nginx.conf

load_module /etc/nginx/modules/ngx_http_brotli_filter_module.so;
load_module /etc/nginx/modules/ngx_http_brotli_static_module.so;
user www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    # 限流区域
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=login_limit:10m rate=1r/s;

    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
    limit_req_status 429;
    ##
    # 基础配置
    ##

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;

    keepalive_timeout 65;

    server_tokens off;

    ##
    # 日志
    ##

    access_log /var/log/nginx/access.log;
    error_log  /var/log/nginx/error.log warn;

    ##
    # GZIP 压缩
    ##

    gzip on;
    gzip_comp_level 6;
    gzip_min_length 1k;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_vary on;
    gzip_proxied any;

    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/json
        application/javascript
        application/x-javascript
        application/xml
        application/xml+rss
        application/rss+xml
        image/svg+xml;

    ##
    # Brotli 压缩（需要 nginx 安装 brotli 模块）
    #
    # Debian 默认 nginx 通常没有启用 brotli
    # 需要安装：
    #
    # apt install nginx-module-brotli
    #
    # 或自行编译模块
    ##

    brotli on;
    brotli_comp_level 6;
    brotli_static on;

    brotli_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/javascript
        application/json
        application/xml
        application/rss+xml
        application/atom+xml
        image/svg+xml;

    ##
    # upstream
    ##

    upstream springboot_backend {
        server 127.0.0.1:9527;
    }

    upstream websocket_backend {
        server 127.0.0.1:8891;
    }

    ##
    # HTTP
    ##

    server {

        listen 80;
        server_name fusionadmin.cn integration.net.cn syndra.cn;

        ##
        # React 打包目录
        ##

        root /home/syndra/web;
        index index.html;

        ##
        # React Router 支持
        ##

        location / {
            try_files $uri $uri/ /index.html;
        }

	# ==================================================
        # 静态资源缓存
        # ==================================================

        location ~* \.(js|css|png|jpg|jpeg|gif|svg|woff|woff2)$ {

            expires 30d;

            add_header Cache-Control "public, immutable";

            try_files $uri =404;
        }

	# ==================================================
        # 登录接口
        # 严格限流
        # ==================================================

        location /api/auth/login {

            proxy_pass http://springboot_backend;

            # 登录限流
            limit_req zone=login_limit burst=5 nodelay;

            # 并发限制
            limit_conn conn_limit 5;

            proxy_http_version 1.1;

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        ##
        # SpringBoot API 代理
        ##

        location /api/ {

            proxy_pass http://springboot_backend;

	        limit_req zone=api_limit burst=20 nodelay;

	        limit_conn conn_limit 20;

            proxy_http_version 1.1;

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

	        proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";

            proxy_connect_timeout 60s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;
 	}

        ##
        # WebSocket 代理
        # 后端 Netty 监听路径为 /ws/syndra（见 application.yml websocket.netty.path）。
        # proxy_pass 带末尾路径 /ws/，Nginx 会用它替换匹配 location 的前缀：
        #   /api/ws/syndra  -> http://websocket_backend/ws/syndra
        ##

        location /api/ws/ {

            proxy_pass http://websocket_backend/ws/;

            proxy_http_version 1.1;

            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            # WebSocket 长连接需要禁用读超时（或设置较大值），否则空闲后会被 Nginx 主动断开
            proxy_read_timeout 86400;
            proxy_send_timeout 86400;
        }

        ##
        # 静态资源缓存
        ##

        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf)$ {

            expires 30d;

            add_header Cache-Control "public, no-transform";
        }
    }

    ##
    # HTTPS 配置（暂时注释）
    ##

    # server {
    #
    #     listen 443 ssl http2;
    #     server_name your-domain.com;
    #
    #     root /home/syndra/web;
    #     index index.html;
    #
    #     ssl_certificate     /home/syndra/ssl/fullchain.pem;
    #     ssl_certificate_key /home/syndra/ssl/privkey.pem;
    #
    #     ssl_protocols TLSv1.2 TLSv1.3;
    #     ssl_ciphers HIGH:!aNULL:!MD5;
    #
    #     location / {
    #         try_files $uri $uri/ /index.html;
    #     }
    #
    #     location /api/ {
    #
    #         proxy_pass http://springboot_backend/;
    #
    #         proxy_http_version 1.1;
    #
    #         proxy_set_header Host $host;
    #         proxy_set_header X-Real-IP $remote_addr;
    #         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #         proxy_set_header X-Forwarded-Proto $scheme;
    #     }
    #
    #     location /api/ws/ {
    #
    #         proxy_pass http://websocket_backend/ws/;
    #
    #         proxy_http_version 1.1;
    #
    #         proxy_set_header Upgrade $http_upgrade;
    #         proxy_set_header Connection "upgrade";
    #
    #         proxy_set_header Host $host;
    #         proxy_read_timeout 86400;
    #         proxy_send_timeout 86400;
    #     }
    # }

}