add: nginx HTTPS config (443 ssl, http→https redirect)

nginx_gaokao.conf

@@ -0,0 +1,74 @@
+# HTTPS server
+server {
+    listen 443 ssl;
+    server_name zszs.site;
+
+    ssl_certificate /etc/nginx/ssl/zszs.site/zszs.site.crt;
+    ssl_certificate_key /etc/nginx/ssl/zszs.site/zszs.site.key;
+    ssl_trusted_certificate /etc/nginx/ssl/zszs.site/root_bundle.crt;
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_tickets off;
+
+    # Security Headers
+    add_header Strict-Transport-Security "max-age=63072000" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    location /.well-known/acme-challenge/ {
+        root /www/wwwroot/gaokao;
+    }
+
+    location / {
+        root /www/wwwroot/gaokao;
+        index index.html;
+        try_files $uri $uri/ /index.html;
+    }
+
+    location /ai-chat {
+        proxy_pass http://127.0.0.1:8080/chat;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_read_timeout 150s;
+    }
+
+    location /chat {
+        proxy_pass http://127.0.0.1:8080/chat;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_read_timeout 150s;
+    }
+
+    location /ai-tool-chat {
+        proxy_pass http://127.0.0.1:8080/ai-tool-chat;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_read_timeout 150s;
+    }
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:8080/api/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_read_timeout 150s;
+    }
+
+    location /health {
+        proxy_pass http://127.0.0.1:8080/health;
+        proxy_set_header Host $host;
+    }
+}
+
+# HTTP → HTTPS
+server {
+    listen 80;
+    server_name zszs.site www.zszs.site;
+    location /.well-known/acme-challenge/ {
+        root /www/wwwroot/gaokao;
+    }
+    location / {
+        return 301 https://zszs.site$request_uri;
+    }
+}