http {
    server_tokens off;
}

curl -I http://your-site.com
# 沒有 server_tokens 時(shí)：Server: nginx/1.18.0
# 開啟后：Server: nginx

server {
    # 只允許常見 HTTP 方法
    if ($request_method !~ ^(GET|POST|PUT|DELETE|HEAD|OPTIONS|PATCH)$) {
        return 405;
    }
    
    # 限制請求體大?。ǚ乐箰阂馍蟼鞒笪募谋M內(nèi)存）
    client_max_body_size 10M;
    client_body_buffer_size 128k;
    
    # 限制請求頭大小（防止 Slowloris 攻擊）
    large_client_header_buffers 4 16k;
}

location / {
    # 顯式拒絕 TRACE 和 TRACK 方法（可能用于 XST 攻擊）
    if ($request_method ~ ^(TRACE|TRACK)$) {
        return 405;
    }
}

server {
    listen 80;
    server_name example.com;
    # 301 永久重定向到 HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    
    # 只啟用安全的 TLS 版本
    ssl_protocols TLSv1.2 TLSv1.3;
    
    # 強(qiáng)加密套件，優(yōu)先使用 ECDHE 實(shí)現(xiàn)前向保密
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
    
    ssl_prefer_server_ciphers on;
    
    # 會(huì)話復(fù)用，減少 TLS 握手開銷
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    
    # OCSP Stapling，加速證書驗(yàn)證
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 1.1.1.1 8.8.8.8 valid=300s;
}

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# 防止點(diǎn)擊劫持
add_header X-Frame-Options "SAMEORIGIN" always;

# 防止 MIME 類型嗅探（如把 .jpg 當(dāng)腳本執(zhí)行）
add_header X-Content-Type-Options "nosniff" always;

# 啟用 XSS 過濾器（現(xiàn)代瀏覽器已廢棄，但仍建議保留兼容）
add_header X-XSS-Protection "1; mode=block" always;

# 控制 Referer 信息泄露
add_header Referrer-Policy "no-referrer-when-downgrade" always;

# 內(nèi)容安全策略（CSP），限制資源加載來源
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'self';" always;

# 限制瀏覽器功能權(quán)限
add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()" always;

# 更靈活的方案：允許指定域名嵌入
add_header Content-Security-Policy "frame-ancestors 'self' https://partner.example.com;" always;

location ~* \.(gif|jpg|jpeg|png|bmp|swf|flv|mp4|ico)$ {
    # 允許空 Referer 和本域名
    valid_referers none blocked server_names *.example.com;
    
    if ($invalid_referer) {
        # 返回 403 或重定向到警告圖
        return 403;
        # 或：rewrite ^/ https://example.com/forbidden.png break;
    }
}

# 黑名單：拒絕特定 IP
location /admin {
    deny 192.168.1.100;
    deny 10.0.0.0/24;
    allow all;
}

# 白名單：只允許特定 IP 訪問
location /api/internal {
    allow 192.168.1.0/24;
    allow 10.0.0.5;
    deny all;
}

location ~ /\. {
    # 拒絕訪問隱藏文件（.git, .env, .htaccess 等）
    deny all;
    access_log off;
    log_not_found off;
}

location ~* \.(git|svn|htaccess|env)$ {
    deny all;
}

http {
    # 定義限流區(qū)域：按 IP 限制，10MB 內(nèi)存存儲(chǔ)狀態(tài)，每秒 10 個(gè)請求
    limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
    
    # 針對登錄接口更嚴(yán)格
    limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
    
    # 按 IP 限制并發(fā)連接數(shù)
    limit_conn_zone $binary_remote_addr zone=addr:10m;
}

server {
    location / {
        # 突發(fā) 20 個(gè)請求，不延遲處理（超出直接 503）
        limit_req zone=general burst=20 nodelay;
        
        # 限制單個(gè) IP 最多 10 個(gè)并發(fā)連接
        limit_conn addr 10;
    }
    
    location /api/login {
        # 登錄接口更嚴(yán)格：每秒 1 次
        limit_req zone=login burst=5 nodelay;
    }
}

http {
    # 讀取客戶端請求頭的超時(shí)時(shí)間
    client_header_timeout 10s;
    
    # 讀取客戶端請求體的超時(shí)時(shí)間
    client_body_timeout 10s;
    
    # 發(fā)送響應(yīng)的超時(shí)時(shí)間
    send_timeout 10s;
}

http {
    # Gzip 壓縮
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_min_length 256;
    gzip_types
        text/plain
        text/css
        text/javascript
        application/javascript
        application/json
        application/xml
        image/svg+xml;
    
    # Brotli 壓縮（需要編譯 ngx_brotli 模塊，壓縮率比 gzip 高 15-25%）
    # brotli on;
    # brotli_comp_level 5;
    # brotli_types text/plain text/css application/javascript application/json;
}

location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|otf)$ {
    # 強(qiáng)緩存：30 天
    expires 30d;
    add_header Cache-Control "public, immutable";
    
    # 禁用日志減少 I/O
    access_log off;
}

location ~* \.(html|htm)$ {
    # HTML 不緩存或短時(shí)間緩存
    expires -1;
    add_header Cache-Control "no-store, no-cache, must-revalidate";
}

http {
    # 內(nèi)核態(tài)直接傳輸文件，零拷貝
    sendfile on;
    
    # 累積到一定大小再發(fā)送（配合 sendfile）
    tcp_nopush on;
    
    # 立即發(fā)送小數(shù)據(jù)包（降低延遲）
    tcp_nodelay on;
}

http {
    # 長連接保持時(shí)間
    keepalive_timeout 30s;
    
    # 單個(gè)長連接最大請求數(shù)
    keepalive_requests 1000;
    
    # 與后端服務(wù)保持長連接（反向代理場景）
    upstream backend {
        server 127.0.0.1:8080;
        keepalive 32;  # 保持 32 個(gè)空閑連接
    }
}

upstream backend {
    server 127.0.0.1:3000 weight=5;
    server 127.0.0.1:3001 weight=5;
    server 127.0.0.1:3002 backup;  # 備用節(jié)點(diǎn)
    keepalive 32;
}

server {
    listen 80;
    server_name api.example.com;
    
    location / {
        proxy_pass http://backend;
        
        # 傳遞真實(shí)客戶端 IP
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # 代理相關(guān)優(yōu)化
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        
        # 超時(shí)配置
        proxy_connect_timeout 5s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;
        
        # 緩沖區(qū)
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 4k;
    }
}

http {
    # 自定義日志格式（含性能指標(biāo)）
    log_format performance '$remote_addr - $remote_user [$time_local] '
                           '"$request" $status $body_bytes_sent '
                           'rt=$request_time '
                           'uct="$upstream_connect_time" '
                           'uht="$upstream_header_time" '
                           'urt="$upstream_response_time"';
    
    # JSON 格式（便于 ELK / Grafana 解析）
    log_format json_combined escape=json '{'
        '"time":"$time_iso8601",'
        '"remote_addr":"$remote_addr",'
        '"request":"$request",'
        '"status":$status,'
        '"request_time":$request_time,'
        '"upstream_response_time":"$upstream_response_time",'
        '"body_bytes_sent":$body_bytes_sent,'
        '"http_referer":"$http_referer",'
        '"http_user_agent":"$http_user_agent"'
    '}';
    
    # 主日志
    access_log /var/log/nginx/access.log performance buffer=32k flush=5s;
    
    # API 專用 JSON 日志
    access_log /var/log/nginx/api.log json_combined;
}

# /etc/nginx/nginx.conf

user www-data;
worker_processes auto;
worker_rlimit_nofile 65535;
pid /run/nginx.pid;

events {
    worker_connections 4096;
    use epoll;
    multi_accept on;
}

http {
    # 基礎(chǔ)設(shè)置
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 30;
    keepalive_requests 1000;
    types_hash_max_size 2048;
    server_tokens off;
    
    # 緩沖區(qū)
    client_body_buffer_size 128k;
    client_max_body_size 10m;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 4k;
    
    # 超時(shí)
    client_header_timeout 10s;
    client_body_timeout 10s;
    send_timeout 10s;
    
    # 壓縮
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_min_length 256;
    gzip_types text/plain text/css text/javascript application/javascript application/json application/xml image/svg+xml;
    
    # MIME 類型
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    # 日志
    log_format performance '$remote_addr - $remote_user [$time_local] '
                           '"$request" $status $body_bytes_sent '
                           'rt=$request_time uct="$upstream_connect_time" '
                           'uht="$upstream_header_time" urt="$upstream_response_time"';
    access_log /var/log/nginx/access.log performance buffer=32k flush=5s;
    error_log /var/log/nginx/error.log warn;
    
    # 限流
    limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
    limit_conn_zone $binary_remote_addr zone=addr:10m;
    
    # 安全響應(yīng)頭
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
    
    # 引入站點(diǎn)配置
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}