user nginx nginx; # 定义nginx的启动用户，不建议使用root

error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

worker_rlimit_nofile 65535; # 这个值为nginx的worker进程打开的最大文件数，如果不配置，会读取服务器内核参数（通过ulimit -a查看），如果内核的值设置太低会让nginx报错（too many open file），但是在此设置后，就会读取自己配置的参数不去读取内核参数

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    use epoll; # 客户端线程轮询方法、内核2.6版本以上的建议使用epoll
    worker_connections 65535; # 设置一个worker可以打开的最大连接数
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   120;
    types_hash_max_size 2048;
	
    server_names_hash_bucket_size 128;
    client_header_buffer_size 32k;
    large_client_header_buffers 4 32k;
    client_max_body_size 8m;
	
    server_tokens       off; # 隐藏nginx版本号
	
    proxy_intercept_errors on;
    fastcgi_intercept_errors on;
    fastcgi_connect_timeout 1300;
    fastcgi_send_timeout 1300;
    fastcgi_read_timeout 1300;
    fastcgi_buffer_size 512k;
    fastcgi_buffers 4 512k;
    fastcgi_busy_buffers_size 512k;
    fastcgi_temp_file_write_size 512k;
 
    proxy_connect_timeout      20s;
    proxy_send_timeout         30s;
    proxy_read_timeout         30s;

    # 开启gzip
    gzip  on;
    # 启用gzip压缩的最小文件，小于设置值的文件将不会压缩
    gzip_min_length 1k;
    # gzip 压缩级别，1-10，数字越大压缩的越好，也越占用CPU时间。一般设置1和2
    gzip_comp_level 2;
    # 进行压缩的文件类型。javascript有多种形式。其中的值可以在 mime.types 文件中找到。
    gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png;
    # 是否在http header中添加Vary: Accept-Encoding，建议开启
    gzip_vary on;
    # 禁用IE 6 gzip
    gzip_disable "MSIE [1-6]\.";
    # 设置缓存路径并且使用一块最大100M的共享内存，用于硬盘上的文件索引，包括文件名和请求次数，每个文件在1天内若不活跃（无请求）则从硬盘上淘汰，硬盘缓存最大10G，满了则根据LRU算法自动清除缓存。
    proxy_cache_path /var/cache/nginx/cache levels=1:2 keys_zone=imgcache:100m inactive=1d max_size=10g;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /usr/local/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

upstream cnxiaobai {
    server 192.168.10.20:8080;
}

# http自动跳转https
server {
    listen 80;
    server_name cnxiaobai.com www.cnxiaobai.com;
    rewrite ^(.*) https://$server_name$1 permanent;
}

server {
    listen 443 ssl http2; # 添加 http2 支持
    server_name www.cnxiaobai.com;
    # 证书路径
    ssl_certificate /etc/nginx/ssl/server.cer;
    ssl_certificate_key /etc/nginx/ssl/server.key;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 5m;
	
    # 浏览器已支持TLSv1.3，建议加上
    # TLSv1和TLSv1.1即将废弃，如果不需要支持IE和XP建议去掉
    # IE8-10/Win7需要TLSv1.0；IE8以下需要SSL3和单证书
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4;	
    ssl_prefer_server_ciphers on; # on由服务器决定加密算法，off由浏览器决定，推荐使用on，更安全，对服务器性能有少量影响
    access_log off;
	
    # HSTS(ngx_http_headers_module is required) (180d)
    # 严格传输安全：即在时间过期之前，每次访问HTTP站点时，由客户端直接跳转到HTTPS站点
    # 设置后，该网站的HTTP站点无法打开，只能等待过期或禁用配置后清空浏览器缓存
    # 启用后注意保持证书不过期，证书过期后网站可能无法访问
    add_header Strict-Transport-Security "max-age=15552000" always;
	
    # 开启 OCSP Stapling，作用：由服务器在线查询证书吊销情况
    # 默认是由浏览器在线查询，由服务器查询效率更高
    ssl_stapling on;
	
    # OCSP Stapling 验证开启
    ssl_stapling_verify on;

    # 定时检测 DNS 的变化，自动更新 DNS 对应的 IP 列表
    resolver 223.5.5.5 valid=5s;
    resolver_timeout 1
 
    location / {
        proxy_pass http://cnxiaobai;
        # 隐藏端口号
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Forwarded-Proto $scheme;
        client_max_body_size 10m;

        proxy_connect_timeout 30; #超时时间
        proxy_send_timeout 60;
        proxy_read_timeout 60;

        proxy_buffer_size 32k;
        proxy_buffering on; #开启缓冲区,减少磁盘io
        proxy_buffers 4 128k;
        proxy_busy_buffers_size 256k;
        proxy_max_temp_file_size 256k; #当超过内存允许储蓄大小，存到文件
    }

    location ~ .*\.(css|js|ico|gif|jpg|jpeg|png|otf|eot|svg|ttf|woff|woff2|htm|mp3)$ {
	log_not_found off;
	expires 7d; 
	access_log off;
	root /home/power/static/;
	proxy_store on; 
	proxy_temp_path    /home/power/static/;
	proxy_redirect     off;  
	proxy_set_header   Host 192.168.10.20:8080;  
	client_max_body_size  10m;
	client_body_buffer_size 1280k;  
        proxy_connect_timeout  900;  
        proxy_send_timeout   900;  
        proxy_read_timeout   900;  
        proxy_buffer_size    40k;  
        proxy_buffers      40 320k;  
        proxy_busy_buffers_size 640k;  
        proxy_temp_file_write_size 640k;  
        if ( !-e $request_filename)  
	{  
	     proxy_pass http://192.168.10.20:8080;
	}
	# 缓存过期管理
	proxy_cache_valid 200 302 1d;
	proxy_cache_valid 404 10m;
	proxy_cache_valid any 1h;
	proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
    }
}

}