📂 solution-1.0

# Hermes 统一网关 — 加入设备白名单认证
# 静态资源直接放行，动态请求走认证网关 8081

upstream auth_gateway {
    server 127.0.0.1:8081;
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    charset utf-8;
    access_log /var/log/nginx/hermes-access.log;
    error_log /var/log/nginx/hermes-error.log;

    location = / {
        return 404 "Hermes Gateway\n";
    }

    location /health {
        return 200 "OK\n";
        add_header Content-Type text/plain;
    }

    location /webchat/ {
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Expires "0";
        add_header Pragma "no-cache";
        root /var/www;
        index index.html;
    }
    location = /webchat { return 301 /webchat/; }

    location /assets/ {
        proxy_pass https://rosicky-doc.oss-cn-shanghai.aliyuncs.com/hermes-assets/;
        proxy_set_header Host rosicky-doc.oss-cn-shanghai.aliyuncs.com;
        proxy_buffering on;
        proxy_http_version 1.1;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    location ^~ /.well-known/ {
        root /root;
        allow all;
    }

    location ~ /\. { deny all; access_log off; log_not_found off; }

    location = /favicon.ico {
        root /var/www;
    }

    location /doc/ {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 30s;
    }
    location = /docs { return 302 /doc/; }

    location = /games { return 302 /games/; }
    location /games/ {
        root /var/www;
        index index.html;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Expires "0";
        add_header Pragma "no-cache";
    }
    location = /games-mian { return 302 /games-mian/; }
    location /games-mian/ {
        root /var/www;
        index index.html;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Expires "0";
        add_header Pragma "no-cache";
    }
    location = /games-liangliang { return 302 /games-liangliang/; }
    location /games-liangliang/ {
        root /var/www;
        index index.html;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Expires "0";
        add_header Pragma "no-cache";
    }

    location = /task-selector.js { root /var/www; add_header Cache-Control "no-cache"; }
    location = /task-org { return 302 /task-org/; }
    location /task-org/ {
        root /var/www;
        index index.html;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
    }

    location = /chat/marked.umd.js {
        root /var/www;
        add_header Cache-Control "public, max-age=3600";
    }

    location /chat/ {
        proxy_pass http://127.0.0.1:8766;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 30s;
    }

    location /api/ {
        rewrite ^/api/(.*) /$1 break;
        proxy_pass http://127.0.0.1:8766;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 30s;
    }

    location = /ws {
        rewrite ^/ws$ / break;
        proxy_pass http://127.0.0.1:8765;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 3600s;
    }

    location /ws/ {
        rewrite ^/ws/(.*) /$1 break;
        proxy_pass http://127.0.0.1:8765;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 3600s;
    }

    location / {
        proxy_pass http://auth_gateway;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        proxy_read_timeout 120s;
        proxy_send_timeout 120s;
    }
}