nginx2.conf

#worker配置
worker_processes auto;
worker_rlimit_nofile 10240;

#pid路径
pid /run/nginx.pid;

#事件模块（选择运行模式）
events {
    #使用epoll事件模型
    use epoll;
    #每个进程同时最多连接数
    worker_connections 1024;
}

http {

    #日志设置
    access_log off;
    error_log /www/log/error.log;

    #启用gzip压缩
    gzip on;
    gzip_types  text/css text/javascript text/xml text/plain  application/json application/javascript application/x-javascript application/xml application/font-woff application/font-sfnt application/font-otf application/font-ttf image/svg+xml image/x-icon image/gif image/jpeg image/png image/bmp;

    #缓存设置
    open_file_cache max=1000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;
    client_body_buffer_size 128k;
    client_header_buffer_size 1k;
    client_max_body_size 10m;
    large_client_header_buffers 4 16k;

    #启用 keepalive 
    keepalive_timeout 70s;
    keepalive_requests 1000;
    tcp_nodelay on;
    tcp_nopush on;
    sendfile on;

    #HTTP/2优先
    http2_push_preload on;
    http2_push off;
    http2_max_concurrent_streams 100;

    #HSTS设置
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";

    server {
        listen 80;
        listen [::]:80;
        #return 301 https://$server_name$request_uri;
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name yourqexo.com;
        
        if ($server_port !~ 443){
            rewrite ^(/.*)$ https://$host$1 permanent;
        }
        
        #SSL证书配置
        ssl_certificate /root/.acme.sh/yourqexo.com_ecc/fullchain.cer;
        ssl_certificate_key /root/.acme.sh/yourqexo.com_ecc/yourqexo.com.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers EECDH+AESGCM:EECDH+AES256:EECDH+AES128:RSA+AES128:RSA+AES:3DES:!MD5:!DSS;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        
        #不记录访问日志
        access_log off;

        location / {
            proxy_pass http://127.0.0.1:8000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    }

    server {
        listen 80;
        listen [::]:80;
        #return 301 https://$server_name$request_uri;
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name yourhexo.com;
        
        if ($server_port !~ 443){
            rewrite ^(/.*)$ https://$host$1 permanent;
        }
        
        #SSL证书配置
        ssl_certificate /root/.acme.sh/yourhexo.com_ecc/fullchain.cer;
        ssl_certificate_key /root/.acme.sh/yourhexo.com_ecc/yourhexo.com.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers EECDH+AESGCM:EECDH+AES256:EECDH+AES128:RSA+AES128:RSA+AES:3DES:!MD5:!DSS;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        
        #不记录访问日志
        access_log off;
        
        index index.php index.html index.htm default.php default.htm default.html;
        root /www/site/public;

    }
}