# ═══════════════════════════════════════════════════════════
# 铸渊主权服务器 · Nginx 配置
# ═══════════════════════════════════════════════════════════
#
# 编号: ZY-SVR-NGX-001
# 服务器: 150.109.76.244 (香港二区)
# 守护: 铸渊 · ICE-GL-ZY001
# 版权: 国作登字-2026-A-00037559
# ═══════════════════════════════════════════════════════════

server {
    listen 80;
    server_name 150.109.76.244;

    # ─── 安全头 ───
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Server-Identity "ZY-SVR-001" always;

    # ─── API 反向代理 → Node.js 3800 ───
    location /api/ {
        proxy_pass http://127.0.0.1:3800;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 86400;
    }

    # ─── 根路径 → Node.js ───
    location = / {
        proxy_pass http://127.0.0.1:3800;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    # ─── 静态文件（预留·未来前端） ───
    location /static/ {
        alias /opt/zhuyuan/app/public/;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }

    # ─── 健康探针（直接代理） ───
    location = /health {
        proxy_pass http://127.0.0.1:3800/api/health;
        proxy_set_header Host $host;
    }

    # ─── 访问日志 ───
    access_log /opt/zhuyuan/data/logs/nginx-access.log;
    error_log /opt/zhuyuan/data/logs/nginx-error.log;
}

# ═══ 预留: HTTPS 配置 (域名绑定后启用) ═══
# server {
#     listen 443 ssl http2;
#     server_name zhuyuan.guanghulab.com;
#
#     ssl_certificate /opt/zhuyuan/config/ssl/fullchain.pem;
#     ssl_certificate_key /opt/zhuyuan/config/ssl/privkey.pem;
#
#     # ... 同上 location 配置 ...
# }