commit 12552281bf63559d4e07d13b5e5174036a410b2d
Author: aiyimickey <39365912+aiyimickey@users.noreply.github.com>
Date:   Tue Jul 14 16:31:35 2026 +0800

    初始提交：ash 服务器 nginx 配置（已优化版）
    
    nginx.conf:
    - worker_processes auto
    - worker_connections 4096 + multi_accept on
    - proxy_buffering 显式配置
    - SSL session cache 10m
    
    token-tlyq.conf:
    - 启用 HTTP/2 (http2 on)
    - proxy_pass → host.docker.internal:3000
    
    token-tuling.conf / letsencrypt.conf: 未修改

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e7dac15
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,14 @@
+# 证书文件（不应提交到仓库）
+certs/
+*.pem
+*.key
+*.crt
+
+# 临时文件
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Docker 相关
+docker-compose.override.yml
diff --git a/letsencrypt.conf b/letsencrypt.conf
new file mode 100644
index 0000000..c24b1b7
--- /dev/null
+++ b/letsencrypt.conf
@@ -0,0 +1,13 @@
+server {
+    listen 80;
+    server_name token.tlyq.ai token.tulingyinqing.com;
+    
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+        try_files $uri =404;
+    }
+    
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
diff --git a/nginx.conf b/nginx.conf
new file mode 100644
index 0000000..59bbc66
--- /dev/null
+++ b/nginx.conf
@@ -0,0 +1,42 @@
+worker_processes auto;
+
+events {
+    worker_connections 4096;
+    multi_accept on;
+}
+
+http {
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    client_max_body_size 16m;
+
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Connection "";
+    proxy_connect_timeout 3s;
+    proxy_send_timeout 30s;
+    proxy_read_timeout 30s;
+
+    # 显式配置 proxy 缓冲（值等于 nginx 默认值，提升可维护性）
+    proxy_buffering on;
+    proxy_buffer_size 4k;
+    proxy_buffers 8 4k;
+    proxy_busy_buffers_size 8k;
+
+    gzip on;
+    gzip_min_length 1k;
+    gzip_comp_level 5;
+    gzip_types text/plain text/css application/json application/javascript application/xml image/svg+xml;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+
+    include /etc/nginx/conf.d/*.conf;
+}
diff --git a/token-tlyq.conf b/token-tlyq.conf
new file mode 100644
index 0000000..0cf1e76
--- /dev/null
+++ b/token-tlyq.conf
@@ -0,0 +1,16 @@
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name token.tlyq.ai;
+    
+    ssl_certificate /etc/nginx/certs/tlyq.ai/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/tlyq.ai/privkey.pem;
+    
+    location / {
+        proxy_pass http://host.docker.internal:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
diff --git a/token-tuling.conf b/token-tuling.conf
new file mode 100644
index 0000000..925045d
--- /dev/null
+++ b/token-tuling.conf
@@ -0,0 +1,15 @@
+server {
+    listen 443 ssl;
+    server_name token.tulingyinqing.com;
+    
+    ssl_certificate /etc/nginx/certs/tulingyinqing.com/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/tulingyinqing.com/privkey.pem;
+    
+    location / {
+        proxy_pass http://host.docker.internal:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}