server { listen 80; server_name lemmy.yourdomain.com; # HTTP 强制跳转 HTTPS return 301 https://$host$request_uri; }

server { listen 443 ssl http2; server_name lemmy.yourdomain.com;

# SSL 证书路径（替换为你的证书）
ssl_certificate /etc/nginx/ssl/lemmy.yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/lemmy.yourdomain.com/privkey.pem;

# SSL 优化配置
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

# 通用缓存静态资源
location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2|woff|ttf)$ {
    expires 30d;
    add_header Cache-Control "public, no-transform";
    proxy_pass http://lemmy-ui:1234;
}

# 图床路由
location /pictrs/ {
    proxy_pass http://pictrs:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

# API 后端路由
location /api/ {
    proxy_pass http://lemmy:8536;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

# WebSocket 通知
location /api/ws {
    proxy_pass http://lemmy:8536;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

# 前端页面主路由
location / {
    proxy_pass http://lemmy-ui:1234;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

# ========== 核心 CSP 头，解决你两个报错 ==========
add_header Content-Security-Policy "
    default-src 'self';
    script-src 'self' 'nonce-8ca6e6c7-3afd-4fac-9092-68eb89bf9e7e' https://cdn.jsdelivr.net 'unsafe-inline' 'unsafe-eval';
    style-src 'self' 'nonce-8ca6e6c7-3afd-4fac-9092-68eb89bf9e7e' https://cdn.jsdelivr.net 'unsafe-inline';
    img-src 'self' data: blob: https://cdn.jsdelivr.net;
    connect-src 'self';
    font-src 'self';
    object-src 'none';
    base-uri 'self';
    frame-src 'self';
" always;

# 其他安全响应头
add_header X-Content-Type-Options nosniff always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Frame-Options SAMEORIGIN always;
add_header Referrer-Policy strict-origin-when-cross-origin always;

}