server {
    server_name zhangpu.tech;
    client_max_body_size 100M;
    location /static/ { alias /opt/tpanel/frontend/; }
    # SSE 任务进度流（v1.3.12 修复"连接断开"）：默认 proxy_read_timeout 60s 会主动断
    location ~ ^/api/tasks/[0-9]+/stream$ {
        proxy_pass http://127.0.0.1:8888;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 1800s;
        proxy_send_timeout 1800s;
        proxy_buffering off;
        proxy_cache off;
        add_header X-Accel-Buffering no;
    }
    # v1.3.34+: phpMyAdmin 通过 /pma/ 路径访问（同域名 SSL,免8443端口）
    # 用 rewrite 把 /pma/X 改成内部 /pma/X 然后 alias 指向 PMA 根目录
    location /pma/ {
        # v1.3.34 修复：用 alias + 不带 rewrite（alias 与 rewrite 互斥）
        # nginx 会自动把 /pma/X 映射到 /usr/share/phpmyadmin/X
        alias /usr/share/phpmyadmin/;
        index index.php;
        # 安全加固
        location ~ ^/pma/(libraries|setup/frames|sql) { deny all; return 403; }
        # PHP 处理
        location ~ \.php$ {
            include fastcgi_params;
            fastcgi_pass 127.0.0.1:9000;
            fastcgi_index index.php;
            # 注意：$request_filename 已经包含 alias 解析后的真实路径
            fastcgi_param SCRIPT_FILENAME $request_filename;
            fastcgi_read_timeout 300;
        }
    }
    location / {
        proxy_pass http://127.0.0.1:8888;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/zhangpu.tech/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/zhangpu.tech/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}
server {
    if ($host = zhangpu.tech) { return 301 https://$host$request_uri; }
    listen 80;
    server_name zhangpu.tech;
    return 404;
}