Nginx 完整配置示例（适配 Lemmy + 放行 eruda CDN + 修复 CSP 行内样式拦截）server { listen 80; server name lemmy.yourdomain.com; HTTP 强制跳转 HTTPS return 301 https://$host$request uri; } server { listen 443 ssl http2; server name lemmy.yourdomain.com; SSL 证书路径（替换为你的证书） ssl certificate /etc/nginx/ssl/lemmy.yourdomain.com/fullchain.pem; ssl certificate key /etc/nginx/ssl/lemmy.yourdomain.com/privkey.pem; SSL 优化配置 ssl protocols TLSv1.2 TLSv1.3; ssl prefer server ciphers on; ssl ciphers ECDHE ECDSA AES128 GCM SHA256:ECDHE RSA AES128 GCM SHA256:ECDHE ECDSA AES256 GCM SHA384:ECDHE RSA AES256 GCM SHA384:ECDHE ECDSA CHACHA20 POLY1305:ECDHE RSA CHACHA20 POLY1305:DHE RSA AES128 GCM SHA256:DHE RSA AES256 GCM SHA384; ssl session cache shared:SSL:10m; ssl session timeout 10m; 通用缓存静态资源 location \.(jpg|jpeg|png|gif|ico|css|js|woff2|woff|ttf)$ { expires 30d; add header Cache Control "public, no transform"; proxy pass http://lemmy ui:1234; } 图床路由 location /pictrs/ { proxy pass http://pictrs:8080; proxy set header Host $host; proxy set header X Real IP $remote addr; proxy set header X Forwarded For $proxy add x forwarded for; proxy set header X Forwarded Proto $scheme; } API 后端路由 location /api/ { proxy pass http://lemmy:8536; proxy set header Host $host; proxy set header X Real IP $remote addr; proxy set header X Forwarded For $proxy add x forwarded for; proxy set header X Forwarded Proto $scheme; } WebSocket 通知 location /api/ws { proxy pass http://lemmy:8536; proxy http version 1.1; proxy set header Upgrade $http upgrade; proxy set header Connection "upgrade"; proxy set header Host $host; proxy set header X Real IP $remote addr; proxy set header X Forwarded For $proxy add x forwarded for; proxy set header X Forwarded Proto $scheme; } 前端页面主路由 location / { proxy pass http://lemmy ui:1234; proxy set header Host $host; proxy set header X Real IP $remote addr; proxy set header X Forwarded For $proxy add x forwarded for; proxy set header X Forwarded Proto $scheme; } ========== 核心 CSP 头，解决你两个报错 ========== add header Content Security Policy " default src 'self'; script src 'self' 'nonce 8ca6e6c7 3afd 4fac 9092 68eb89bf9e7e' https://cdn.jsdelivr.net 'unsafe inline' 'unsafe eval'; style src 'self' 'nonce 8ca6e6c7 3afd 4fac 9092 68eb89bf9e7e' https://cdn.jsdelivr.net 'unsafe inline'; img src 'self' data: blob: https://cdn.jsdelivr.net; connect src 'self'; font src 'self'; object src 'none'; base uri 'self'; frame src 'self'; " always; 其他安全响应头 add header X Content Type Options nosniff always; add header X XSS Protection "1; mode=block" always; add header X Frame Options SAMEORIGIN always; add header Referrer Policy strict origin when cross origin always; }Lemmy2026-06-1831
123123132132123123131321 1321 321 31 2 13 1 2 31 32 1231231321212323123131321 1321 321 31 2 13 1 2 31 32 1231231321212323123131321 1321 321 31 2 13 1 2 31 32 1231231321212323123131321 1321 321 31 2 13 1 2 31 32 1231231321212323Lemmy2026-06-1800
