sub2api nginx配置如何再优化

现在使用的是nginx反代docker容器里的sub2api，首字时间较长，找ai优化了一版本感觉还是没用，有没有佬看看配置怎么再改改比较好



nginx.conf

user nginx;

worker_processes auto;

error_log /var/log/nginx/error.log warn;

pid       /var/run/nginx.pid;



events {

    worker_connections 1024;

}



http {

    include       /etc/nginx/mime.types;

    default_type  application/octet-stream;

    #rt：Nginx 总请求耗时。

    #urt：上游应用响应耗时。

    #uaddr：实际代理到的上游地址。

    #cf：Cloudflare Ray ID，方便关联 Cloudflare 请求。

    log_format main '$remote_addr - $remote_user [$time_local] '

            '"$host" "$request" '

            '$status $body_bytes_sent "$http_referer" '

            '"$http_user_agent" "$http_x_forwarded_for" '

            'rt=$request_time '

            'urt=$upstream_response_time '

            'uaddr=$upstream_addr '

            'cache="$upstream_cache_status" '

            'cf="$http_cf_ray"';



    access_log /var/log/nginx/access.log main;

    sendfile        on;

    keepalive_timeout 65;

    client_max_body_size 100m;

    client_body_buffer_size 256k;

    proxy_buffer_size 128k;

    proxy_buffers 4 256k;

    proxy_busy_buffers_size 256k;



    # ========================================

    # 安全配置

    # ========================================



    # 隐藏 nginx 版本号

    server_tokens off;



    # 安全响应头

    #add_header X-Frame-Options "SAMEORIGIN" always;

    add_header X-Content-Type-Options "nosniff" always;

    add_header X-XSS-Protection "1; mode=block" always;

    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;



    # HSTS - 强制 HTTPS（开启前确保所有站点 HTTPS 正常，取消注释即可启用）

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;



    # 请求速率限制（每 IP 每秒 10 个请求，突发允许 20）

    #limit_req_zone $binary_remote_addr zone=req_limit:10m rate=10r/s;



    # 连接数限制（每 IP 最多 50 个并发连接）

    #limit_conn_zone $binary_remote_addr zone=conn_limit:10m;



    # ========================================

    # 性能配置

    # ========================================



    # Gzip

    gzip on;

    gzip_vary on;

    gzip_min_length 1024;

    gzip_types text/plain text/css application/json application/javascript text/xml;



    # SSL 全局优化

    ssl_protocols TLSv1.2 TLSv1.3;

    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

    ssl_prefer_server_ciphers off;

    ssl_session_cache shared:SSL:10m;

    ssl_session_timeout 1d;

    ssl_session_tickets off;



    # Cloudflare 真实 IP 还原

    set_real_ip_from 173.245.48.0/20;

    set_real_ip_from 103.21.244.0/22;

    set_real_ip_from 103.22.200.0/22;

    set_real_ip_from 103.31.4.0/22;

    set_real_ip_from 141.101.64.0/18;

    set_real_ip_from 108.162.192.0/18;

    set_real_ip_from 190.93.240.0/20;

    set_real_ip_from 188.114.96.0/20;

    set_real_ip_from 197.234.240.0/22;

    set_real_ip_from 198.41.128.0/17;

    set_real_ip_from 162.158.0.0/15;

    set_real_ip_from 104.16.0.0/13;

    set_real_ip_from 104.24.0.0/14;

    set_real_ip_from 172.64.0.0/13;

    set_real_ip_from 131.0.72.0/22;

    real_ip_header CF-Connecting-IP;



    resolver_timeout 5s;



    # 加载所有独立站点配置

    include /etc/nginx/conf.d/*.conf;

}

sub.conf

upstream sub2api_backend {

    zone sub2api_backend 64k;

    resolver 127.0.0.11 valid=10s ipv6=off;

    server sub2api:8080 resolve;

    keepalive 32;

}



server {

    listen 80;

    server_name sub.xx.xx;

    return 301 https://$host$request_uri;

}



server {

    listen 443 ssl;

    http2 on;

    server_name sub.xx.xx;



    ssl_certificate     /etc/nginx/ssl/sub.xx.xx/fullchain.pem;

    ssl_certificate_key /etc/nginx/ssl/sub.xx.xx/privkey.pem;



    # 静态资源缓存：适合 Vite/React 这类 hash 文件

    location ^~ /assets/ {

        proxy_pass http://sub2api_backend;

        proxy_http_version 1.1;

        proxy_set_header Connection "";



        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto $scheme;



        proxy_hide_header Cache-Control;

        proxy_hide_header Expires;

        add_header Cache-Control "public, max-age=31536000, immutable" always;

    }



    # logo 如果稳定不常变，也可以缓存；如果经常换，就不要设太长

    location = /logo.png {

        proxy_pass http://sub2api_backend;

        proxy_http_version 1.1;

        proxy_set_header Connection "";



        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto $scheme;



        proxy_hide_header Cache-Control;

        proxy_hide_header Expires;

        add_header Cache-Control "public, max-age=604800" always;

    }

    

    # 无 /v1 前缀的模型 API，兼容 Codex Desktop 等客户端

    location ~ ^/(responses|messages|chat/completions|completions|embeddings|files|uploads|batches)(/.*)?$ {

        proxy_pass http://sub2api_backend;

        proxy_http_version 1.1;

        proxy_set_header Connection "";



        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto $scheme;



        proxy_buffering off;

        proxy_cache off;

        proxy_request_buffering off;

        chunked_transfer_encoding on;



        proxy_read_timeout 300s;

        proxy_send_timeout 300s;

    }



    # 流式模型接口：保持关闭 buffering

    location ^~ /v1/ {

        proxy_pass http://sub2api_backend;

        proxy_http_version 1.1;

        proxy_set_header Connection "";



        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto $scheme;



        proxy_buffering off;

        proxy_cache off;

        proxy_request_buffering off;

        chunked_transfer_encoding on;

        proxy_read_timeout 300s;

        proxy_send_timeout 300s;

    }



    # 其他普通网页和 API

    location / {

        proxy_pass http://sub2api_backend;

        proxy_http_version 1.1;

        proxy_set_header Connection "";



        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto $scheme;



        proxy_read_timeout 120s;

        proxy_send_timeout 120s;

    }

}