# 门店检测工作台 —— nginx 反向代理配置
#
# 用途：把 https://yhm-shop-data.hzbeautybox.com/ 转发到本机的 127.0.0.1:8787
#
# 安装：
#   sudo cp deploy/nginx-yhm-shop-data.conf /etc/nginx/conf.d/
#   sudo nginx -t && sudo systemctl reload nginx
#
# 证书（二选一）：
#   A. Let's Encrypt 免费证书
#      sudo certbot --nginx -d yhm-shop-data.hzbeautybox.com
#      （certbot 会自动改这个文件的 443 部分，不用手写 ssl 参数）
#   B. 公司已有证书 → 把下面 ssl_certificate 两行改成实际路径
#
# 注意：应用要以 --local 启动，只监听 127.0.0.1，不直接暴露 8787

# ---------- 80：全部跳转到 HTTPS ----------
server {
    listen 80;
    listen [::]:80;
    server_name yhm-shop-data.hzbeautybox.com;

    # Let's Encrypt 续期验证需要这一条
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# ---------- 443：正式服务 ----------
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name yhm-shop-data.hzbeautybox.com;

    # ---- 证书（改用 Let's Encrypt 的话把这两行替换成 certbot 生成的路径）----
    ssl_certificate     /etc/nginx/ssl/yhm-shop-data.crt;
    ssl_certificate_key /etc/nginx/ssl/yhm-shop-data.key;
    # Let's Encrypt 默认路径：
    # ssl_certificate     /etc/letsencrypt/live/yhm-shop-data.hzbeautybox.com/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/yhm-shop-data.hzbeautybox.com/privkey.pem;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 1d;

    # 上传 Excel 用，文件一般几百 KB，留足余量
    client_max_body_size 30m;

    # 安全响应头
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;
    add_header Referrer-Policy no-referrer-when-downgrade always;

    location / {
        proxy_pass http://127.0.0.1:8787;
        proxy_http_version 1.1;

        # 让后端知道真实来源（会话记录、日志、Secure Cookie 判断都靠这几个）
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 同步接口要跑几分钟，超时给足
        proxy_connect_timeout 30s;
        proxy_send_timeout    600s;
        proxy_read_timeout    600s;

        # 导出大文件时不要缓冲到内存
        proxy_buffering off;
    }
}