apiVersion: v1
kind: ConfigMap
metadata:
  name: goalfymax-admin-web-config
  namespace: goalfyagent
data:
  nginx.conf: |
    server {
        listen 80;
        server_name _;

        # 前端静态文件根目录
        root /usr/share/nginx/html;
        index index.html index.htm;

        # Gzip 压缩
        gzip on;
        gzip_vary on;
        gzip_min_length 1024;
        gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/json application/javascript;

        # 前端路由支持（SPA应用）
        location / {
            try_files $uri $uri/ /index.html;
        }

        # 静态资源缓存
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
            expires 1y;
            add_header Cache-Control "public, immutable";
            try_files $uri =404;
        }

        # 健康检查接口
        location /health {
            access_log off;
            return 200 "healthy\n";
            add_header Content-Type text/plain;
        }

        # 安全头设置
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;

        # 隐藏 nginx 版本
        server_tokens off;
    }