PropertyDeployment/domain-name/nginx.conf

# ----------------------------
# 全局设置
# ----------------------------
user nginx;
worker_processes auto;
worker_rlimit_nofile 51200;

error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    sendfile on;
    keepalive_timeout 180;
    proxy_send_timeout 180;
    proxy_read_timeout 180;
    client_max_body_size 1024m;
    gzip on;

    # ----------------------------
    # 全局安全/性能优化
    # ----------------------------
    server_tokens off;
    client_body_buffer_size 16K;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 16k;

    # ===============================================================
    # HTTP(80) 配置 — Certbot 验证路径 + HTTPS 强制跳转
    # ===============================================================

    # www.gccmpm.com
    server {
        listen 80;
        server_name www.gccmpm.com;

        # Certbot 验证路径
        location /.well-known/acme-challenge/ {
            alias /var/www/certbot/.well-known/acme-challenge/;
        }

        # 其他请求跳转 HTTPS
        location / {
            return 301 https://$server_name$request_uri;
        }
    }

    # tg.gccmpm.com
    server {
        listen 80;
        server_name tg.gccmpm.com;

        location /.well-known/acme-challenge/ {
            alias /var/www/certbot/.well-known/acme-challenge/;
        }

        location / {
            return 301 https://$server_name$request_uri;
        }
    }

    # iot.gccmpm.com
    server {
        listen 80;
        server_name iot.gccmpm.com;

        location /.well-known/acme-challenge/ {
            alias /var/www/certbot/.well-known/acme-challenge/;
        }

        location / {
            return 301 https://$server_name$request_uri;
        }
    }

    # ===============================================================
    # HTTPS(443) 配置段
    # ===============================================================

    # ----------------------------
    # www.gccmpm.com → 127.0.0.1:8111
    # ----------------------------
    server {
        listen 443 ssl;
        server_name www.gccmpm.com;

        ssl_certificate     /etc/letsencrypt/live/www.gccmpm.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/www.gccmpm.com/privkey.pem;

        ssl_session_timeout 10m;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        access_log /var/log/nginx/www.gccmpm.com.access.log main;
        error_log  /var/log/nginx/www.gccmpm.com.error.log;

        location / {
            proxy_pass http://127.0.0.1:8111;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html { root /usr/share/nginx/html; }
    }

    # ----------------------------
    # tg.gccmpm.com → 127.0.0.1:8113
    # ----------------------------
    server {
        listen 443 ssl;
        server_name tg.gccmpm.com;

        ssl_certificate     /etc/letsencrypt/live/www.gccmpm.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/www.gccmpm.com/privkey.pem;

        ssl_session_timeout 10m;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        access_log /var/log/nginx/tg.gccmpm.com.access.log main;
        error_log  /var/log/nginx/tg.gccmpm.com.error.log;

        location / {
            proxy_pass http://127.0.0.1:8113;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html { root /usr/share/nginx/html; }
    }

    # ----------------------------
    # iot.gccmpm.com → 127.0.0.1:8112
    # ----------------------------
    server {
        listen 443 ssl;
        server_name iot.gccmpm.com;

        ssl_certificate     /etc/letsencrypt/live/www.gccmpm.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/www.gccmpm.com/privkey.pem;

        ssl_session_timeout 10m;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        access_log /var/log/nginx/iot.gccmpm.com.access.log main;
        error_log  /var/log/nginx/iot.gccmpm.com.error.log;

        location / {
            proxy_pass http://127.0.0.1:8112;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html { root /usr/share/nginx/html; }
    }
}