTP -> HTTPS 重定向 ====================
    # HTTP server块 - 重定向到HTTPS（放行 ACME 校验路径，供证书自动续期使用）
    server {
        listen 80;
        server_name service.fastapiadmin.com;

        # 证书续期校验路径（ACME http-01）：必须在 301 之前放行，
        # 否则签发/续期校验请求会被重定向到 https 而导致验证失败。
        location ^~ /.well-known/acme-challenge/ {
            root /usr/share/nginx/html/acme;
            default_type "text/plain";
            access_log off;
        }

        location / {
            return 301 https://$server_name$request_uri;
        }
    }

    # ==================== HTTPS Server ====================
    server {
        listen 443 ssl;
        http2 on;
        server_name service.fastapiadmin.com;
        
        # ==================== SSL 配置 ====================
        ssl_certificate     /etc/nginx/ssl/server.pem;
        ssl_certificate_key /etc/nginx/ssl/server.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;

        # ==================== 官网（根路径） ====================
        # 已禁用：docs 不开源，如需使用请取消注释
        location / {
            root /usr/share/nginx/html/docs/dist;
            index index.html index.htm;
            try_files $uri $uri/ /index.html; #解决页面刷新404问题
        }

        # ==================== 前端（/web） ====================
        location /web {
        include cache-headers.inc;  # 静态资源长缓存（优化项，可删除）
            alias /usr/share/nginx/html/web/dist;
            try_files $uri $uri/ /web/index.html; #解决页面刷新404问题
        }
        location ~ /\. { deny all; access_log off; log_not_found off; }


        # ==================== 小程序 H5（/app） ====================
        # 已禁用：app 不开源，如需使用请取消注释
        location /app {
        include cache-headers.inc;  # 静态资源长缓存（优化项，可删除）
            alias /usr/share/nginx/html/app/dist/build/h5;
            try_files $uri $uri/ /app/index.html; #解决页面刷新404问题
        }
        location ~ /\. { deny all; access_log off; log_not_found off; }



        # ==================== 封堵接口文档（仅本机/内网可访问）====================
        location ~ ^/api/v1/(docs|redoc|openapi\.json)$ {
            allow 127.0.0.1;
            allow 10.0.0.0/8;
            allow 172.16.0.0/12;
            allow 192.168.0.0/16;
            deny all;
            proxy_pass http://backend:8001;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
        # ==================== 后端 API 代理 ====================
        location /api/v1 {
            limit_req zone=api_limit burst=60 nodelay;
            limit_conn conn_limit 100;

            proxy_set_header Host $host;
            proxy_set_header  X-Real-IP  $remote_addr;
            proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-NginX-Proxy true;
            proxy_connect_timeout 300s;
            proxy_send_timeout 300s;
            proxy_read_timeout 300s;
            proxy_pass http://backend:8001;

            # WebSocket 支持
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

        # ==================== 错误页面 ====================
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
    }
}