xuanheng-website/nginx/default.conf

# ==============================================================================
# 上海炫恒网络系统有限公司 官网 —— Nginx 站点配置
#
# 设计要点：
#   1. /brands 这种「无扩展名地址」自动映射到 /brands.html，对外网址更干净
#   2. 访问目录（如 /assets）由 nginx 自动 301 补结尾斜杠，保证相对路径正确
#   3. HTML 不缓存、CSS/JS/图片长缓存 —— 改版后用户能立刻看到新页面
#   4. 开启 gzip 与基础安全响应头
#   5. /healthz 供 Docker 健康检查使用
#
# 注意：nginx 的 add_header 不会从上级继承到声明了 add_header 的 location，
#      所以每个自定义 location 里都重复声明了安全响应头。
# ==============================================================================

server {
    listen       80;
    listen       [::]:80;
    server_name  _;

    root   /usr/share/nginx/html;
    index  index.html;

    charset       utf-8;
    server_tokens off;

    access_log /var/log/nginx/access.log;
    error_log  /var/log/nginx/error.log warn;

    # ---- 健康检查（不写日志，避免污染） ----------------------------------
    location = /healthz {
        access_log off;
        default_type text/plain;
        return 200 "ok\n";
    }

    # ---- favicon 单独处理 ------------------------------------------------
    location = /favicon.ico {
        access_log off;
        expires 30d;
        add_header Cache-Control "public";
        add_header X-Content-Type-Options "nosniff" always;
        try_files $uri =404;
    }

    # ---- 核心：无扩展名访问 + 目录索引 -----------------------------------
    #  /            -> index.html
    #  /brands      -> brands.html
    #  /assets/x.js -> 直接命中文件
    location / {
        try_files $uri $uri.html $uri/index.html =404;
        # 未命中时不要缓存，避免 CDN / 浏览器记住错误页
        add_header X-Content-Type-Options   "nosniff" always;
        add_header X-Frame-Options          "SAMEORIGIN" always;
        add_header Referrer-Policy          "strict-origin-when-cross-origin" always;
        add_header Permissions-Policy       "geolocation=(), microphone=(), camera=()" always;
    }

    # ---- 静态资源长缓存 --------------------------------------------------
    location ~* \.(?:css|js)$ {
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable";
        add_header X-Content-Type-Options "nosniff" always;
        access_log off;
        try_files $uri =404;
    }

    location ~* \.(?:webp|png|jpe?g|gif|svg|ico|avif)$ {
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable";
        add_header X-Content-Type-Options "nosniff" always;
        access_log off;
        try_files $uri =404;
    }

    location ~* \.(?:woff2?|ttf|eot|otf)$ {
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable";
        access_log off;
        try_files $uri =404;
    }

    location ~* \.(?:mp4|webm)$ {
        expires 30d;
        add_header Cache-Control "public";
        access_log off;
        try_files $uri =404;
    }

    # ---- HTML 不缓存，保证改版即时生效 -----------------------------------
    # 用 expires -1（即 Cache-Control: no-cache）而不是再叠加 add_header，
    # 避免与上面的安全响应头互相覆盖。
    location ~* \.html?$ {
        expires -1;
        add_header X-Content-Type-Options   "nosniff" always;
        add_header X-Frame-Options          "SAMEORIGIN" always;
        add_header Referrer-Policy          "strict-origin-when-cross-origin" always;
        add_header Permissions-Policy       "geolocation=(), microphone=(), camera=()" always;
        try_files $uri =404;
    }

    # ---- gzip 压缩 -------------------------------------------------------
    gzip              on;
    gzip_vary         on;
    gzip_comp_level   6;
    gzip_min_length   256;
    gzip_proxied      any;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/javascript
        application/json
        application/xml
        image/svg+xml
        font/woff
        font/woff2;

    # ---- 404 兜底：回到首页（纯静态站点，避免出现死链页面） --------------
    error_page 404 /index.html;
}