ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;
ssl_prefer_server_ciphers on;

client_body_timeout 10s;
client_header_timeout 10s;
keepalive_timeout 5s;

location ~* \.(conf|log|bak)$ { deny all; }

add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "SAMEORIGIN";
add_header Content-Security-Policy "default-src 'self'";

worker_processes auto;  # 自動(dòng)匹配CPU核心數(shù) ?:ml-citation{ref="1,3" data="citationList"}  
worker_cpu_affinity auto;  # CPU親和性優(yōu)化（需Nginx 1.9+）?:ml-citation{ref="1,3" data="citationList"}  
worker_rlimit_nofile 65535;  # 進(jìn)程最大文件句柄數(shù) ?:ml-citation{ref="3,4" data="citationList"}  
events {  
    use epoll;  # 高性能I/O模型（Linux環(huán)境）?:ml-citation{ref="1,3" data="citationList"}  
    worker_connections 65535;  # 單進(jìn)程最大并發(fā)連接數(shù) ?:ml-citation{ref="1,3" data="citationList"}  
    multi_accept on;  # 允許同時(shí)接受新連接 ?:ml-citation{ref="3,4" data="citationList"}  
}

http {  
    client_max_body_size 20m;  # 文件上傳大小限制 ?:ml-citation{ref="4" data="citationList"}  
    client_header_buffer_size 4k;  # 請(qǐng)求頭緩沖區(qū) ?:ml-citation{ref="1,3" data="citationList"}  
    keepalive_timeout 65s;  # 長(zhǎng)連接超時(shí) ?:ml-citation{ref="2,4" data="citationList"}  
    sendfile on;  # 啟用高效傳輸模式 ?:ml-citation{ref="3,4" data="citationList"}  
    tcp_nopush on;  # 減少網(wǎng)絡(luò)報(bào)文數(shù)量 ?:ml-citation{ref="3,4" data="citationList"}  
}

server_tokens off;  # 隱藏Nginx版本號(hào) ?:ml-citation{ref="1,2" data="citationList"}  
add_header Server "Custom";  # 自定義Server頭（需headers-more模塊）?:ml-citation{ref="4,8" data="citationList"}  

location /nginx_status {  
    allow 192.168.1.0/24;  # 限制狀態(tài)接口IP訪問(wèn) ?:ml-citation{ref="5,6" data="citationList"}  
    deny all;  
}

ssl_protocols TLSv1.2 TLSv1.3;  # 禁用舊協(xié)議 ?:ml-citation{ref="1,3" data="citationList"}  
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;  
ssl_prefer_server_ciphers on;  # 優(yōu)先服務(wù)端加密套件 ?:ml-citation{ref="1,3" data="citationList"}  
ssl_session_cache shared:SSL:10m;  # 會(huì)話緩存復(fù)用 ?:ml-citation{ref="3,4" data="citationList"}

gzip on;  # 啟用GZIP壓縮 ?:ml-citation{ref="2,4" data="citationList"}  
gzip_min_length 1k;  # 最小壓縮文件大小 ?:ml-citation{ref="2,4" data="citationList"}  
open_file_cache max=1000 inactive=20s;  # 文件元數(shù)據(jù)緩存 ?:ml-citation{ref="3,4" data="citationList"}  

proxy_cache_path /data/cache levels=1:2 keys_zone=mycache:10m;  # 反向代理緩存 ?:ml-citation{ref="4" data="citationList"}

upstream backend {  
    server 10.0.0.1:80 weight=5;  # 權(quán)重分配 ?:ml-citation{ref="3,4" data="citationList"}  
    server 10.0.0.2:80 backup;  # 備用節(jié)點(diǎn) ?:ml-citation{ref="3,4" data="citationList"}  
    keepalive 32;  # 長(zhǎng)連接復(fù)用 ?:ml-citation{ref="4" data="citationList"}  
    check interval=3000 rise=2 fall=3 timeout=1000;  # 健康檢查（需nginx_upstream_check模塊）?:ml-citation{ref="6" data="citationList"}  
}

log_format main '$remote_addr - $request_time - "$request" $status';  # 自定義日志格式 ?:ml-citation{ref="2,3" data="citationList"}  
access_log /var/log/nginx/access.log main buffer=32k flush=5m;  # 緩沖寫(xiě)入日志 ?:ml-citation{ref="4" data="citationList"}  
error_log /var/log/nginx/error.log warn;  # 錯(cuò)誤日志級(jí)別控制 ?:ml-citation{ref="3,4" data="citationList"}

worker_processes auto;
 
events {
    worker_connections 1024;
}
 
http {
    include       mime.types;
    default_type  application/octet-stream;
 
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
 
    access_log  /var/log/nginx/access.log  main;
    error_log   /var/log/nginx/error.log warn;
 
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;
    types_hash_max_size 2048;
 
    server {
        listen       80;
        server_name  localhost;
 
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }
 
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
    }
}

worker_processes auto; # 基于CPU核心數(shù)自動(dòng)設(shè)置工作進(jìn)程數(shù)，通常設(shè)置為CPU核心數(shù)或2倍CPU核心數(shù)。
pid        /var/run/nginx.pid; # 設(shè)置nginx進(jìn)程ID文件路徑。
worker_rlimit_nofile 16384; # 設(shè)置單個(gè)工作進(jìn)程可以打開(kāi)的最大文件描述符數(shù)量。
events {
    worker_connections 16384; # 根據(jù)實(shí)際負(fù)載調(diào)整并發(fā)連接數(shù)。
    multi_accept on; # 允許每個(gè)工作進(jìn)程同時(shí)接受多個(gè)新連接。
}
http {
    ... # 其他配置保持不變。
    gzip on; # 啟用Gzip壓縮。
    gzip_types text/plain application/xml text/css application/javascript application/json application/x-javascript text/xml application/xml+rss text/javascript; # 設(shè)置需要壓縮的MIME類型。
    ... # 其他配置保持不變。
    server {
        listen       80 default_server; # 監(jiān)聽(tīng)80端口，并設(shè)置為默認(rèn)服務(wù)器。
        listen       443 ssl default_server; # 監(jiān)聽(tīng)443端口，并啟用SSL加密，設(shè)置為默認(rèn)服務(wù)器。
        server_name  localhost; # 根據(jù)實(shí)際域名設(shè)置。
        ssl_certificate       /etc/ssl/certs/nginx-selfsigned.crt; # SSL證書(shū)路徑。
        ssl_certificate_key   /etc/ssl/private/nginx-selfsigned.key; # SSL私鑰路徑。
        ssl_session_cache    shared:SSL:1m; # 設(shè)置SSL會(huì)話緩存。
        ssl_session_timeout  5m; # 設(shè)置SSL會(huì)話超時(shí)時(shí)間。
        ... # 其他配置保持不變。
        location / { ... } # 其他location配置保持不變。
        ... # 其他配置保持不變。
    }