# ═══════════════════════════════════════════════
# 铸渊专线V1 · 面孔服务器 Nginx订阅服务反向代理
# 添加到 /etc/nginx/sites-enabled/ 中的主配置
#
# ⚠️ 仅用于面孔服务器 (ZY-SVR-002) · V1 · 端口3802
# ⚠️ 大脑服务器 (ZY-SVR-005) 请使用 nginx-brain-proxy-snippet.conf
# ═══════════════════════════════════════════════

# §3 铸渊专线V1订阅服务 (面孔服务器)
# 通过主域名的 /api/proxy-sub/ 路径访问
# 实际由 subscription-server.js (port 3802) 处理

location /api/proxy-sub/ {
    proxy_pass http://127.0.0.1:3802/;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_connect_timeout 10s;
    proxy_read_timeout 30s;
    proxy_send_timeout 30s;

    # 订阅服务安全头
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options DENY always;
    add_header Cache-Control "no-store, no-cache, must-revalidate" always;
}