first init

2026-06-08 11:37:14 +08:00
commit 94ecbe5887
1058 changed files with 87732 additions and 0 deletions
@@ -0,0 +1,108 @@
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    sendfile        on;
+    keepalive_timeout  65;
+
+    # Logging
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log;
+
+    # HTTP server (default - works for training/dev)
+    # For production with HTTPS, mount a custom nginx.conf that includes SSL config
+    server {
+        listen 80;
+        server_name _;
+        root /var/www/public;
+        index index.php index.html;
+
+        # Security headers
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-referrer-when-downgrade" always;
+
+        # API routes - pass directly to Laravel with original REQUEST_URI
+        # (try_files would redirect to /index.php and lose the path, causing 502/bad routing)
+        location /api/ {
+            fastcgi_pass 127.0.0.1:9000;
+            fastcgi_index index.php;
+            fastcgi_param SCRIPT_FILENAME $document_root/index.php;
+            include fastcgi_params;
+            fastcgi_param HTTP_PROXY "";
+            fastcgi_param HTTPS $https if_not_empty;
+            fastcgi_read_timeout 300;
+            fastcgi_send_timeout 300;
+        }
+
+        # Training SPA (built with base=/training/)
+        # Serve training frontend routes from /var/www/public/training
+        location ^~ /training/ {
+            try_files $uri $uri/ /training/index.html;
+        }
+
+        # Serve frontend assets
+        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+            add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+            try_files $uri =404;
+        }
+
+        # Handle all other routes - serve Vue app or Laravel
+        location / {
+            add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+            try_files $uri $uri/ /index.html /index.php?$query_string;
+        }
+
+        # Handle PHP files - connect to localhost PHP-FPM
+        location ~ \.php$ {
+            fastcgi_pass 127.0.0.1:9000;
+            fastcgi_index index.php;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            include fastcgi_params;
+            
+            # Additional FastCGI parameters
+            fastcgi_param HTTP_PROXY "";
+            fastcgi_param HTTPS $https if_not_empty;
+            fastcgi_read_timeout 300;
+            fastcgi_send_timeout 300;
+        }
+
+        # Deny access to hidden files
+        location ~ /\. {
+            deny all;
+        }
+
+        # Cache static assets
+        location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+            add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+            try_files $uri =404;
+        }
+
+        location ^~ /horizon {
+            add_header Content-Security-Policy "default-src 'self' http: https: data: blob 'unsafe-inline' 'unsafe-eval'" always;
+            fastcgi_pass 127.0.0.1:9000;
+            fastcgi_index index.php;
+            fastcgi_param SCRIPT_FILENAME $document_root/index.php;
+            include fastcgi_params;
+            fastcgi_param HTTP_PROXY "";
+            fastcgi_param HTTPS $https if_not_empty;
+            fastcgi_read_timeout 300;
+            fastcgi_send_timeout 300;
+        }
+    }
+
+    # HTTPS server block removed from default config
+    # To enable HTTPS in production:
+    # 1. Mount SSL certificates to /etc/nginx/ssl/
+    # 2. Mount a custom nginx.conf that includes HTTPS server block
+    # Example: - ./production-nginx.conf:/etc/nginx/nginx.conf:ro
+}