# 运行用户
user www www;

# 工作进程数，通常设置为CPU核心数
worker_processes auto;

# 错误日志配置，使用crit级别减少不必要的日志
error_log /www/wwwlogs/nginx_error.log crit;
pid /www/server/nginx/logs/nginx.pid;

# 最大打开文件数
worker_rlimit_nofile 65535;  # 增加到65535以支持更多并发连接

# TCP流配置
stream {
    # 日志格式定义
    log_format tcp_format '$time_local|$remote_addr|$protocol|$status|$bytes_sent|$bytes_received|$session_time|$upstream_addr|$upstream_bytes_sent|$upstream_bytes_received|$upstream_connect_time';
    
    # 访问日志配置
    access_log /www/wwwlogs/tcp-access.log tcp_format buffer=32k; # 添加缓冲
    error_log /www/wwwlogs/tcp-error.log;
    include /www/server/panel/vhost/nginx/tcp/*.conf;
}

# 事件模块配置
events {
    use epoll;  # 使用epoll事件驱动，性能更好
    worker_connections 65535;  # 增加每个worker进程的最大连接数
    multi_accept on;  # 允许一次接受多个连接
    accept_mutex on;  # 添加accept锁，避免惊群效应
}

# HTTP模块配置
http {
    include mime.types;
    include proxy.conf;
    
    # 基础配置
    default_type application/octet-stream;
    server_names_hash_bucket_size 512;
    client_header_buffer_size 32k;
    large_client_header_buffers 4 32k;
    client_max_body_size 50m;
    
    # 优化文件传输
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    
    # 超时设置
    keepalive_timeout 65;  # 适当增加保持连接超时
    keepalive_requests 100;  # 添加单个连接最大请求数
    send_timeout 10;  # 添加发送超时

    # FastCGI配置优化
    fastcgi_connect_timeout 300;
    fastcgi_send_timeout 300;
    fastcgi_read_timeout 300;
    fastcgi_buffer_size 64k;
    fastcgi_buffers 4 64k;
    fastcgi_busy_buffers_size 128k;
    fastcgi_temp_file_write_size 256k;
    fastcgi_intercept_errors on;
    fastcgi_cache_use_stale error timeout invalid_header http_500;  # 添加缓存策略

    # Gzip压缩配置优化
    gzip on;
    gzip_min_length 1k;
    gzip_buffers 4 16k;
    gzip_http_version 1.1;
    gzip_comp_level 4;  # 调整为4，在压缩率和CPU消耗之间取得平衡
    gzip_types text/plain application/javascript application/x-javascript text/javascript text/css application/xml application/json 
               image/jpeg image/gif image/png font/ttf font/otf image/svg+xml application/xml+rss text/x-js
               application/x-httpd-php application/x-yaml;  # 增加更多MIME类型
    gzip_vary on;
    gzip_proxied any;  # 修改为any以支持所有代理请求
    gzip_disable "MSIE [1-6]\.";

    # Brotli压缩配置优化
    brotli on;
    brotli_comp_level 8;    # 调整为4，在压缩率和CPU消耗之间取得平衡
    brotli_buffers 16 8k;
    brotli_min_length 20;
    brotli_types text/plain application/javascript application/x-javascript text/javascript text/css application/xml 
                 application/json image/svg application/font-woff application/vnd.ms-fontobject application/vnd.apple.mpegurl 
                 image/x-icon image/jpeg image/gif image/png image/bmp application/vnd.api+json;
    brotli_static always;
    brotli_window 512k;

    # 连接限制
    limit_conn_zone $binary_remote_addr zone=perip:10m;
    limit_conn_zone $server_name zone=perserver:10m;
    limit_conn perip 20;  # 添加每个IP的连接数限制
    limit_conn perserver 1000;  # 添加每个服务器的连接数限制
    limit_rate 2048k;  # 添加连接速率限制

    # 安全配置
    server_tokens off;  # 隐藏版本号
    add_header X-Frame-Options SAMEORIGIN;  # 防止点击劫持
    add_header X-Content-Type-Options nosniff;  # 防止MIME类型嗅探
    add_header X-XSS-Protection "1; mode=block";  # XSS防护
    add_header Strict-Transport-Security "max-age=31536000";  # HSTS配置

    # 访问日志配置
    access_log off;  # 关闭主访问日志
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    # phpMyAdmin服务器配置
    server {
        listen 888;
        server_name phpmyadmin;
        index index.html index.htm index.php;
        root /www/server/phpmyadmin;

        # 启用PHP支持
        include enable-php.conf;

        # 静态文件缓存
        location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ {
            expires 30d;
            access_log off;  # 关闭静态文件访问日志
            add_header Cache-Control "public";  # 添加缓存控制
        }

        # location ~ .*\.(js|css)$ {
        #     expires 12h;
        #     access_log off;
        #     add_header Cache-Control "public";
        # }

        # 安全配置
        location ~ /\. {
            deny all;
            access_log off;
            log_not_found off;
        }

        # 添加基本的安全头
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";

        # 访问日志
        access_log /www/wwwlogs/access.log main buffer=32k;  # 添加日志缓冲
    }

    # 包含其他配置文件
    include /www/server/panel/vhost/nginx/*.conf;
}