1
# 全局设定
2
......
3
# events 块
4
events {
5

6
}
7
# http 块
8
http {
9
    # http全局设定
10
    ......
11
    # server块
12
    server {
13
        # server 配置
14
        ......
15
        # location块，
16
        location [PATTERN] {
17

18
        }
19
    }
20
}

1
worker_processes  auto;
2
error_log  logs/error.log  warn;
3
pid        logs/nginx.pid;

1
events{
2
    worker_connections  2048;
3
    multi_accept        on;
4
    use                 epoll;
5
}

1
http {
2
    include       mime.types;
3
    default_type  application/octet-stream;
4

5
    sendfile        on;
6
    sendfile_max_chunk  100k;
7
    send_timeout    75;
8
    tcp_nopush      on;
9
    tcp_nodelay     on;
10
    keepalive_timeout  65;
11
    client_max_body_size 100M;
12

13
    # 日志格式
14
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
15
                      '$status $body_bytes_sent "$http_referer" '
16
                      '"$http_user_agent" "$http_x_forwarded_for"';
17

18
    access_log  logs/access.log  main;
19

20

21
    # 防CC攻击
22
    limit_req_zone $binary_remote_addr zone=cc:10m rate=10r/s;
23

24
    # 防止中文出现乱码
25
    charset utf-8;
26

27
    server{}
28
    server{}
29
}

1
server {
2
        listen 80;
3
        server_name your_server_name;
4

5
        root E:/yourWebsite;
6
        index index.html;
7

8
        error_page 404 /404.html
9
        error_page 500 502 503 /50x.html
10

11

12
        # 防护措施
13

14
        # 超出部分429 Too Many Requests
15
        limit_req zone=cc burst=20 nodelay;
16

17
        # 禁止恶意请求方法，禁止恶意访问
18
        location ~ /(\.|git|svn|log|tmp|backup|config|database|ini|bat|cmd|sh|bak)$ {
19
            deny all;
20
            return 403;
21
        }
22

23
        # 图片类使用30天内缓存，不写入日志
24
        location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|eot)$ {
25
            expires 30d;
26
            add_header Cache-Control "public, max-age=2592000";
27
            access_log off;
28
        }
29
    }

1
server {
2
        listen 443 ssl;
3
        server_name your_server_name;
4

5
        # 证书路径
6
        ssl_certificate      C:/certifications/LetsEncrypt-Certs/full-chain.pem;
7
        ssl_certificate_key  C:/certifications/LetsEncrypt-Certs/private_key.pem;
8

9
        # ssl安全配置
10
        ssl_protocols TLSv1.2 TLSv1.3;
11
        ssl_session_timeout 10m;
12
        ssl_session_cache shared:SSL:10m;
13
        ssl_session_tickets off;
14
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
15

16
        # 反向代理
17

18
        # 放开文件上传大小限制（Seafile大文件上传必备）
19
        client_max_body_size 10G;
20
        # 禁用缓存（避免Seafile动态内容缓存异常）
21
        proxy_buffering off;
22

23
        location / {
24
            proxy_pass         http://127.0.0.1:8000;   # 反向代理至本地8000端口
25
            proxy_set_header   Host $host;
26
            proxy_set_header   X-Real-IP $remote_addr;
27
            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
28
            proxy_set_header   X-Forwarded-Proto $scheme;
29

30
            proxy_connect_timeout 3600;
31
            proxy_read_timeout 3600;
32
            proxy_send_timeout 3600;
33
            proxy_http_version 1.1;
34
        }
35

36

37
        # 防护措施
38
        limit_req zone=cc burst=20 nodelay;
39

40
        # # 禁止恶意请求
41
        location ~ /(\.|git|svn|log|tmp|backup|config|database|ini|bat|cmd|sh|bak)$ {
42
            deny all;
43
            return 403;
44
        }
45
        if ($request_method !~ ^(GET|POST|HEAD)$) {
46
            return 405;
47
        }
48
    }

1
        location ~ /(\.|git|svn|log|tmp|backup|config|database|ini|bat|cmd|sh|bak)$ {
2
            deny all;
3
            return 403;
4
        }
5
        location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|eot)$ {
6
            # 缓存静态资源30天
7
            expires 30d;
8
            add_header Cache-Control "public, max-age=2592000";
9
            # 关闭日志
10
            access_log off;
11
        }