v3

2026-09-13 20:05:01 +01:00
commit 51d6d76b53
12 changed files with 1559 additions and 0 deletions
@@ -0,0 +1,128 @@
+# Cipher Barcode Studio — hardened nginx configuration
+# Static-only site, no upstream, no PHP, no dynamic code. Read-only filesystem.
+
+worker_processes auto;
+pid /tmp/nginx.pid;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    # Temp paths in /tmp so we can run as a non-root user with a read-only rootfs
+    client_body_temp_path  /tmp/client_body;
+    proxy_temp_path        /tmp/proxy;
+    fastcgi_temp_path      /tmp/fastcgi;
+    uwsgi_temp_path        /tmp/uwsgi;
+    scgi_temp_path         /tmp/scgi;
+
+    # Logging
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent"';
+    access_log /var/log/nginx/access.log main;
+    error_log  /var/log/nginx/error.log warn;
+
+    # Performance
+    sendfile           on;
+    tcp_nopush         on;
+    tcp_nodelay        on;
+    keepalive_timeout  30;
+    server_tokens      off;   # hide nginx version
+
+    # Limits — this is a static-only site, so cap request size strictly
+    client_max_body_size       1k;
+    client_body_buffer_size    1k;
+    client_header_buffer_size  1k;
+    large_client_header_buffers 2 4k;
+
+    # Compression
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 256;
+    gzip_types
+        text/plain
+        text/css
+        text/javascript
+        application/javascript
+        application/json
+        image/svg+xml
+        font/woff2;
+
+    server {
+        listen       8080 default_server;
+        listen       [::]:8080 default_server;
+        server_name  _;
+
+        root   /usr/share/nginx/html;
+        index  index.html;
+
+        # ---------- Security headers ----------
+        # Static-only site: tight CSP. Inline styles/scripts are unavoidable
+        # because the app is one self-contained HTML file, but external scripts
+        # are restricted to 'self' and validated with SRI in the markup.
+        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;
+
+        # Block framing entirely (defense-in-depth alongside CSP frame-ancestors)
+        add_header X-Frame-Options "DENY" always;
+
+        # Stop MIME-type sniffing
+        add_header X-Content-Type-Options "nosniff" always;
+
+        # Disable unused browser features
+        add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=(), payment=(), usb=()" always;
+
+        # Don't leak referrer to third-party fonts
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+        # HSTS — only meaningful behind HTTPS; harmless on HTTP
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+        # Cross-origin isolation
+        add_header Cross-Origin-Opener-Policy "same-origin" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+
+        # ---------- Routes ----------
+        # Hash-able vendor assets get long-lived caches
+        location /vendor/ {
+            add_header Cache-Control "public, max-age=2592000, immutable" always;
+            # Re-apply security headers (add_header doesn't inherit across location blocks)
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header X-Frame-Options "DENY" always;
+            try_files $uri =404;
+        }
+
+        # The main HTML — short cache so updates roll out
+        location = / {
+            add_header Cache-Control "public, max-age=300, must-revalidate" always;
+            try_files /index.html =404;
+        }
+
+        # Healthcheck endpoint for docker / orchestrators
+        location = /healthz {
+            access_log off;
+            add_header Content-Type text/plain;
+            return 200 "ok\n";
+        }
+
+        # Block hidden files and common sensitive paths
+        location ~ /\. {
+            deny all;
+            return 404;
+        }
+
+        location / {
+            try_files $uri $uri/ =404;
+        }
+
+        # Custom error pages
+        error_page 404 /index.html;
+        error_page 500 502 503 504 /index.html;
+    }
+}