# k3s 方案 A：仅静态 SPA。API 由浏览器按域名直连（prod: api.ideship.com / test: api.test.ideship.com）。
server {
    listen 80;
    server_name _;

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml image/svg+xml;

    root /usr/share/nginx/html;

    location = / {
        # 官网优先；缺失时回退 SPA，避免 readiness 探针 404
        try_files /site/index.html /index.html =404;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Pragma "no-cache";
        add_header Expires "0";
    }

    location = /9610.html {
        try_files /9610.html =404;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
    }

    location = /site {
        return 301 /;
    }
    location = /site/ {
        return 301 /;
    }
    location = /site/index.html {
        return 301 /;
    }

    location ^~ /site/ {
        try_files $uri =404;
        expires 7d;
        add_header Cache-Control "public";
        access_log off;
    }

    location = /favicon.ico {
        try_files /favicon.png =404;
        expires 7d;
        add_header Cache-Control "public";
        access_log off;
    }

    location = /favicon.png {
        try_files /favicon.png =404;
        expires 7d;
        add_header Cache-Control "public";
        access_log off;
    }

    location = /login {
        try_files $uri @spa;
    }
    location = /login/ {
        try_files $uri @spa;
    }

    rewrite ^/admin/?$ /index.html last;

    location = /admin {
        try_files $uri @spa;
    }
    location = /admin/ {
        try_files $uri @spa;
    }

    location ~ ^/api/(upstreamInterface|upstreamInterfaceConfig|upstreamInterfaceConfigEdit|downstreamInterface(|/newPort)|appList(|/createApplication)|requestLog|callStatistics|apiDebugger|apiTest)(/|$) {
        try_files $uri @spa;
    }

    location ^~ /xhs/startService { try_files $uri @spa; }
    location ^~ /xhs/creation { try_files $uri @spa; }
    location ^~ /xhs/publishHistory { try_files $uri @spa; }
    location ^~ /xhs/skills { try_files $uri @spa; }
    location ^~ /xhs/humanSettings { try_files $uri @spa; }
    location ^~ /xhs/agentPair { try_files $uri @spa; }
    location = /xhs/analysis { try_files $uri @spa; }
    location = /xhs/analysis/ { try_files $uri @spa; }

    location ^~ /wechat/register { try_files $uri @spa; }
    location ^~ /wechat/bind { try_files $uri @spa; }
    location ^~ /h5 { try_files $uri @spa; }
    location ^~ /track/query { try_files $uri @spa; }
    location ^~ /operation/inboundScan { try_files $uri @spa; }
    location ^~ /operation/outboundScan { try_files $uri @spa; }
    location ^~ /operation/printLabel { try_files $uri @spa; }
    location ^~ /operation/parcelArrival { try_files $uri @spa; }
    location ^~ /operation/fulfillPack { try_files $uri @spa; }

    # 订单前端路由（^~ 须比下方 /order/ API 正则代理更优先）
    location ^~ /order/priceCheck { try_files $uri @spa; }
    location ^~ /order/placeOrder { try_files $uri @spa; }
    location ^~ /order/myOrders { try_files $uri @spa; }
    location ^~ /order/fulfillOrders { try_files $uri @spa; }
    location ^~ /order/waybillManage { try_files $uri @spa; }
    location ^~ /order/pickupOrder { try_files $uri @spa; }
    location ^~ /order/customs9610Order { try_files $uri @spa; }
    location ^~ /order/batchJobs { try_files $uri @spa; }
    location ^~ /order/templateMapping { try_files $uri @spa; }
    location ^~ /order/platformStore { try_files $uri @spa; }
    location ^~ /order/platformStoreOrder { try_files $uri @spa; }

    # 知识库前端路由（^~ 须比下方 /kb/ API 代理更优先）
    location ^~ /kb/category { try_files $uri @spa; }
    location ^~ /kb/article { try_files $uri @spa; }

    location = /warehouse/parcel { try_files $uri @spa; }
    location = /warehouse/inventory { try_files $uri @spa; }
    location = /warehouse/sku { try_files $uri @spa; }
    location = /warehouse/binLocation { try_files $uri @spa; }
    location ^~ /warehouse/inboundNotice { try_files $uri @spa; }
    location ^~ /Plugin/ { try_files $uri @spa; }

    location ^~ /channel/salesProducts { try_files $uri @spa; }
    location ^~ /channel/serviceChannels { try_files $uri @spa; }
    location ^~ /channel/priceArea { try_files $uri @spa; }
    location ^~ /channel/blacklist { try_files $uri @spa; }
    location ^~ /channel/remoteZones { try_files $uri @spa; }
    location ^~ /channel/weightRules { try_files $uri @spa; }
    location ^~ /channel/weightRounding { try_files $uri @spa; }
    location ^~ /channel/autoTrigger { try_files $uri @spa; }
    location ^~ /channel/issueTemplate { try_files $uri @spa; }
    location ^~ /channel/labelDesign { try_files $uri @spa; }

    # 营销前端路由（^~ 须比下方 /marketing/ API 正则代理更优先）
    location ^~ /marketing/memberLevel { try_files $uri @spa; }
    location ^~ /marketing/pointsRule { try_files $uri @spa; }
    location ^~ /marketing/pointsFlow { try_files $uri @spa; }
    location ^~ /marketing/couponTemplate { try_files $uri @spa; }
    location ^~ /marketing/couponGrant { try_files $uri @spa; }
    location ^~ /marketing/commissionRule { try_files $uri @spa; }
    location ^~ /marketing/commissionDetail { try_files $uri @spa; }
    location ^~ /marketing/commissionWithdraw { try_files $uri @spa; }
    location ^~ /marketing/referralTree { try_files $uri @spa; }

    # 面单 PDF 同源代理：/__cos__/<host>/<path> → https://<host>/<path>
    # 与 Vite 开发代理一致，避免浏览器直打 cos.* 触发 CORS
    location ~ ^/__cos__/([^/]+)(/.*)$ {
        set $cos_host $1;
        set $cos_uri $2;
        resolver 1.1.1.1 8.8.8.8 ipv6=off valid=300s;
        resolver_timeout 5s;
        proxy_http_version 1.1;
        proxy_ssl_server_name on;
        proxy_set_header Host $cos_host;
        proxy_set_header Authorization "";
        proxy_set_header Cookie "";
        proxy_set_header X-Real-IP "";
        proxy_pass https://$cos_host$cos_uri$is_args$args;
        proxy_connect_timeout 10s;
        proxy_read_timeout 120s;
        proxy_buffering off;
    }

    # 系统管理前端路由（^~ 须比下方 /system/ API 正则代理更优先）
    location = /system/dict { try_files $uri @spa; }
    location = /system/warehouseAddress { try_files $uri @spa; }
    location = /system/announcement { try_files $uri @spa; }
    location ^~ /system/users { try_files $uri @spa; }
    location ^~ /system/roles { try_files $uri @spa; }
    location ^~ /system/menus { try_files $uri @spa; }
    location ^~ /system/organizations { try_files $uri @spa; }
    location ^~ /system/batchEmail { try_files $uri @spa; }
    location ^~ /system/otherConfig { try_files $uri @spa; }
    location ^~ /system/aiAssistant { try_files $uri @spa; }
    location ^~ /system/aiSkills { try_files $uri @spa; }
    location ^~ /system/mcpTools { try_files $uri @spa; }
    location ^~ /system/dataPerm/ { try_files $uri @spa; }

    # SPA 回退：try_files $uri @spa 统一带 no-cache，避免部署后浏览器缓存旧 index.html
    location @spa {
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        add_header Pragma "no-cache" always;
        add_header Expires "0" always;
        try_files /index.html =404;
    }

    location = /index.html {
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        add_header Pragma "no-cache" always;
        add_header Expires "0" always;
        try_files /index.html =404;
    }

    # 微信 JS 安全域名校验：原样返回 txt，禁止 SPA 回落 index.html
    location ~* ^/MP_verify_[A-Za-z0-9]+\.txt$ {
        default_type text/plain;
        charset off;
        add_header Cache-Control "no-store";
        try_files $uri =404;
    }

    location ~* \.(?:js|css)$ {
        try_files $uri =404;
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    location / {
        try_files $uri @spa;
    }
}