if ($http_user_agent !~* "(Windows\ NT\ 5.1;Windows\ NT\ 5.2)|BaiduSpider|360Spider|YisouSpider") {
rewrite ^(.*)$ https://$host$1 permanent;
}

if ($http_user_agent ~* "(Windows\ NT\ 5.1;Windows\ NT\ 5.2)|BaiduSpider|360Spider|YisouSpider") {
rewrite ^(.*)$ http://$host$1 permanent;
}

http {
### TCP 优化
sendfile on;
tcp_nopush on;
tcp_nodelay on;

keepalive_timeout 60;


### 开启 Gzip
gzip on;
gzip_vary on;

gzip_comp_level 6;
gzip_buffers 16 8k;

gzip_min_length 1000;
gzip_proxied any;
gzip_disable "msie6";

gzip_http_version 1.0;

gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;


### 开启缓存
# 定义服务端缓存目录和属性值
proxy_cache_path /home/jerry/cache/nginx/proxy_cache_path levels=1:2 keys_zone=pnc:300m inactive=7d max_size=10g;
proxy_temp_path /home/jerry/cache/nginx/proxy_temp_path;
proxy_cache_key $host$uri$is_args$args;

server {

location / {
resolver 127.0.0.1;
proxy_cache pnc;
proxy_cache_valid 200 304 2h; # 服务端缓存：状态值等于 200 和 304 的响应缓存 2 小时
proxy_cache_lock on;
proxy_cache_lock_timeout 5s;
proxy_cache_use_stale updating error timeout invalid_header http_500 http_502;

proxy_http_version 1.1;

proxy_ignore_headers Set-Cookie; # 移除 Set-Cookie
... ...
}

# 客户端缓存：开启 etag 、设置 expires 为最大值
location ~ ^/static/ {
root /home/jerry/www/blog/www;
etag on;
expires max;
}

### HTTPS 优化
## 缓存 TLS 会话供后续连接使用：简化 TLS 握手
ssl_session_cache shared:SSL:10m; # session_cache 缓存方式
ssl_session_timeout 60m;

ssl_session_tickets on; # session_tickets 缓存方式

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /xxx/full_chain.crt;

resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;

# 配置 OCSP stapling 策略：让浏览器跳过在线验证证书有效性，用服务端获取 OCSP 同时更好地缓存
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /xxx/full_chain.crt;

resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;

### 使用 HTTP/2
listen 443 ssl http2 fastopen=3 reuseport; # 限制 fastopen 为 3 减少攻击导致资源耗尽（仅支持Kernel3.7以上内核）、启用 SO_REUSEPORT 监听多个 socket（每个 Worker 都能分到一个）
... ...
}
... ...
}