每日一题fix3

nginx.conf

@@ -88,14 +88,105 @@ http {
             proxy_read_timeout                 60s;
         }
 
-        location /apis/ {
-            proxy_pass                         http://47.111.95.164:8080/api/;
+        # favicon.ico
+        location = /favicon.ico {
+            log_not_found off;
+            access_log    off;
+        }
+
+        # robots.txt
+        location = /robots.txt {
+            log_not_found off;
+            access_log    off;
+        }
+
+        # assets, media
+        location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
+            expires    7d;
+            access_log off;
+        }
+
+        # svg, fonts
+        location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
+            add_header Access-Control-Allow-Origin "*";
+            expires    7d;
+            access_log off;
+        }
+
+        # gzip
+        gzip            on;
+        gzip_vary       on;
+        gzip_proxied    any;
+        gzip_comp_level 6;
+        gzip_types      text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
+    }
+
+    server {
+        listen                             80;
+        listen                             [::]:80;
+        server_name                        eval.seec.seecoder.cn;
+        root                               /var/www/eval.seec.seecoder.cn/public;
+
+        # security headers
+        add_header X-Frame-Options         "SAMEORIGIN" always;
+        add_header X-XSS-Protection        "1; mode=block" always;
+        add_header X-Content-Type-Options  "nosniff" always;
+        add_header Referrer-Policy         "no-referrer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+
+        # . files
+        location ~ /\.(?!well-known) {
+            deny all;
         }
 
-        location /apiss/ {
-            proxy_pass                         http://47.111.95.164:8080/api/;
+        # index.html fallback
+        location / {
+            try_files $uri $uri/ /index.html;
+        }
+
+        # reverse proxy
+        location /apis {
+            proxy_pass                         http://47.111.95.164:8080/api;
+            proxy_http_version                 1.1;
+            proxy_cache_bypass                 $http_upgrade;
+
+            # Proxy headers
+            proxy_set_header Upgrade           $http_upgrade;
+            proxy_set_header Connection        $connection_upgrade;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Host  $host;
+            proxy_set_header X-Forwarded-Port  $server_port;
+
+            # Proxy timeouts
+            proxy_connect_timeout              60s;
+            proxy_send_timeout                 60s;
+            proxy_read_timeout                 60s;
         }
 
+        location /apiss {
+            proxy_pass                         http://47.111.95.164:8080/api;
+            proxy_http_version                 1.1;
+            proxy_cache_bypass                 $http_upgrade;
+
+            # Proxy headers
+            proxy_set_header Upgrade           $http_upgrade;
+            proxy_set_header Connection        $connection_upgrade;
+            proxy_set_header Host              $host;
+            proxy_set_header X-Real-IP         $remote_addr;
+            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Host  $host;
+            proxy_set_header X-Forwarded-Port  $server_port;
+
+            # Proxy timeouts
+            proxy_connect_timeout              60s;
+            proxy_send_timeout                 60s;
+            proxy_read_timeout                 60s;
+        }
+        
         # favicon.ico
         location = /favicon.ico {
             log_not_found off;