#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
           include       mime.types;
           default_type  application/octet-stream;
           #access_log         logs/access.log  main;
           charset             UTF-8;
           sendfile            on;
           tcp_nopush          on;
           tcp_nodelay        on;
           keepalive_timeout   30;

           # 开启gzip压缩
           gzip            on;
           gzip_vary           on;
           gzip_comp_level     6;
           gzip_buffers        16 8k;
           gzip_min_length     1000;
           gzip_proxied        any;
           gzip_disable        "msie6";
           gzip_http_version   1.0;
           gzip_types          text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;

        #    server {
        #       listen 80 ;
        #   # Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
        #       return 301 https://$host$request_uri;
        #     }

           # 缓存
           proxy_cache_path  /usr/local/nginx_cache/blog/proxy_cache_pathlevels=1:2 keys_zone=pnc:300m inactive=7d max_size=10g;
           proxy_temp_path   /usr/local/nginx_cache/blog/proxy_temp_path;
           proxy_cache_key   $host$uri$is_args$args;

           server {
                        listen 80 ;
                        listen 443 ssl ;
                        # listen 443 443 ssl http2 fastopen=3 reuseport;

                        server_name  www.example.com example.com;

                        server_tokens off;

                        ssl_certificate /etc/letsencrypt/live/www.example.com/fullchain.pem;
                        ssl_certificate_key  /etc/letsencrypt/live/www.example.com/privkey.pem;
                            ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';



                        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;


                        ssl_prefer_server_ciphers on;
                        ssl_session_cache shared:SSL:10m;
                        ssl_session_timeout 30m;

                        ssl_session_tickets on;
                        ssl_stapling on;
                        ssl_stapling_verify on;
                        if ($host != 'www.example.com' ) {
                                rewrite          ^/(.*)$  https://www.example.com/$1 permanent;
                        }

                        location / {
                                           proxy_http_version        1.1;
                                           add_header  Strict-Transport-Security  "max-age=31536000";
                                           add_header  X-Frame-Options  deny;
                                           add_header  X-Content-Type-Options  nosniff;
                                           resolver                  127.0.0.1;
                                           proxy_cache               pnc;
                                           proxy_cache_valid         200 304 2h;
                                           proxy_cache_lock          on;
                                           proxy_cache_lock_timeout  5s;
                                           proxy_cache_use_stale     updating error timeout invalid_header http_500 http_502;
                                           proxy_ignore_headers      Set-Cookie;

                                    #     proxy_set_header Host www.example.com;
                                    #     proxy_set_header X-Real-IP $remote_addr;
                                    #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;


                                           proxy_pass     http://example.com:8088 ;
                       }
           }
}