Page History

#user  nobody;
worker_processes  1;

#error_log#  logs/error.log;
#error_log  logs/error.log  notice;Расширенный лог для отладки
#error_log  logs/error.log  info; 

#pidevents {
       logs/nginx.pid;


events {
    workerworker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format sendfile main  '$remote_addr - $remote_user [$time_local] "$request" 'on;
    # client_max_body_size 20G;
    
    # КРИТИЧНО: Увеличиваем буферы для тяжелых Kerberos-тикетов
   '$status $bodylarge_client_bytes_sent "$http_referer" 'header_buffers 4 64k;
    proxy_buffer_size   128k;
    #proxy_buffers   4 256k;
    proxy_busy_buffers_size   256k;

    # Поддержка  '"$http_user_agent" "$http_x_forwarded_for"';
постоянных соединений с браузером
    #access_log  logs/access.log  mainkeepalive_timeout  300s;
    keepalive_requests 1000;

    sendfile# 1. Настройка Upstream с Keep-Alive (обязательно  on;
для Negotiate/NTLM)
    upstream #tcpvitros_nopushbackend {
    on;

    #keepalive_timeout  0;
server 127.0.0.1:4615;
        keepalive_timeout 64; 
    65;}

    # Редирект с #gzipHTTP на on;

HTTPS
    server {
        listen 80 default_server;
		server_name vitro.example.ru;
          listen [::]:80 default_server;
        client_max_body_size 100000M;
        
        proxy_http_versionserver_name dev-vs.vitro.dev;

        if ( $host  1.1;
		proxy_pass_request_headers on;
		proxy_pass_request_body!= "dev-vs.vitro.dev" ){
    on;           

		proxy_buffer_size   1Mreturn 444;
        proxy_buffers   4 1M;
}

        return 301 proxy_read_timeout 1hhttps://$host$request_uri;
    }

    # proxy_send_timeout 1h; 
Основной SSL сервер
        location /server {
        listen 443 ssl default_server;
     #proxying traffic to upstream application (Vitro.Server.Core.Web)
  listen [::]:443 ssl default_server;
        server_name dev-vs.vitro.dev;

        proxy_pass http://127.0.0.1:4615;
				proxy_set_header X-Real-IP $remote_addr;
				proxy_set_headerssl_certificate     C:/nginx/conf/ssl/dev-vs.vitro.dev.crt;
        ssl_certificate_key C:/nginx/conf/ssl/dev-vs.vitro.dev.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        
 X-Forwarded-For     $proxy_add_x_forwarded_for;
				proxy_set_header      # Оптимизация SSL для Windows
     X-Forwarded-Proto   $scheme;
				proxy_set_header Host $host;         
		}
 
  ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;

       location /workflow/manager {
    if ( $host != "dev-vs.vitro.dev" ){
            proxy_pass http://localhost:4616/workflow/managerreturn 444;
        }

          
	}
}# Общие настройки проксирования для Windows Auth
        proxy_http_version 1.1;
        proxy_pass_request_headers on;
        proxy_pass_request_body    on;
        proxy_read_timeout 1h;
        proxy_send_timeout 1h;

        location / {
            # 2. Используем upstream
            proxy_pass http://vitros_backend;

            # 3. КРИТИЧНО: Отключаем буферизацию для трансляции NTLM-рукопожатия
            proxy_buffering off;
            proxy_request_buffering off;

            # 4. Сбрасываем заголовок Connection для работы Keep-Alive до бэкенда
            proxy_set_header Connection ""; 
            
            # 5. Проброс заголовков
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            # Для поддержки WebSockets
            proxy_set_header Upgrade $http_upgrade;
            # proxy_set_header Connection "upgrade"; # Раскомментируйте, если нужны только сокеты
        }

        location /workflow/manager {
            proxy_pass http://localhost:4616/workflow/manager;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_buffering off;
            proxy_set_header Host $host;
        }	
    }
}