api.ioliu.cn.conf

server {
    server_name  api.ioliu.cn;
    listen       80;
    listen       [::]:80;
    listen       443 ssl http2;
    listen       [::]:443 ssl http2;
    #add_header                  Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
    add_header                  Strict-Transport-Security "max-age=31536000;preload";
    add_header                  X-Frame-Options "DENY";
    add_header                  X-Content-Type-Options "nosniff";
    add_header                  X-XSS-Protection "1; mode=block";
    add_header                  Set-Cookie "HttpOnly";
    add_header                  Set-Cookie "Secure";
    add_header                  Cache-Control "no-siteapp";
    add_header                  Public-Key-Pins 'pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; pin-sha256="kb6xLprt35abNnSn74my4Dkfya9arbk5zN5a60YzuqE="; max-age=0;';
    ssl_certificate             /etc/letsencrypt/live/bing.ioliu.cn/fullchain.pem;
    ssl_certificate_key         /etc/letsencrypt/live/bing.ioliu.cn/privkey.pem;
    ssl_trusted_certificate     /etc/letsencrypt/live/bing.ioliu.cn/chain.pem;
    
    #ssl_certificate             usr/home/wwwroot/keys/ioliu.crt;
    #ssl_certificate_key         usr/home/wwwroot/keys/ioliu.key;
    
    #ssl_dhparam                 keys/dhparam.pem;
    
    ssl_ecdh_curve              secp384r1;
    ssl_session_cache           shared:SSL:2m;
    ssl_session_timeout         12h;
    ssl_session_tickets         on;
    ssl_prefer_server_ciphers   on;
    ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers                 EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA256:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EDH+aRSA+AESGCM:EDH+aRSA+SHA256:EDH+aRSA:EECDH:!DH:!aNULL:!eNULL:!MEDIUM:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED;
    ssl_stapling                on;
    ssl_stapling_verify         on;
    set                         $rewriterule https;
    if                          ($scheme = https) {
        set                     $rewriterule "${rewriterule}7"; 
    }
    if                          ($host ~* ^api.ioliu.cn) {
        set                     $rewriterule "${rewriterule}8"; 
    }
    if                          ($rewriterule != "https78") {
        return                  301 https://api.ioliu.cn$request_uri;
        break; 
    }

    location / {
        root   /home/webroot/api.ioliu.cn/;
        index  index.php index.html index.htm;
        rewrite "^/([0-9]+)[/]?" /?p=$1 last;
        rewrite "^/detail/([0-9]+)[/]?" /detail/?id=$1 last;
        rewrite "^/bing/([0-9]+)[/]?" /bing/?d=$1 last;
        rewrite "^/bing/blur/([0-9]+)[/]?" /bing/blur/?d=$1 last;
    }

    #error_page  404              /404.html;
    
    access_log      /home/webroot/logs/api.ioliu.access.log;
    error_log       /home/webroot/logs/api.ioliu.error.log;

    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
    
    location ~ \.php$ {
        root           html;
        fastcgi_pass   127.0.0.1:9000;
        #fastcgi_pass   unix:/var/run/php-fpm/php-fpm.sock;
        #fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /home/webroot/api.ioliu.cn$fastcgi_script_name;
        include        fastcgi_params;
    }

    # 静止访问 "." 开头的隐藏文件
    location                            ~ /\. {
        deny                            all;
    }
    # robots.txt 、 favicon.ico ，status.gif 文件访问不记录日志
    location                            ~* ^/(favicon.ico|robots.txt|status.gif)$ {
        allow                           all;
        access_log                      /dev/null;
        error_log                       /dev/null;
    }


}