# status.xpcool.com 服务监控面板（Uptime Kuma 2.5.3）
# 反代后端容器 uptime-kuma：127.0.0.1:3001
# 2026-09-13 部署；证书为腾讯云免费 DV 证书（本地源 E:\CentOS\ssl\status.xpcool.com_nginx\）
# 2026-09-13 追加 /bark-assets/ 静态位置，供 Bark 推送取图标与告警配图（手机端直接访问，必须公开）

# HTTP -> HTTPS 跳转
server {
    listen 80;
    server_name status.xpcool.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name status.xpcool.com;

    ssl_certificate     /data/nginx/ssl/status.xpcool.com/status.xpcool.com_bundle.crt;
    ssl_certificate_key /data/nginx/ssl/status.xpcool.com/status.xpcool.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;

    # 面板内存有各类通知凭据，附加基础安全响应头
    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;

    # Bark 推送素材：手机收到通知后会主动来拉取，故必须可匿名访问、走 HTTPS
    location /bark-assets/ {
        alias /data/www/bark-assets/;
        default_type image/png;
        autoindex off;
        access_log off;
        expires 7d;
        add_header Cache-Control "public, max-age=604800";
    }

    # 面板依赖 WebSocket 实时推送状态，必须透传 Upgrade 头，否则页面无限重连
    location / {
        proxy_pass http://127.0.0.1:3001;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # 长连接保持时间，避免面板偶发掉线
        proxy_read_timeout 300s;
        proxy_send_timeout 300s;
    }
}