# ═══════════════════════════════════════════════
# 铸渊专线 · Nginx订阅服务反向代理
# 添加到 /etc/nginx/sites-enabled/ 中的主配置
# ═══════════════════════════════════════════════

# §3 铸渊专线订阅服务
# 通过主域名的 /api/proxy-sub/ 路径访问
# 实际由 subscription-server.js (port 3802) 处理

location /api/proxy-sub/ {
    proxy_pass http://127.0.0.1:3802/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # 订阅服务安全头
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options DENY always;
    add_header Cache-Control "no-store, no-cache, must-revalidate" always;
}