杂散笔记

1
server_names_hash_bucket_size 128;
2

3
map $host $site_root_name {
4
  default _;
5
  loliblogs.yearnstudio.cn loliblogs;
6
  lolifamily.yearnstudio.cn lolifamily;
7
}
8

9
map $http_upgrade $connection_upgrade {
10
  default upgrade;
11
  ''      close;
12
}
13

14
gzip on;
15
gzip_proxied any;
16
gzip_vary on;
17
gzip_types text/html text/richtext text/plain text/css text/x-script text/x-component text/x-java-source text/x-markdown application/javascript application/x-javascript text/javascript text/js image/x-icon image/vnd.microsoft.icon application/x-perl application/x-httpd-cgi text/xml application/xml application/rss+xml application/vnd.api+json application/x-protobuf application/json multipart/bag multipart/mixed application/xhtml+xml font/ttf font/otf font/x-woff font/woff2 font/svg+xml image/svg+xml application/vnd.ms-fontobject application/ttf application/x-ttf application/otf application/x-otf application/truetype application/opentype application/x-opentype application/font-woff application/eot application/font application/font-sfnt application/wasm application/javascript-binast application/manifest+json application/ld+json application/geo+json;
18

19
server {
20
  listen 80 default_server;
21
  listen [::]:80 default_server;
22
  server_name _;
23

24
  location ~ ^/\.well-known/ {
25
    root /usr/share/nginx/html;
26
  }
27

28
  location / {
29
    return 301 https://$host$request_uri;
30
  }
31
}
32

33
# modern configuration
34
ssl_protocols TLSv1.3;
35
ssl_ecdh_curve X25519:prime256v1:secp384r1;
36
ssl_prefer_server_ciphers off;
37

38
server {
39
  listen 443 ssl default_server;
40
  listen [::]:443 ssl default_server;
41
  http2 on;
42

43
  listen 443 quic reuseport;
44
  listen [::]:443 quic reuseport;
45
  server_name _;
46

47
  if ($site_root_name = _) {
48
    return 444;
49
  }
50

51
  ssl_certificate conf.d/lolifamily.pem;
52
  ssl_certificate_key conf.d/lolifamily.key;
53

54
  # HSTS (ngx_http_headers_module is required) (63072000 seconds)
55
  add_header Alt-Svc 'h3=":443"; ma=86400' always;
56
  add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-src 'self' https://giscus.app; frame-ancestors 'none';" always;
57
  add_header X-Frame-Options "DENY" always;
58
  add_header X-Content-Type-Options "nosniff" always;
59
  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
60
  add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
61
  add_header Cross-Origin-Opener-Policy "same-origin" always;
62
  add_header Cross-Origin-Resource-Policy "same-origin" always;
63
  add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
64

65
  location ~ /_astro {
66
    add_header Cache-Control "public, max-age=63072000, immutable" always;
67
  }
68

69
  error_page 404 /404.html;
70
  error_page 403 500 502 503 504 /403.html;
71

72
  try_files $uri $uri.html $uri/ =404;
73

74
  root /usr/share/nginx/html/$site_root_name;
75
}
76

77
server {
78
  listen 443 ssl;
79
  listen [::]:443 ssl;
80
  server_name mcsm-demo-nb2.hugo.net.cn;
81
  http2 on;
82

83
  ssl_certificate conf.d/fullchain.crt;
84
  ssl_certificate_key conf.d/private.key;
85

86
  add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'; sandbox;" always;
87
  add_header X-Frame-Options "DENY" always;
88
  add_header X-Content-Type-Options "nosniff" always;
89
  add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
90
  add_header Cross-Origin-Opener-Policy "same-origin" always;
91
  add_header Cross-Origin-Resource-Policy "same-origin" always;
92
  add_header Cache-Control "no-store, no-cache, must-revalidate";
93

94
  location / {
95
    proxy_pass http://127.0.0.1:24444;
96
    proxy_set_header Host $host;
97
    proxy_set_header X-Real-IP $remote_addr;
98
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
99
    proxy_set_header X-Forwarded-Proto $scheme;
100
    proxy_set_header X-Forwarded-Host $host;
101

102
    proxy_http_version 1.1;
103
    proxy_set_header Upgrade $http_upgrade;
104
    proxy_set_header Connection $connection_upgrade;
105

106
    proxy_read_timeout 60s;
107
    proxy_send_timeout 30s;
108

109
    # Disable cache
110
    proxy_request_buffering off;
111
    proxy_buffering off;
112
  }
113
}