nginx ssl 配置

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;                      # Nginx 1.25.1+ 写法；旧版用 listen 443 ssl http2;
    
    server_name starneko.top;

    # ===== 证书配置 =====
    ssl_certificate     /etc/nginx/ssl/example.com.fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;

    # ===== 协议版本 =====
    # 只启用 TLS 1.2 / 1.3，禁用已不安全的 TLS 1.0/1.1
    ssl_protocols TLSv1.2 TLSv1.3;

    # ===== 加密套件 =====
    # TLS 1.3 套件由 OpenSSL 自动管理，无需在此配置
    # 以下为 TLS 1.2 的推荐套件（优先 ECDHE + AEAD）
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;   # 让客户端优先选择，TLS 1.3 下此项已无效

    # ===== 会话复用（提升性能）=====
    ssl_session_cache shared:SSL:10m;   # 约可存 4 万个会话
    ssl_session_timeout 1d;
    ssl_session_tickets off;            # 关闭 ticket，避免前向安全性问题

    # ===== 安全响应头 =====
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options    "nosniff" always;
    add_header X-Frame-Options           "SAMEORIGIN" always;
    add_header Referrer-Policy           "strict-origin-when-cross-origin" always;

    # ===== DH 参数（如使用 DHE 套件）=====
    # ssl_dhparam /etc/nginx/ssl/dhparam.pem;  # openssl dhparam -out dhparam.pem 2048

    location / {
        root /var/www/html;
        index index.html;
    }
}

# HTTP 强制跳转 HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name starneko.top;
    return 301 https://$host$request_uri;
}