55 lines
1.7 KiB
Nginx Configuration File
55 lines
1.7 KiB
Nginx Configuration File
# 限制请求速率（防止暴力破解和 DDoS）
|
||
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
|
||
limit_req_zone $binary_remote_addr zone=login_limit:10m rate=1r/s;
|
||
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
|
||
|
||
server {
|
||
listen 80;
|
||
server_name _;
|
||
|
||
limit_req_status 429;
|
||
limit_conn_status 429;
|
||
|
||
# 基础安全头
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
|
||
# 限制连接数
|
||
limit_conn conn_limit 20;
|
||
|
||
# 禁止访问隐藏文件
|
||
location ~ /\. {
|
||
deny all;
|
||
}
|
||
|
||
# 登录接口 - 严格限流（防暴力破解）
|
||
location /api/admin/auth/login {
|
||
limit_req zone=login_limit burst=3 nodelay;
|
||
proxy_pass http://license-server:3000;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
}
|
||
|
||
# API 接口 - 普通限流
|
||
location /api/ {
|
||
limit_req zone=api_limit burst=20 nodelay;
|
||
proxy_pass http://license-server:3000;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
}
|
||
|
||
# 静态资源和页面
|
||
location / {
|
||
proxy_pass http://license-server:3000;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
}
|
||
}
|