# HTTP服务器（重定向到HTTPS）
server {
    listen 80;
    server_name example.com www.example.com;
    
    # 永久重定向到HTTPS
    return 301 https://$server_name$request_uri;
}

# HTTPS服务器
server {
    # 启用HTTPS和HTTP/2
    listen 443 ssl http2;
    server_name example.com www.example.com;
    
    # SSL证书配置
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    # TLS协议版本（仅支持安全版本）
    ssl_protocols TLSv1.2 TLSv1.3;
    
    # 密码套件（优先使用AEAD算法）
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
    
    # 优先使用服务器端密码套件顺序
    ssl_prefer_server_ciphers off;
    
    # 根目录和索引文件
    root /var/www/example;
    index index.html index.htm;
    
    # 反向代理示例（如果需要）
    location /api/ {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 强制HTTPS访问，有效期1年
add_header Strict-Transport-Security "max-age=31536000" always;

# 包含所有子域名
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# 提交到浏览器预加载列表（需在hstspreload.org注册）
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# 防止点击劫持
add_header X-Frame-Options DENY always;

# 防止MIME类型嗅探
add_header X-Content-Type-Options nosniff always;

# 控制Referrer信息
add_header Referrer-Policy strict-origin-when-cross-origin always;

# 内容安全策略（根据实际需求调整）
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'" always;

# 启用跨域资源共享（根据需求配置）
add_header Access-Control-Allow-Origin "*" always;

# 启用OCSP装订
ssl_stapling on;
ssl_stapling_verify on;

# 指定可信CA证书（用于验证OCSP响应）
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

# DNS解析器配置
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

# 共享会话缓存（所有worker进程共享）
ssl_session_cache shared:SSL:10m;

# 会话超时时间
ssl_session_timeout 10m;

# 启用会话票证（无状态会话恢复）
ssl_session_tickets on;

# 会话票证密钥（定期轮换）
ssl_session_ticket_key /etc/nginx/session_ticket.key;

# 减小SSL缓冲区大小（默认16k，可减小到4k）
ssl_buffer_size 4k;

# 启用HTTP/2
listen 443 ssl http2;

# HTTP/2连接参数
http2_max_field_size 64k;
http2_max_header_size 128k;
http2_max_concurrent_streams 128;

server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;
    
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets on;
    
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    
    location / {
        root /var/www/example;
        index index.html;
    }
}