log_format  web-archives-manager  '$remote_addr - $remote_user [$time_local] "$request" '
                                  '$status $body_bytes_sent "$http_referer" '
                                  '"$http_user_agent" "$http_x_forwarded_for"';

server {
    server_name dev.web-archives-manager.com;
    listen 8096 ssl;

    ssl_certificate   /home/keysecret/server.crt;
    ssl_certificate_key  /home/keysecret/server.key;

    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers on;

    ssl_protocols TLSv1.2 ;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 5m;

    resolver 8.8.4.4 8.8.8.8 valid=300s;
    resolver_timeout 10s;

    #ssl_dhparam /home/keysecret/server.pem;

    access_log /home/a8096/access_web-archives-manager-dev.log web-archives-manager;
    error_log /home/a8096/error_web-archives-manager-dev.log;

    root /home/a8096/web-archives-manager;

    location /stage-api/ {
      proxy_pass http://192.168.206.182:8090/;
      proxy_set_header Host $host;
      client_max_body_size 30m;
    }

    error_page 403 /403.html;
    add_header X-Content-Type-Options nosniff;
    add_header X-Permitted-Cross-Domain-Policies master-only;
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
    add_header X-Frame-Options 'SAMEORIGIN';
    add_header X-XSS-Protection "1; mode=block";
    add_header Content-Security-Policy  "default-src 'self'; script-src 'self' https://at.alicdn.com/ 'unsafe-inline'; font-src 'self' data:; img-src 'self'  data: 'unsafe-inline' https:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; frame-src 'self'; connect-src https:";
    # nginx中增加对Referrer的控制
    add_header  Referrer-Policy  "origin-when-crossorigin";
    add_header 'Referrer-Policy' 'origin';
    add_header 'Referrer-Policy' 'unsafe-url';
    add_header Cache-Control no-cache;
    add_header Cache-Control private;
}