# uniservice-mobile.hnxinyouhe.com Nginx 配置
# 1Panel 静态站点配置
# 文件位置: 1Panel 网站设置 -> 配置文件

server {
    listen 80;
    listen 443 ssl;
    server_name uniservice-mobile.hnxinyouhe.com;

    index index.php index.html index.htm default.php default.htm default.html;

    access_log /www/sites/uniservice-mobile.hnxinyouhe.com/log/access.log main;
    error_log /www/sites/uniservice-mobile.hnxinyouhe.com/log/error.log;

    # ============================================
    # 安全配置
    # ============================================

    location ~ ^/(\.user.ini|\.htaccess|\.git|\.env|\.svn|\.project|LICENSE|README.md) {
        return 404;
    }

    # Let's Encrypt ACME 挑战
    location ^~ /.well-known/acme-challenge {
        allow all;
        root /usr/share/nginx/html;
    }

    # 禁止访问敏感文件扩展
    if ($uri ~ "^/\.well-known/.*\.(php|jsp|py|js|css|lua|ts|go|zip|tar\.gz|rar|7z|sql|bak)$") {
        return 403;
    }

    # ============================================
    # SSL 证书配置
    # ============================================

    http2 on;

    if ($scheme = http) {
        return 301 https://$host$request_uri;
    }

    ssl_certificate /www/sites/uniservice-mobile.hnxinyouhe.com/ssl/fullchain.pem;
    ssl_certificate_key /www/sites/uniservice-mobile.hnxinyouhe.com/ssl/privkey.pem;
    ssl_protocols TLSv1.3 TLSv1.2;
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA384:DHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DSS:!DES:!RC4:!3DES:!MD5:!PSK:!KRB5:!SRP:!CAMELLIA:!SEED;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    error_page 497 https://$host$request_uri;

    # HSTS 安全头
    add_header Strict-Transport-Security "max-age=31536000" always;
    proxy_set_header X-Forwarded-Proto https;

    # ============================================
    # 后端 API 反向代理
    # ============================================

    location /api/ {
        proxy_pass http://127.0.0.1:8787;
        proxy_http_version 1.1;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;

        # 超时配置
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;

        # 缓冲配置
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 4k;
        proxy_busy_buffers_size 8k;
    }

    # ============================================
    # 飞书登录回调（必须在 API 之前匹配）
    # ============================================

    location /login {
        proxy_pass http://127.0.0.1:8787;
        proxy_http_version 1.1;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    location /login/callback {
        proxy_pass http://127.0.0.1:8787;
        proxy_http_version 1.1;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    location /login/qrcode {
        proxy_pass http://127.0.0.1:8787;
        proxy_http_version 1.1;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    # 飞书卡片回调
    location /feishu/card/callback {
        proxy_pass http://127.0.0.1:8787;
        proxy_http_version 1.1;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }

    # ============================================
    # 静态资源缓存
    # ============================================

    location ~* \.(js|css|png|jpg|jpeg|gif|webp|svg|ico|woff|woff2|ttf|eot)$ {
        root /www/sites/uniservice-mobile.hnxinyouhe.com/index;
        expires 7d;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    # ============================================
    # 前端 SPA（所有其他请求）
    # ============================================

    root /www/sites/uniservice-mobile.hnxinyouhe.com/index;

    location / {
        try_files $uri $uri/ /index.html;

        # SPA HTML 不缓存
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Pragma "no-cache";
        add_header Expires "0";
    }

    # 404 页面
    error_page 404 /404.html;
}