# ═══════════════════════════════════════════════════════════
# 国内域名 · ICP备案落地页 Nginx 配置
# ═══════════════════════════════════════════════════════════
#
# 编号: ZY-SVR-NGX-CN-LANDING
# 服务器: ZY-SVR-004 · 43.139.217.141 · 广州七区
# 守护: 铸渊 · ICE-GL-ZY001
# 版权: 国作登字-2026-A-00037559
#
# 架构:
#   ZY_CN_DOMAIN (guanghulab.com / www.guanghulab.com) → 国内用户首页
#   前端: /opt/zhuyuan-cn/sites/cn-landing/ (静态HTML)
#   用途: ICP备案合规 + 未来国内语言操作系统入口
#
# 域名变量由 GitHub Secrets 注入:
#   ZY_CN_DOMAIN — 国内备案域名 (裸域名，如 guanghulab.com)
#   部署时自动展开为: guanghulab.com + www.guanghulab.com
#
# SSL: 首次部署后运行 setup-ssl 动作安装Let's Encrypt证书
#   certbot会自动添加443监听 + HTTP→HTTPS重定向
#   后续deploy会检测已有证书并重新注入SSL配置
# ═══════════════════════════════════════════════════════════

server {
    listen 80 default_server;
    server_name ZY_CN_BARE_DOMAIN_PLACEHOLDER www.ZY_CN_BARE_DOMAIN_PLACEHOLDER;

    # ─── 安全头 ───
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Server-Identity "ZY-SVR-004" always;
    add_header X-Site-Mode "cn-landing" always;

    # ─── 静态文件根目录 · 国内落地页 ───
    root /opt/zhuyuan-cn/sites/cn-landing;
    index index.html;

    # ─── 前端静态文件 ───
    location / {
        try_files $uri $uri/ /index.html;
    }

    # ─── 健康探针 ───
    location = /health {
        access_log off;
        return 200 '{"status":"ok","server":"ZY-SVR-004","role":"cn-landing"}';
        add_header Content-Type application/json;
    }

    # ─── 静态资源缓存 ───
    location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {
        expires 7d;
        add_header Cache-Control "public, immutable";
    }

    # ─── 错误页面 ───
    error_page 404 /index.html;
    error_page 500 502 503 504 /index.html;

    # ─── 访问日志 ───
    access_log /opt/zhuyuan-cn/data/logs/nginx-cn-landing.log;
    error_log /opt/zhuyuan-cn/data/logs/nginx-cn-landing-error.log;
}