v1st233/lsky-pro repository overview

server {
    listen 80;
    server_name _;

    root /var/www/html/public;
    index index.php index.html;

    # 基础安全与通用头（按需调整/精简）
    add_header X-Frame-Options SAMEORIGIN always;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy strict-origin-when-cross-origin always;
    add_header X-XSS-Protection "1; mode=block" always;

    # 健康检查
    location = /health {
        add_header Content-Type text/plain;
        return 200 "ok";
    }


    # 主路由：优先文件/目录，其次交给 index.php（WordPress 友好）
    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    # 仅处理真实存在的 PHP 文件，避免任意转发
    location ~ \.php$ {
        # 若 php.ini / fpm 池已有 PATHINFO 处理，可关闭 PATH_INFO
        try_files $uri =404;

        # 使用 fastcgi.conf（比 fastcgi_params 更全，含 SCRIPT_FILENAME）
        include fastcgi.conf;
        fastcgi_pass lsky:9000;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

        real_ip_header X-Forwarded-For;
        real_ip_recursive on;

        set_real_ip_from 172.0.0.0/8;   # 信任代理的内网段
        set_real_ip_from 127.0.0.1;
        set_real_ip_from 192.168.0.0/16;
        set_real_ip_from ::1;
        fastcgi_param REMOTE_ADDR $remote_addr;

        # 适度的超时/缓冲（按业务调整）
        fastcgi_connect_timeout 5s;
        fastcgi_send_timeout 60s;
        fastcgi_read_timeout 60s;
        fastcgi_buffers 8 16k;
        fastcgi_buffer_size 32k;

        # 如需临时提高上传限制，可在此覆盖
        client_max_body_size 64m;
    }


    # 屏蔽 Nginx 版本信息（需在 http {} 中 server_tokens off; 更佳）
    server_tokens off;

    # 可选：对 favicon、robots 降低日志噪音
    location = /favicon.ico  { access_log off; log_not_found off; }
    location = /robots.txt   { access_log off; log_not_found off; }
}