user             nginx;
worker_processes auto;

pid       /var/run/nginx.pid;
error_log /var/log/nginx/error.log notice;

events {
    use                epoll;
    worker_connections 1024;
}

http {
    log_format main '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"';
    
    access_log /var/log/nginx/access.log main buffer=32k flush=10s;

    include      /etc/nginx/mime.types;
    include      /etc/nginx/conf.d/*.conf;
    default_type application/octet-stream;

    gzip            on;
    gzip_types      font/woff text/xml text/css text/plain text/javascript image/gif image/png image/jpg image/webp image/jpeg image/x-icon image/svg+xml application/json application/javascript application/octet-stream application/vnd.ms-fontobject;
    gzip_min_length 1k;

    sendfile                 on;
    server_tokens            off;
    keepalive_timeout        60;
    client_max_body_size     16m;
    fastcgi_intercept_errors on;

    server {
        listen 80   default_server;
        server_name localhost;
        error_page  497 https://$host$request_uri;
        return      301 https://$host$request_uri;
    }
    
    server {
        listen      443 ssl http2;
        server_name localhost;

        access_log  /var/log/nginx/taoyao.log main buffer=32k flush=10s;

        ssl_certificate     /data/certs/server.crt;
        ssl_certificate_key /data/certs/server.key;
        ssl_ciphers   TLS13-AES-128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-CBC-SHA256:ECDHE-ECDSA-AES128-CBC-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_session_timeout       30m;
        ssl_prefer_server_ciphers on;

        add_header Strict-Transport-Security "max-age=15552000; includeSubdomains; preload";

        location / {
            root  /data/taoyao/taoyao-client-web/dist;
            index index.html;
        }
    }
    
}