# =============================================
# 文件管理系统 - 生产环境 Nginx 配置
# =============================================
# 功能:
# 1. 前端静态资源服务
# 2. API反向代理到Go后端
# 3. MinIO反向代理(预签名模式)
# 4. X-Sendfile支持(中转模式优化)
# 5. HTTPS配置(可选)
# =============================================

worker_processes  auto;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile      off;  # Windows环境建议关闭
    charset       utf-8;

    # 日志格式
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent"';

    # Gzip压缩
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml;

    # =============================================
    # Upstream
    # =============================================
    upstream fileserver {
        server 127.0.0.1:8080;  # Go文件管理服务
        keepalive 32;
    }

    upstream minio {
        server 127.0.0.1:9000;  # MinIO服务(不暴露公网)
        keepalive 32;
    }

    # =============================================
    # HTTP → HTTPS 重定向(可选)
    # =============================================
    # server {
    #     listen 80;
    #     server_name files.example.com;
    #     return 301 https://$host$request_uri;
    # }

    # =============================================
    # 主站配置
    # =============================================
    server {
        listen       80;       # 或 443 ssl
        server_name  files.example.com;  # 替换为你的域名

        client_max_body_size 500m;  # 最大上传500MB

        # SSL配置(可选)
        # ssl_certificate     /path/to/cert.pem;
        # ssl_certificate_key /path/to/key.pem;
        # ssl_protocols TLSv1.2 TLSv1.3;

        # access_log logs/access.log main;

        # =============================================
        # 1. API请求 → Go后端
        # =============================================
        location ^~ /api/ {
            proxy_pass http://fileserver;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # 超时设置
            proxy_connect_timeout 30s;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
        }

        # =============================================
        # 2. MinIO反向代理(预签名模式)
        #    用户通过此路径直连MinIO获取文件
        #    关键: 必须保留签名参数
        # =============================================
        location ^~ /minio/ {
            proxy_pass http://minio/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;

            # 大文件下载超时
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;

            # 禁用缓冲(流式传输)
            proxy_buffering off;

            # 隐藏MinIO内部头
            proxy_hide_header X-Amz-Id-2;
            proxy_hide_header X-Amz-Request-Id;
        }

        # =============================================
        # 3. X-Sendfile路径(中转模式优化)
        #    Go后端返回X-Accel-Redirect头时,
        #    Nginx直接从本地路径发送文件
        # =============================================
        location ^~ /minio-files/ {
            internal;  # 仅允许内部重定向, 外部不可直接访问

            alias D:/Seeyon/A8/localfile/;

            # 优化大文件传输
            sendfile on;
            tcp_nopush on;

            # 缓存控制
            expires 30d;
            add_header Cache-Control "public, immutable";
            add_header X-Content-Type-Options nosniff;
        }

        # =============================================
        # 4. 前端静态资源
        # =============================================
        location / {
            root D:/Seeyon/A8/frontend/dist;  # 前端构建产物目录
            index index.html;

            # SPA路由支持
            try_files $uri $uri/ /index.html;

            # 静态资源缓存
            location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?)$ {
                expires 30d;
                add_header Cache-Control "public, immutable";
            }
        }

        # =============================================
        # 5. 安全头
        # =============================================
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
    }
}