37d7e06d38
nginx 的 add_header 在 location 有自己的 add_header 时不继承 server 块， portal 的 location / 和 location = /index.html 都有 Cache-Control， 需在两处重复加安全头：X-Frame-Options/X-Content-Type-Options/ Referrer-Policy/X-XSS-Protection/Permissions-Policy
90 lines
2.9 KiB
Nginx Configuration File
90 lines
2.9 KiB
Nginx Configuration File
# BuildFlow 门户网站 Nginx 配置
|
||
# - SPA history 路由回退到 index.html
|
||
# - 静态资源长缓存（hash 文件名）
|
||
# - Gzip 压缩
|
||
# - 安全响应头
|
||
|
||
server {
|
||
listen 5173;
|
||
listen [::]:5173;
|
||
server_name _;
|
||
|
||
root /usr/share/nginx/html;
|
||
index index.html;
|
||
|
||
# Gzip 压缩
|
||
gzip on;
|
||
gzip_vary on;
|
||
gzip_min_length 1024;
|
||
gzip_comp_level 6;
|
||
gzip_types
|
||
text/plain
|
||
text/css
|
||
text/xml
|
||
text/javascript
|
||
application/javascript
|
||
application/json
|
||
application/xml
|
||
application/rss+xml
|
||
image/svg+xml
|
||
font/woff
|
||
font/woff2;
|
||
|
||
# 安全响应头
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
||
|
||
# 静态资源长缓存（Vite 产物带 hash 文件名，可安全 immutable）
|
||
location /assets/ {
|
||
expires 1y;
|
||
add_header Cache-Control "public, immutable";
|
||
access_log off;
|
||
try_files $uri =404;
|
||
}
|
||
|
||
# 图片资源缓存
|
||
location ~* \.(?:jpg|jpeg|png|gif|ico|svg|webp|avif)$ {
|
||
expires 30d;
|
||
add_header Cache-Control "public";
|
||
access_log off;
|
||
try_files $uri =404;
|
||
}
|
||
|
||
# 字体资源缓存
|
||
location ~* \.(?:woff2?|ttf|otf|eot)$ {
|
||
expires 1y;
|
||
add_header Cache-Control "public, immutable";
|
||
add_header Access-Control-Allow-Origin "*";
|
||
access_log off;
|
||
try_files $uri =404;
|
||
}
|
||
|
||
# SPA history 路由回退（加安全头，nginx add_header 继承规则：location 有自己的 add_header 时不继承 server）
|
||
location / {
|
||
try_files $uri $uri/ /index.html;
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
||
}
|
||
|
||
# index.html 不缓存，保证发布后立即生效
|
||
location = /index.html {
|
||
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
||
# 安全响应头（同理重复，防继承覆盖）
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
||
expires 0;
|
||
}
|
||
|
||
# 自定义错误页回退到首页（SPA 友好）
|
||
error_page 404 /index.html;
|
||
}
|