# 安装 certbot
sudo apt install certbot python3-certbot-nginx

# 获取证书
sudo certbot --nginx -d example.com -d www.example.com

# 自动续期
sudo certbot renew --dry-run

# 设置自动续期 cron
0 0 1 * * certbot renew --quiet

# 服务器告诉浏览器：未来只能用 HTTPS 访问
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

server {
    listen 443 ssl;
    server_name example.com;
    
    # HSTS 头部
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
}

# HTTP 重定向到 HTTPS
server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

# 基础 CSP
Content-Security-Policy: default-src 'self'

# 完整 CSP
Content-Security-Policy: 
    default-src 'self';
    script-src 'self' https://cdn.example.com 'nonce-abc123';
    style-src 'self' 'unsafe-inline';
    img-src 'self' data: https:;
    font-src 'self' https://fonts.gstatic.com;
    connect-src 'self' https://api.example.com;
    frame-src 'none';
    object-src 'none';
    base-uri 'self';
    form-action 'self';
    upgrade-insecure-requests;

<!-- CSP 阻止内联脚本 -->
<script>alert('XSS')</script>  <!-- 被 CSP 阻止 -->

<!-- 使用 nonce 的安全脚本 -->
<script nonce="abc123">
    // 只有带正确 nonce 的脚本才能执行
    console.log('安全的脚本');
</script>

# 仅报告模式（不阻止）
Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-report

# 报告模式 + 执行
Content-Security-Policy: default-src 'self'; report-uri /csp-report

server {
    listen 443 ssl http2;
    server_name example.com;
    
    # TLS 配置
    ssl_certificate /etc/ssl/certs/example.pem;
    ssl_certificate_key /etc/ssl/private/example.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    
    # 安全头部
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.example.com" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
}

# 证书透明度日志
# 所有公开信任的证书都必须记录到 CT 日志
# 浏览器验证 SCT（Signed Certificate Timestamp）
Expect-CT: max-age=86400, enforce, report-uri="/ct-report"

# 安全的 Cookie 配置
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=3600

# 完整的电商网站安全配置
server {
    listen 443 ssl http2;
    server_name shop.example.com;
    
    # TLS 1.2 + 1.3
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    
    # HSTS（预加载）
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    
    # CSP（严格）
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.shop.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https://api.shop.com wss://ws.shop.com" always;
    
    # 防止点击劫持
    add_header X-Frame-Options "DENY" always;
    
    # 防止 MIME 嗅探
    add_header X-Content-Type-Options "nosniff" always;
    
    # Referrer 策略
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    
    # 功能权限
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(self)" always;
    
    # 支付页面特别配置
    location /checkout {
        # 更严格的 CSP
        add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; form-action 'self'; frame-ancestors 'none'" always;
    }
}