user             nginx;
worker_processes auto;

pid       /var/run/nginx.pid;
error_log /var/log/nginx/error.log notice;

events {
    use                epoll;
    worker_connections 1024;
}

http {
    log_format main '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"';
    
    access_log /var/log/nginx/access.log main buffer=32k flush=10s;

    include      /etc/nginx/mime.types;
    include      /etc/nginx/conf.d/*.conf;
    default_type application/octet-stream;

    gzip            on;
    gzip_types      text/xml text/css text/plain text/javascript image/gif image/png image/jpg image/webp image/jpeg image/x-icon image/svg+xml application/json application/javascript font/woff application/octet-stream application/vnd.ms-fontobject;
    gzip_min_length 1k;

    sendfile                 on;
#   tcp_nopush               on;
    server_tokens            off;
    keepalive_timeout        60;
    client_max_body_size     16m;
    fastcgi_intercept_errors on;

    upstream taoyao {
        server    https://localhost:8888;
        keepalive 60;
    }

    server {
        listen 80  default_server;
        listen 443 ssl default_server;
        ssl_certificate     /data/certs/server.crt;
        ssl_certificate_key /data/certs/server.key;
        error_page 497 https://$host:$server_port$request_uri;
        return     301 https://taoyao.acgist.com$request_uri;
    }
    
    server {
        listen      443 ssl http2;
        server_name taoyao.acgist.com;

        access_log  /var/log/nginx/taoyao.acgist.com.log main buffer=32k flush=10s;

        ssl_certificate     /data/certs/server.crt;
        ssl_certificate_key /data/certs/server.key;
        ssl_ciphers   TLS13-AES-128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-CBC-SHA256:ECDHE-ECDSA-AES128-CBC-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_session_timeout       30m;
        ssl_prefer_server_ciphers on;

#       proxy_http_version 1.1;
        proxy_http_version 2.0;

#       proxy_set_header   Connection         close;
        proxy_set_header   Connection         keep-alive;
        proxy_set_header   Host               $host;
#       proxy_set_header   Host               $host:$server_port;
#       proxy_set_header   X-Scheme           $scheme;
        proxy_set_header   X-Real-IP          $remote_addr;
#       proxy_set_header   X-Http-scheme      $scheme;
        proxy_set_header   X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host   $host;
        proxy_set_header   X-Forwarded-Proto  $scheme;
        proxy_set_header   X-Forwarded-Server $host;

        add_header Strict-Transport-Security "max-age=15552000; includeSubdomains; preload";

        location = /websocket.signal {
            proxy_set_header      Upgrade    $http_upgrade;
            proxy_set_header      Connection "Upgrade";
            keepalive_timeout     1200s;
            proxy_read_timeout    1200s;
            proxy_send_timeout    1200s;
            proxy_connect_timeout 30s;
            proxy_pass            taoyao;
        }

        location / {
            proxy_pass taoyao;
        }
    }
    
}