初始提交：ash 服务器 nginx 配置（已优化版）

nginx.conf:
- worker_processes auto
- worker_connections 4096 + multi_accept on
- proxy_buffering 显式配置
- SSL session cache 10m

token-tlyq.conf:
- 启用 HTTP/2 (http2 on)
- proxy_pass → host.docker.internal:3000

token-tuling.conf / letsencrypt.conf: 未修改

.gitignore

@@ -0,0 +1,14 @@
+# 证书文件（不应提交到仓库）
+certs/
+*.pem
+*.key
+*.crt
+
+# 临时文件
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Docker 相关
+docker-compose.override.yml

letsencrypt.conf

@@ -0,0 +1,13 @@
+server {
+    listen 80;
+    server_name token.tlyq.ai token.tulingyinqing.com;
+    
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+        try_files $uri =404;
+    }
+    
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}

nginx.conf

@@ -0,0 +1,42 @@
+worker_processes auto;
+
+events {
+    worker_connections 4096;
+    multi_accept on;
+}
+
+http {
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    client_max_body_size 16m;
+
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Connection "";
+    proxy_connect_timeout 3s;
+    proxy_send_timeout 30s;
+    proxy_read_timeout 30s;
+
+    # 显式配置 proxy 缓冲（值等于 nginx 默认值，提升可维护性）
+    proxy_buffering on;
+    proxy_buffer_size 4k;
+    proxy_buffers 8 4k;
+    proxy_busy_buffers_size 8k;
+
+    gzip on;
+    gzip_min_length 1k;
+    gzip_comp_level 5;
+    gzip_types text/plain text/css application/json application/javascript application/xml image/svg+xml;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+
+    include /etc/nginx/conf.d/*.conf;
+}

token-tlyq.conf

@@ -0,0 +1,16 @@
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name token.tlyq.ai;
+    
+    ssl_certificate /etc/nginx/certs/tlyq.ai/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/tlyq.ai/privkey.pem;
+    
+    location / {
+        proxy_pass http://host.docker.internal:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

token-tuling.conf

@@ -0,0 +1,15 @@
+server {
+    listen 443 ssl;
+    server_name token.tulingyinqing.com;
+    
+    ssl_certificate /etc/nginx/certs/tulingyinqing.com/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/tulingyinqing.com/privkey.pem;
+    
+    location / {
+        proxy_pass http://host.docker.internal:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}