@@ -0,0 +1,141 @@
# ============================================
# FastapiAdmin Nginx 配置文件
# ============================================
# 自动检测 CPU 核心数，多核服务器自动利用所有核心
worker_processes auto ;
# 错误日志输出到 stdout（Docker 容器日志最佳实践）
error_log /var/log/nginx/error.log warn ;
pid /var/run/nginx.pid ;
events {
accept_mutex on ; # 设置网络连接序列化，防止惊群现象发生，默认为on
multi_accept on ; # 设置一个进程是否同时接受多个网络连接，默认为off
use epoll ; # 事件驱动模型，select|poll|kqueue|epoll|resig|/dev/poll|eventport
worker_connections 1024 ; # 最大连接数，默认为512
}
http {
include mime.types ; # 文件扩展名与文件类型映射表
default_type application/octet-stream ; # 默认文件类型，默认为text/plain
# ==================== 基础优化 ====================
sendfile on ;
tcp_nopush on ;
tcp_nodelay on ;
keepalive_timeout 65 ;
keepalive_requests 1000 ;
types_hash_max_size 2048 ;
client_max_body_size 50m ;
server_tokens off ;
# ==================== 日志格式 ====================
log_format main ' $remote_addr - $remote_user [ $time_local] " $request" '
' $status $body_bytes_sent " $http_referer" '
'" $http_user_agent" " $http_x_forwarded_for" '
' $request_time $upstream_response_time' ;
access_log /var/log/nginx/access.log main buffer=32k flush=5s ;
# ==================== Gzip 压缩 ====================
gzip on ;
gzip_vary on ;
gzip_proxied any ;
gzip_comp_level 6 ;
gzip_min_length 256 ;
gzip_types
text/plain
text/css
text/javascript
application/javascript
application/json
application/xml
application/x-javascript
image/svg+xml
image/x-icon ;
# ==================== 安全头 ====================
# 全局安全头，默认被所有 server 块继承
add_header X-Frame-Options "SAMEORIGIN" always ;
add_header X-Content-Type-Options "nosniff" always ;
# HSTS：强制浏览器仅用 HTTPS 访问（仅 HTTPS 响应生效；配合下方 HTTP->HTTPS 301）
add_header Strict-Transport-Security "max-age=31536000 ; includeSubDomains" always ;
# 限制浏览器 API 能力（相机/麦克风/定位一律禁用）
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always ;
add_header Referrer-Policy "strict-origin-when-cross-origin" always ;
# ==================== 速率限制 ====================
# API 请求速率限制: 每 IP 每秒 30 个请求
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=30r/s ;
# 连接数限制: 每 IP 最多 100 个并发连接
limit_conn_zone $binary_remote_addr zone=conn_limit:10m ;
# ==================== HTTP -> HTTPS 重定向 ====================
# HTTP server块 - 重定向到HTTPS
server {
listen 80 ;
server_name service.fastapiadmin.com ;
return 301 https:// $server_name$request_uri ;
}
# ==================== HTTPS Server ====================
server {
listen 443 ssl http2 ;
server_name service.fastapiadmin.com ;
# ==================== SSL 配置 ====================
ssl_certificate /etc/nginx/ssl/server.pem ;
ssl_certificate_key /etc/nginx/ssl/server.key ;
ssl_protocols TLSv1.2 TLSv1.3 ;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384 ;
ssl_prefer_server_ciphers on ;
ssl_session_cache shared:SSL:10m ;
ssl_session_timeout 10m ;
# ==================== 官网（根路径） ====================
# 已禁用：docs 不开源，如需使用请取消注释
location / {
root /usr/share/nginx/html/docs/dist ;
index index.html index.htm ;
try_files $uri $uri/ /index.html ; #解决页面刷新404问题
}
# ==================== 前端（/web）
location /web {
alias /usr/share/nginx/html/web/dist ;
try_files $uri $uri/ /web/index.html ; #解决页面刷新404问题
}
# ==================== 小程序 H5（ ）
# 已禁用：app 不开源，如需使用请取消注释
location /app {
alias /usr/share/nginx/html/app/dist/build/h5 ;
try_files $uri $uri/ /app/index.html ; #解决页面刷新404问题
}
# ==================== 后端 API 代理 ====================
location /api/v1 {
proxy_set_header Host $host ;
proxy_set_header X-Real-IP $remote_addr ;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for ;
proxy_set_header X-Forwarded-Proto $scheme ;
proxy_set_header X-NginX-Proxy true ;
proxy_connect_timeout 300s ;
proxy_send_timeout 300s ;
proxy_read_timeout 300s ;
proxy_pass http://backend:8001 ;
# WebSocket 支持
proxy_http_version 1 .1 ;
proxy_set_header Upgrade $http_upgrade ;
proxy_set_header Connection "upgrade" ;
}
# ==================== 错误页面 ====================
error_page 500 502 503 504 /50x.html ;
location = /50x.html {
root /usr/share/nginx/html ;
}
}
}
34047007@qq.com