worker_processes 1;

events {
    worker_connections 1024;
}

http {
    client_max_body_size 50M;
    include       mime.types;
    default_type  application/octet-stream;
    sendfile      on;
    keepalive_timeout  65;

    # --- 关键：定义限流区域 (之前配置中缺少这行会报错) ---
    limit_req_zone $binary_remote_addr zone=yfios_device_api:10m rate=10r/s;

    server {
        listen       80;
        charset utf8;

        # 1. 开启 Gzip 压缩
        gzip on;
        gzip_min_length 1k;        
        gzip_buffers 8 32k;
        gzip_http_version 1.1;
        gzip_comp_level 6;         
        gzip_types text/plain application/javascript application/x-javascript 
                   text/javascript text/css application/xml application/json
                   image/svg+xml image/jpeg image/png; 
        gzip_vary on;              
        gzip_disable "MSIE [1-6]\.";

        # --- 关键：修改为 Docker 镜像内的路径 ---
        root D:/app/yfios-platform/frontend/yfios-iot-frontend/dist;
        index index.html index.htm;

        # 日志路径修改为 D:/app/logs
        access_log  D:/app/logs/nginx_access.log;
        error_log   D:/app/logs/nginx_error.log warn;

        # 2. 带有哈希值的资源：永久缓存
        location ~* \.(?:js|css|png|jpg|jpeg|gif|ico|svg|woff2?|ttf)$ {
            if ($request_uri ~* "[.-][a-f0-9]{8,}\.") {
                expires 365d;
                add_header Cache-Control "public, max-age=31536000, immutable";
                access_log off;
            }
            expires 1h;
            add_header Cache-Control "public, no-transform, must-revalidate";
            access_log off;
        }

        location / {
            add_header 'X-Frame-Options' 'DENY' always;
            add_header 'Access-Control-Allow-Origin' '*' always; # 容器内建议先设为*或你的域名
            add_header 'Access-Control-Allow-Credentials' 'true' always;
            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
            add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Token' always;
            add_header 'X-XSS-Protection' '1; mode=block' always;
            add_header 'X-Content-Type-Options' 'nosniff' always;

            if ($request_method = 'OPTIONS') {
                return 204;
            }

            try_files $uri $uri/ /index.html;
        } 

        # 3. 后端 API 代理 (连接容器内部 PM2 启动的 yfios-service)
        location /prod-api/ {
            limit_req zone=yfios_device_api burst=100 nodelay;    
            
            # 因为 node 服务也在同一个容器，用 127.0.0.1 性能最高
            proxy_pass http://127.0.0.1:8881/api/;
            
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_connect_timeout 60s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;
            
            add_header 'Access-Control-Allow-Origin' '*' always;
            add_header 'Access-Control-Allow-Credentials' 'true' always;
        }

        # 禁止访问敏感文件
        location ~ /\.(git|svn|htaccess|env) {
            deny all;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }     
}