nginx.conf

events {
    worker_connections 2048;
    use epoll;
    multi_accept on;
}

http {
    # MIME types 설정
    include /etc/nginx/mime.types;
    types_hash_max_size 2048;
    types_hash_bucket_size 128;

    types {
        application/javascript mjs;
    }

    # 성능 최적화
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 100;
    client_max_body_size 20M;
    client_body_buffer_size 128k;
    
    # 버퍼링 최적화
    proxy_buffering on;
    proxy_buffer_size 4k;
    proxy_buffers 8 4k;
    proxy_busy_buffers_size 8k;
    proxy_temp_file_write_size 8k;
    
    # 타임아웃 최적화
    proxy_connect_timeout 10s;
    proxy_send_timeout 30s;
    proxy_read_timeout 30s;
    send_timeout 30s;
    
    # Gzip 압축
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
    gzip_disable "msie6";
    gzip_min_length 1000;
    
    # 로그 최적화
    access_log off;
    error_log /var/log/nginx/error.log warn;

    # HTTP 서버 - Admin 앱 (Let's Encrypt 인증용)
    # server {
    #     listen 80;
    #     server_name ~^(dev-admin|admin)\..+;
        
    #     # Let's Encrypt 인증 경로 (최우선)
    #     location /.well-known/acme-challenge/ {
    #         root /var/www/certbot;
    #         try_files $uri =404;
    #     }
        
    #     # 인증서가 있으면 HTTPS로 리다이렉트
    #     location / {
    #         # 인증서 파일 존재 여부 확인 후 리다이렉트
    #         if (-f /etc/letsencrypt/live/devfive.kr/fullchain.pem) {
    #             return 301 https://$host$request_uri;
    #         }
    #         # 인증서가 없으면 HTTP로 직접 서비스 (인증서 발급 중)
    #         proxy_pass http://node:3001;
    #         proxy_set_header Host $host;
    #         proxy_set_header X-Real-IP $remote_addr;
    #         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #         proxy_set_header X-Forwarded-Proto $scheme;
    #     }
    # }

    # Admin 앱 서버 (dev-admin.*, admin.* 도메인) - HTTPS
    server {
        listen 443 ssl;
        http2 on;
        server_name ~^(dev-admin|admin)\..+;
        client_max_body_size 20M;

        # SSL 인증서 설정 (Let's Encrypt)
        # ssl_certificate /etc/letsencrypt/live/devfive.kr/fullchain.pem;
        # ssl_certificate_key /etc/letsencrypt/live/devfive.kr/privkey.pem;
        
        # SSL 보안 설정
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;

        # 정적 파일 호스팅 (/files/ 경로)
        location /files/ {
            alias /var/files/;
            expires 1y;
            access_log off;
            add_header Cache-Control "public, immutable";

            # 파일이 없을 때 404 반환
            try_files $uri $uri/ /;
        }

        # 메인 라우트
        location / {
            proxy_pass http://node:3001;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            
            # Keep-alive 연결 재사용
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            
            # 캐싱 비활성화 (동적 콘텐츠)
            add_header Cache-Control "no-cache, no-store, must-revalidate";
            add_header Pragma "no-cache";
            add_header Expires "0";
        }

        # 정적 파일 캐싱
        location ~* ^(?!/files/).*\.(?:css|js|woff2?|eot|ttf|otf|jpg|jpeg|png|gif|ico|svg|webp)$ {
            proxy_pass http://node:3001;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            
            # Keep-alive 연결 재사용
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            
            # 정적 파일 캐싱
            expires 1y;
            access_log off;
            add_header Cache-Control "public, immutable";
        }
    }

    # HTTP 서버 - Front 앱 (Let's Encrypt 인증용)
    # server {
    #     listen 80 default_server;
        
    #     # Let's Encrypt 인증 경로 (최우선)
    #     location /.well-known/acme-challenge/ {
    #         root /var/www/certbot;
    #         try_files $uri =404;
    #     }
        
    #     # 인증서가 있으면 HTTPS로 리다이렉트
    #     location / {
    #         # 인증서 파일 존재 여부 확인 후 리다이렉트
    #         if (-f /etc/letsencrypt/live/devfive.kr/fullchain.pem) {
    #             return 301 https://$host$request_uri;
    #         }
    #         # 인증서가 없으면 HTTP로 직접 서비스 (인증서 발급 중)
    #         proxy_pass http://node:3000;
    #         proxy_set_header Host $host;
    #         proxy_set_header X-Real-IP $remote_addr;
    #         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #         proxy_set_header X-Forwarded-Proto $scheme;
    #     }
    # }

    # Front 앱 서버 (기본 서버) - HTTPS
    server {
        listen 80 default_server;
        client_max_body_size 20M;

        # listen 443 ssl default_server;
        # http2 on;
        # server_name devfive.kr www.devfive.kr;
        # client_max_body_size 20M;

        # SSL 인증서 설정 (Let's Encrypt)
        # ssl_certificate /etc/letsencrypt/live/devfive.kr/fullchain.pem;
        # ssl_certificate_key /etc/letsencrypt/live/devfive.kr/privkey.pem;
        
        # SSL 보안 설정
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;

        # 정적 파일 호스팅 (/files/ 경로)
        location /files/ {
            alias /var/files/;
            expires 1y;
            access_log off;
            add_header Cache-Control "public, immutable";

            # 파일이 없을 때 404 반환
            try_files $uri $uri/ /;
        }

        # 메인 라우트
        location / {
            proxy_pass http://node:3000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            
            # Keep-alive 연결 재사용
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            
            # 캐싱 비활성화 (동적 콘텐츠)
            add_header Cache-Control "no-cache, no-store, must-revalidate";
            add_header Pragma "no-cache";
            add_header Expires "0";
        }

        location ~* ^(?!/files/).*\.(?:css|js|woff2?|eot|ttf|otf|jpg|jpeg|png|gif|ico|svg|webp)$ {
            proxy_pass http://node:3000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            
            # Keep-alive 연결 재사용
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            
            # 정적 파일 캐싱
            expires 1y;
            access_log off;
            add_header Cache-Control "public, immutable";
        }
    }

    # HTTP 서버 - API 서버 (Let's Encrypt 인증용)
    # server {
    #     listen 80;
    #     server_name ~^(dev-api|api)\..+;
        
    #     # Let's Encrypt 인증 경로 (최우선)
    #     location /.well-known/acme-challenge/ {
    #         root /var/www/certbot;
    #         try_files $uri =404;
    #     }
        
    #     # 인증서가 있으면 HTTPS로 리다이렉트
    #     location / {
    #         # 인증서 파일 존재 여부 확인 후 리다이렉트
    #         if (-f /etc/letsencrypt/live/devfive.kr/fullchain.pem) {
    #             return 301 https://$host$request_uri;
    #         }
    #         # 인증서가 없으면 HTTP로 직접 서비스 (인증서 발급 중)
    #         proxy_pass http://api:8000;
    #         proxy_set_header Host $host;
    #         proxy_set_header X-Real-IP $remote_addr;
    #         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #         proxy_set_header X-Forwarded-Proto $scheme;
    #     }
    # }

    # API 서버 (dev-api.*, api 도메인) - HTTPS
    server {
        listen 80;
        server_name ~^(dev-api|api)\..+;
        client_max_body_size 20M;

        # listen 443 ssl;
        # http2 on;
        # server_name ~^(dev-api|api)\..+;
        # client_max_body_size 20M;

        # SSL 인증서 설정 (Let's Encrypt)
        # ssl_certificate /etc/letsencrypt/live/devfive.kr/fullchain.pem;
        # ssl_certificate_key /etc/letsencrypt/live/devfive.kr/privkey.pem;
        
        # SSL 보안 설정
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;

        # 정적 파일 호스팅 (/files/ 경로)
        location /files/ {
            alias /var/files/;
            expires 1y;
            access_log off;
            add_header Cache-Control "public, immutable";

            # 파일이 없을 때 404 반환
            try_files $uri $uri/ /;
        }

        # 메인 라우트
        location / {
            proxy_pass http://api:8000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            
            # Keep-alive 연결 재사용
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            
            # 캐싱 비활성화 (동적 콘텐츠)
            add_header Cache-Control "no-cache, no-store, must-revalidate";
            add_header Pragma "no-cache";
            add_header Expires "0";
        }
        
        # 정적 파일 캐싱
        location ~* ^(?!/files/).*\.(?:css|js|woff2?|eot|ttf|otf|jpg|jpeg|png|gif|ico|svg|webp)$ {
            proxy_pass http://api:8000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            
            # Keep-alive 연결 재사용
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            
            # 정적 파일 캐싱
            expires 1y;
            access_log off;
            add_header Cache-Control "public, immutable";
        }
    }
}