# Nginx 配置文件 for ST-System

worker_processes  4;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;

    # 允许大文件上传 (500MB)
    client_max_body_size 500M;

    # 定义后端服务地址
    upstream st_backend {
        server 127.0.0.1:5000;
    }

    # HTTPS 服务器配置
    server {
        listen       443 ssl;
        server_name  localhost;

        # SSL 证书配置
        ssl_certificate      server.cert;
        ssl_certificate_key  server.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        # 安全响应头
        add_header X-Frame-Options "SAMEORIGIN";
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Content-Type-Options "nosniff";

        # 1. 前端静态资源 (React)
        # 直接由 Nginx 提供服务，性能更高
        location / {
            # 安全策略：拦截移动端访问，重定向到提示页
            if ($http_user_agent ~* "(mobile|android|iphone|ipad|phone)") {
                return 302 /mobile_forbidden.html;
            }

            root   c:/Users/16216/Desktop/STsystem/client/build;
            index  index.html index.htm;
            try_files $uri $uri/ /index.html;
        }

        # 移动端禁止访问提示页
        location = /mobile_forbidden.html {
            root c:/Users/16216/Desktop/STsystem/static;
        }

        # 2. 后端 API 接口
        location /api/ {
            proxy_pass http://st_backend;
            
            # 传递真实 IP (配合后端 app.set('trust proxy', 1))
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # 支持 WebSocket
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

        # 3. 上传文件访问
        location /uploads/ {
            alias c:/Users/16216/Desktop/STsystem/server/uploads/;
            expires 30d;
            add_header Cache-Control "public, no-transform";
            
            # 安全加固：禁止目录列表和脚本执行
            autoindex off;
            # 确保不解析 PHP 等脚本 (如果服务器安装了 PHP)
            location ~ \.(php|jsp|asp|aspx|py|pl|sh|cgi)$ {
                deny all;
                return 403;
            }
        }
    }

    # HTTP 自动跳转 HTTPS
    server {
        listen       80;
        server_name  localhost;
        return 301 https://$host$request_uri;
    }
}