user www-data www-data;
worker_processes auto;
worker_cpu_affinity auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 2048;
    multi_accept on;          # 启用多接受，提升并发处理能力
    use epoll;                # 明确使用 epoll（Linux 推荐）
}

http {
    ##
    # 基础设置
    ##
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;           # 禁用 Nagle 算法，减少延迟
    types_hash_max_size 2048;
    server_tokens off;        # ★ 隐藏版本号，提升安全性

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # 超时与缓冲区设置（性能与安全）
    ##
    keepalive_timeout 65;
    keepalive_requests 100;           # 单个连接最大请求数
    client_body_timeout 60;           # 客户端请求体超时
    client_header_timeout 60;         # 客户端请求头超时
    send_timeout 60;                  # 发送响应超时
    client_max_body_size 100M;        # ★ 允许大文件上传（根据业务调整）
    client_body_buffer_size 16k;
    client_header_buffer_size 4k;
    large_client_header_buffers 4 32k;
    reset_timedout_connection on;     # ★ 超时后主动释放连接

    ##
    # 日志格式（保留原有的 main，包含性能指标）
    ##
    log_format main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" '
                      '$request_time $upstream_response_time '
                      '$upstream_addr $upstream_status '
                      '$ssl_protocol $ssl_cipher '
                      '$host $server_port '
                      '$request_length $bytes_sent';

    access_log /var/log/nginx/access.log main;

    ##
    # SSL 全局优化（部分参数也可在 server 块单独设置）
    ##
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
    ssl_session_cache shared:SSL:10m;     # ★ 启用会话缓存
    ssl_session_timeout 1d;               # ★ 缓存时长 1 天（可调）
    ssl_session_tickets off;              # 禁用 ticket 可提升安全性（若有性能需求可开启）
    # ssl_dhparam /etc/nginx/ssl/dhparam.pem;  # 建议生成并启用（2048 位）

    ##
    # Gzip 压缩优化（★ 已按您的需求扩展为完整单行）
    ##
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_min_length 1024;                 # ★ 小于 1KB 不压缩
    gzip_disable "msie6";                 # ★ 禁用 IE6 兼容问题
    gzip_types text/plain text/css text/xml application/json application/javascript application/xml application/xml+rss text/javascript image/svg+xml application/ld+json application/manifest+json application/rss+xml application/atom+xml application/geo+json application/vnd.ms-fontobject font/ttf font/otf font/x-woff application/font-woff application/font-woff2;

    ##
    # 文件缓存（提升静态文件处理性能）
    ##
    open_file_cache max=2000 inactive=20s;
    open_file_cache_valid 60s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;

    ##
    # 反向代理全局默认值（若 server/location 未覆盖则生效）
    ##
    proxy_connect_timeout 60s;
    proxy_send_timeout 60s;
    proxy_read_timeout 60s;
    proxy_buffering off;          # 可改为 on 并调优 buffers，视后端需求而定
    proxy_buffer_size 4k;
    proxy_buffers 8 4k;
    proxy_busy_buffers_size 8k;

    ##
    # 虚拟主机配置（保留原有 include，兼容您的站点配置）
    ##
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*.conf;
}