###############################################################################
#  https.conf · 生产级 HTTPS 完整模板
#  - 强制 HTTPS、HTTP/2、HSTS、A+ SSL 评分
#  - 兼容 Let's Encrypt 自动续签（HTTP-01 验证）
###############################################################################

# ---------- HTTP → HTTPS 301 跳转 ----------
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    # 1. 让 Let's Encrypt 续签时能验证（不能跳转）
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    # 2. 其他全部 301 跳到 HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}

# ---------- HTTPS 主站 ----------
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    # ---- 证书 ----
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    # ---- 协议 + 加密套件（A+ 配置） ----
    ssl_protocols           TLSv1.2 TLSv1.3;
    ssl_ciphers             ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    # ---- 会话缓存 ----
    ssl_session_cache    shared:SSL:10m;
    ssl_session_timeout  1d;
    ssl_session_tickets  off;

    # ---- OCSP Stapling ----
    ssl_stapling          on;
    ssl_stapling_verify   on;
    resolver 1.1.1.1 8.8.8.8 valid=300s;
    resolver_timeout 5s;

    # ---- 安全响应头 ----
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options          SAMEORIGIN always;
    add_header X-Content-Type-Options   nosniff   always;
    add_header Referrer-Policy          "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy       "geolocation=(), microphone=(), camera=()" always;

    # ---- 业务路由 ----
    root  /var/www/html;
    index index.html;

    location / {
        try_files $uri $uri/ /index.html;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:3000/;
        proxy_http_version 1.1;
        proxy_set_header Connection         "";
        proxy_set_header Host               $host;
        proxy_set_header X-Real-IP          $remote_addr;
        proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto  $scheme;
    }
}
