# 自定义日志格式，记录 Referer
log_format referer_log '$remote_addr - $remote_user [$time_local] '
                      '"$request" $status $body_bytes_sent '
                      '"$http_referer" "$http_user_agent" "$invalid_referer"';
# 监听80端口，重定向到443
server {
     listen 80;
     server_name oss.dev1.ipykj.com;

     # 301永久重定向到HTTPS
     return 301 https://$server_name$request_uri;

     # 可选：记录重定向访问日志
     access_log /opt/tengine/conf/conf.d/logs/redirect_access.log referer_log;
}
server {
    listen  443 ssl;
    server_name  oss.dev1.ipykj.com;
    ssl_certificate /mydata/omp/workspace/certs/oss.dev1.ipykj.com_bundle.crt;
    ssl_certificate_key /mydata/omp/workspace/certs/oss.dev1.ipykj.com.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;

    access_log /opt/tengine/conf/conf.d/logs/referer_access.log referer_log;

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header REMOTE-HOST $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket 配置
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;

        proxy_pass http://192.168.0.103:9102/;
    }

    # 图片防盗链 - 精准匹配
    location ~* ^/dev1-bucket/files/images/.+\.(jpg|jpeg|png|gif|webp|bmp|ico)$ {
        # 详细的白名单配置
        valid_referers none blocked server_names
                       # 允许自己的域名（支持通配符）
                       # *.ilyixy.com
                       *.ipykj.com
                       ipykj.com
                       *.dev1.ipykj.com
                       dev1.ipykj.com

                       # 允许直接访问（无 Referer）
                       none

                       # 允许空 Referer（某些特殊情况）
                       blocked

                       # 允许的特定域名
                       https://yourdomain.com
                       http://yourdomain.com

                       # 本地开发环境
                       localhost
                       127.0.0.1
                       192.168.*

                       # 搜索引擎（可选）
                       baidu.com;
        # 防盗链检查
        if ($invalid_referer) {
            # 记录非法访问
            access_log /opt/tengine/conf/conf.d/logs/hotlink.log referer_log;
            # 返回403错误页面
            return 403 '<html><body><h1>403 Forbidden</h1><p>Hotlinking is not allowed.</p></body></html>';
            # 或者重定向到错误图片
            # rewrite ^ /static/anti-hotlink.jpg last;
        }

        # 合法访问：正常代理
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_pass http://192.168.0.103:9102;
    }

    error_page   403 /403.html;
    location = /403.html {
        root   /usr/share/nginx/html;
    }

    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   html;
    }
}