worker_processes  1;
error_log  logs/error.log debug;
pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile      on;
    keepalive_timeout  65;

    # 国密 HTTPS 服务 - 单向认证
    server {
        listen       8443 ssl;
        server_name  localhost;

        ssl_certificate     /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-cert.pem;
        ssl_certificate_key /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-key.pem;

        # 国密套件优先
        ssl_ciphers ECDHE-SM2-SM4-GCM-SM3:ECDHE-SM2-SM4-CBC-SM3:TLS_SM4_GCM_SM3:TLS_SM4_CCM_SM3:HIGH:!aNULL:!MD5;
        ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;

        location / {
            default_type text/plain;
            return 200 "GMSSL One-Way Auth OK!\nHost: $host\nCipher: $ssl_cipher\nProtocol: $ssl_protocol\n";
        }
    }

    # 国密 HTTPS 服务 - 双向认证
    server {
        listen       9443 ssl;
        server_name  localhost;

        ssl_certificate     /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-cert.pem;
        ssl_certificate_key /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-key.pem;

        ssl_ciphers ECDHE-SM2-SM4-GCM-SM3:ECDHE-SM2-SM4-CBC-SM3:TLS_SM4_GCM_SM3:TLS_SM4_CCM_SM3:HIGH:!aNULL:!MD5;
        ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;

        # 双向认证
        ssl_verify_client on;
        ssl_client_certificate /mnt/d/workbench/gateway2/java-client/certs/ca-sm2-cert.pem;

        location / {
            default_type text/plain;
            return 200 "GMSSL Two-Way Auth OK!\nHost: $host\nCipher: $ssl_cipher\nProtocol: $ssl_protocol\nClient: $ssl_client_s_dn\n";
        }
    }
}

stream {
    # TCP+SSL 单向认证代理
    server {
        listen              9444 ssl;
        ssl_certificate     /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-cert.pem;
        ssl_certificate_key /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-key.pem;
        ssl_ciphers ECDHE-SM2-SM4-GCM-SM3:ECDHE-SM2-SM4-CBC-SM3:TLS_SM4_GCM_SM3:TLS_SM4_CCM_SM3:HIGH:!aNULL:!MD5;
        ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;

        proxy_pass 127.0.0.1:8080;
    }

    # TCP+SSL 双向认证代理
    server {
        listen              9445 ssl;
        ssl_certificate     /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-cert.pem;
        ssl_certificate_key /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-key.pem;
        ssl_ciphers ECDHE-SM2-SM4-GCM-SM3:ECDHE-SM2-SM4-CBC-SM3:TLS_SM4_GCM_SM3:TLS_SM4_CCM_SM3:HIGH:!aNULL:!MD5;
        ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;

        ssl_verify_client on;
        ssl_client_certificate /mnt/d/workbench/gateway2/java-client/certs/ca-sm2-cert.pem;

        proxy_pass 127.0.0.1:8080;
    }
}