# ----------------------------
# 全局设置
# ----------------------------
user nginx;
worker_processes auto;
worker_rlimit_nofile 51200;

error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    sendfile on;
    keepalive_timeout 180;
    proxy_send_timeout 180;
    proxy_read_timeout 180;
    client_max_body_size 1024m;
    gzip on;

    # ----------------------------
    # 全局安全/性能优化
    # ----------------------------
    server_tokens off;
    client_body_buffer_size 16K;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 16k;

    # ===============================================================
    # HTTP(80) 配置 — Certbot 验证路径 + HTTPS 强制跳转
    # ===============================================================

    # www.gccmpm.com
    server {
        listen 80;
        server_name www.gccmpm.com;

        # Certbot 验证路径
        location /.well-known/acme-challenge/ {
            alias /var/www/certbot/.well-known/acme-challenge/;
        }

        # 其他请求跳转 HTTPS
        location / {
            return 301 https://$server_name$request_uri;
        }
    }

    # tg.gccmpm.com
    server {
        listen 80;
        server_name tg.gccmpm.com;

        location /.well-known/acme-challenge/ {
            alias /var/www/certbot/.well-known/acme-challenge/;
        }

        location / {
            return 301 https://$server_name$request_uri;
        }
    }

    # iot.gccmpm.com
    server {
        listen 80;
        server_name iot.gccmpm.com;

        location /.well-known/acme-challenge/ {
            alias /var/www/certbot/.well-known/acme-challenge/;
        }

        location / {
            return 301 https://$server_name$request_uri;
        }
    }


    # staff.gccmpm.com
    server {
        listen 80;
        server_name staff.gccmpm.com;

        location /.well-known/acme-challenge/ {
            alias /var/www/certbot/.well-known/acme-challenge/;
        }

        location / {
            return 301 https://$server_name$request_uri;
        }
    }
}