# 完整的nginx配置 - 支持HTTP重定向和WebSocket

# 在 http 块中添加 WebSocket 升级映射
http {
    # WebSocket 升级映射 - 必须在 http 块中
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }
    
    # HTTP server - 重定向到HTTPS
    server {
        listen 80;
        server_name whaletownend.xinghangee.icu;
        
        # 重定向所有HTTP请求到HTTPS
        return 301 https://$host$request_uri;
    }
    
    # HTTPS server - 主要配置
    server {
        listen 443 ssl;
        server_name whaletownend.xinghangee.icu;

        # SSL配置
        ssl_certificate /home/ubuntu/node_test/keys/whaletownend.xinghangee.icu_bundle.crt;
        ssl_certificate_key /home/ubuntu/node_test/keys/whaletownend.xinghangee.icu.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;
        
        # 安全头
        add_header X-Content-Type-Options "nosniff" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
        
        client_max_body_size 500M;

        # Socket.IO 配置 - 使用升级映射
        location /socket.io/ {
            proxy_pass http://127.0.0.1:3000/socket.io/;

            # 基础反向代理头
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # WebSocket 核心配置 - 使用映射变量
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;  # 使用映射变量

            # 超时配置
            proxy_connect_timeout 75s;
            proxy_send_timeout 3600s;
            proxy_read_timeout 3600s;
            
            # 关闭缓冲
            proxy_buffering off;
            proxy_cache off;
        }

        # 普通HTTP请求
        location / {
            proxy_pass http://127.0.0.1:3000;
            
            # 基础代理头
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # HTTP配置
            proxy_http_version 1.1;
            proxy_set_header Connection "";

            # 超时配置
            proxy_connect_timeout 60s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;

            # 关闭缓冲
            proxy_buffering off;
        }
    }
}