user  root;
# This number should be, at maximum, the number of CPU cores on your system.
worker_processes auto;
worker_rlimit_nofile 655350;

pcre_jit on;

#error_log  logs/error.log;
pid        logs/nginx.pid;



events {
    use epoll;
    worker_connections 60000;
    multi_accept on;
}

stream {
    preread_timeout        120s;
    proxy_connect_timeout  30s;
    proxy_protocol_timeout 30s;
    proxy_buffer_size      64k;
    proxy_timeout          120s;
    tcp_nodelay            on;
    proxy_next_upstream    on;
    proxy_socket_keepalive on;

    log_format proxy '$remote_addr [$time_local] '
                  '$protocol $status $bytes_sent $bytes_received '
                  '$session_time "$upstream_addr" "$upstream_bytes_sent"'
                  '"$upstream_bytes_received" "$upstream_connect_time"';

    upstream ss {
        server shadowsocks:8388;
    }

    server {
        listen 7777;
        listen 7777 udp;
        listen [::]:7777 ipv6only=on;
        listen [::]:7777 udp ipv6only=on;
        include allow.list;
        deny all;
        proxy_pass ss;
    }
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    reset_timedout_connection on;
    client_header_timeout 15;
    client_body_timeout 10;
    send_timeout 15;
    keepalive_timeout 30;
    keepalive_requests 30;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';


    client_body_buffer_size 128k;
    client_max_body_size 10m;
    proxy_read_timeout 180s;

    gzip on;
    gzip_min_length 10240;
    gzip_proxied expired no-cache no-store private auth;
    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml;
    gzip_disable "msie6";

    sendfile on;
    tcp_nodelay on;
    tcp_nopush on;


    server_tokens off;

    error_page 404             /404.html;
    error_page 500 502 503 504 /50x.html;

    server{
        listen 80;
        listen [::]:80 ipv6only=on;

        charset utf-8;

        location  / {
            auth_basic "";
            auth_basic_user_file /etc/openresty/auth;
            add_header Content-Type text/plain;
        }

        location = /auth {
            auth_basic "";
            auth_basic_user_file /etc/openresty/auth;
            add_header Content-Type "text/plain; charset=utf-8";
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
            content_by_lua_block {
                clientIP=ngx.var.remote_addr
                headers=ngx.req.get_headers()
                file = io.open("/etc/openresty/allow.list","a+")
                io.input(file)
                io.output(file)
                for line in file:lines() do
                    if string.find(line,clientIP) then
                        m = string.find(line,clientIP)
                        ngx.print("当前IP:"..clientIP.."已存在，无需添加\n\n")
                        for k, v in pairs(headers) do
                           ngx.print(k..":"..v.."\n")
                        end
                    end
                end
                if m == nil then
                    io.write("allow "..clientIP..";\n")
                    ngx.print("当前IP:"..clientIP.."已添加至白名单")
                end
                io.close(file)
                os.execute("/usr/local/openresty/nginx/sbin/nginx -s reload")
            }
        }
        
        location = /purge {
            auth_basic "";
            auth_basic_user_file /etc/openresty/auth;
            add_header Content-Type "text/plain; charset=utf-8";
            content_by_lua_block {
                file = io.open("/etc/openresty/allow.list","w+")
                ngx.print("IP列表已被清空")
                io.close(file)
                os.execute("/usr/local/openresty/nginx/sbin/nginx -s reload")
            }
        }
    }
}
