feat: nginx 全局性能优化（gzip/timeout/buffer/SSL/缓存）

- nginx.conf: 添加 gzip 压缩、SSL session cache、sendfile/tcp_nopush/tcp_nodelay
- nginx.conf: 设置反代全局默认参数（timeout 3s/30s/30s, buffer 16k×8）
- nginx.conf: 添加客户端超时和 keepalive 配置
- nginx.conf: 添加 worker_connections 1024
- conf.d/*.conf: www-ai/issue-ai/assets-ai 补全 _next/static 缓存（expires 1y）
- conf.d/*.conf: cloud-ai/token-ai 切换到 resolver 变量模式
- conf.d/*.conf: sso-ai 修正证书路径 + proxy_ssl_verify off
- conf.d/monitor-ai.conf: 新增监控站点反向代理配置
- nginx-local.conf: 同步本地测试配置的优化参数

conf.d/assets-ai.conf

@@ -5,10 +5,18 @@ server {
     ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
 
+    location /_next/static/ {
+        proxy_pass http://assets-ai:3000;
+        proxy_set_header Host $host;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
     location / {
         proxy_pass http://assets-ai:3000;
         proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto https;
     }
 }

conf.d/cloud-ai.conf

@@ -2,11 +2,13 @@ server {
     listen 443 ssl;
     server_name cloud.tlyq.ai;
 
-    ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
 
     location / {
-        proxy_pass http://cloud-ai;
+        resolver 127.0.0.11 valid=30s;
+        set $upstream cloud-ai;
+        proxy_pass http://$upstream;
         proxy_set_header Host $host;
     }
 }

conf.d/issue-ai.conf

@@ -5,10 +5,19 @@ server {
     ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
 
+    location /_next/static/ {
+        proxy_pass http://issue-ai:3000;
+        proxy_set_header Host $host;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
     location / {
         proxy_pass http://issue-ai:3000;
         proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto https;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
     }
 }

conf.d/monitor-ai.conf

@@ -0,0 +1,28 @@
+server {
+    listen 443 ssl;
+    server_name monitor.tlyq.ai;
+
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
+
+    location /_next/static/ {
+        resolver 127.0.0.11 valid=30s;
+        set $upstream monitor-ai:3000;
+        proxy_pass http://$upstream;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto https;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    location / {
+        resolver 127.0.0.11 valid=30s;
+        set $upstream monitor-ai:3000;
+        proxy_pass http://$upstream;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto https;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+    }
+}

conf.d/sso-ai.conf

@@ -2,11 +2,14 @@ server {
     listen 443 ssl;
     server_name sso.tlyq.ai;
 
-    ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai-0001/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai-0001/privkey.pem;
 
     location / {
-        proxy_pass http://authelia:9091;
+        resolver 127.0.0.11 valid=30s;
+        set $upstream authelia:9091;
+        proxy_pass https://$upstream;
+        proxy_ssl_verify off;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

conf.d/token-ai.conf

@@ -2,11 +2,13 @@ server {
     listen 443 ssl;
     server_name token.tlyq.ai;
 
-    ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
 
     location / {
-        proxy_pass http://token-ai;
+        resolver 127.0.0.11 valid=30s;
+        set $upstream token-ai;
+        proxy_pass http://$upstream;
         proxy_set_header Host $host;
     }
 }

conf.d/www-ai.conf

@@ -5,10 +5,20 @@ server {
     ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
 
+    location /_next/static/ {
+        resolver 127.0.0.11 valid=30s;
+        set $upstream www-ai;
+        proxy_pass http://$upstream;
+        proxy_set_header Host $host;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
     location / {
         resolver 127.0.0.11 valid=30s;
         set $upstream www-ai;
         proxy_pass http://$upstream;
         proxy_set_header Host $host;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
     }
 }

nginx.conf

@@ -1,6 +1,56 @@
-events {}
+events {
+    worker_connections 1024;
+}
 
 http {
+    # --- 基础 IO 优化 ---
+    sendfile        on;
+    tcp_nopush      on;
+    tcp_nodelay     on;
+
+    # --- Keepalive ---
+    keepalive_timeout  65;
+    keepalive_requests 1000;
+
+    # --- 客户端超时（防慢连接拖死 worker）---
+    client_max_body_size      16m;
+    client_body_buffer_size   128k;
+    client_header_buffer_size 1k;
+    large_client_header_buffers 4 8k;
+    client_body_timeout       30s;
+    client_header_timeout     30s;
+    send_timeout              30s;
+
+    # --- 反代默认参数（各 conf.d 可按需覆盖）---
+    proxy_http_version 1.1;
+    proxy_set_header   Host $host;
+    proxy_set_header   X-Real-IP $remote_addr;
+    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header   X-Forwarded-Proto $scheme;
+    proxy_set_header   Connection "";
+    proxy_connect_timeout 3s;
+    proxy_send_timeout    30s;
+    proxy_read_timeout    30s;
+    proxy_buffer_size          16k;
+    proxy_buffers              8 16k;
+    proxy_busy_buffers_size    32k;
+
+    # --- Gzip 压缩 ---
+    gzip on;
+    gzip_min_length 1k;
+    gzip_comp_level 5;
+    gzip_types text/plain text/css application/json application/javascript application/xml image/svg+xml;
+    gzip_proxied any;
+    gzip_vary on;
+
+    # --- SSL 会话缓存 ---
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets on;
+
+    # --- 关闭版本号 ---
+    server_tokens off;
+
     include /etc/nginx/conf.d/*.conf;
 
     # 所有 HTTP 自动跳 HTTPS