129 lines
4.7 KiB
Nginx Configuration File
129 lines
4.7 KiB
Nginx Configuration File
# Cipher Barcode Studio — hardened nginx configuration
|
|
# Static-only site, no upstream, no PHP, no dynamic code. Read-only filesystem.
|
|
|
|
worker_processes auto;
|
|
pid /tmp/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# Temp paths in /tmp so we can run as a non-root user with a read-only rootfs
|
|
client_body_temp_path /tmp/client_body;
|
|
proxy_temp_path /tmp/proxy;
|
|
fastcgi_temp_path /tmp/fastcgi;
|
|
uwsgi_temp_path /tmp/uwsgi;
|
|
scgi_temp_path /tmp/scgi;
|
|
|
|
# Logging
|
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent"';
|
|
access_log /var/log/nginx/access.log main;
|
|
error_log /var/log/nginx/error.log warn;
|
|
|
|
# Performance
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout 30;
|
|
server_tokens off; # hide nginx version
|
|
|
|
# Limits — this is a static-only site, so cap request size strictly
|
|
client_max_body_size 1k;
|
|
client_body_buffer_size 1k;
|
|
client_header_buffer_size 1k;
|
|
large_client_header_buffers 2 4k;
|
|
|
|
# Compression
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_proxied any;
|
|
gzip_comp_level 6;
|
|
gzip_min_length 256;
|
|
gzip_types
|
|
text/plain
|
|
text/css
|
|
text/javascript
|
|
application/javascript
|
|
application/json
|
|
image/svg+xml
|
|
font/woff2;
|
|
|
|
server {
|
|
listen 8080 default_server;
|
|
listen [::]:8080 default_server;
|
|
server_name _;
|
|
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# ---------- Security headers ----------
|
|
# Static-only site: tight CSP. Inline styles/scripts are unavoidable
|
|
# because the app is one self-contained HTML file, but external scripts
|
|
# are restricted to 'self' and validated with SRI in the markup.
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;
|
|
|
|
# Block framing entirely (defense-in-depth alongside CSP frame-ancestors)
|
|
add_header X-Frame-Options "DENY" always;
|
|
|
|
# Stop MIME-type sniffing
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
# Disable unused browser features
|
|
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=(), payment=(), usb=()" always;
|
|
|
|
# Don't leak referrer to third-party fonts
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
# HSTS — only meaningful behind HTTPS; harmless on HTTP
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
# Cross-origin isolation
|
|
add_header Cross-Origin-Opener-Policy "same-origin" always;
|
|
add_header Cross-Origin-Resource-Policy "same-origin" always;
|
|
|
|
# ---------- Routes ----------
|
|
# Hash-able vendor assets get long-lived caches
|
|
location /vendor/ {
|
|
add_header Cache-Control "public, max-age=2592000, immutable" always;
|
|
# Re-apply security headers (add_header doesn't inherit across location blocks)
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
try_files $uri =404;
|
|
}
|
|
|
|
# The main HTML — short cache so updates roll out
|
|
location = / {
|
|
add_header Cache-Control "public, max-age=300, must-revalidate" always;
|
|
try_files /index.html =404;
|
|
}
|
|
|
|
# Healthcheck endpoint for docker / orchestrators
|
|
location = /healthz {
|
|
access_log off;
|
|
add_header Content-Type text/plain;
|
|
return 200 "ok\n";
|
|
}
|
|
|
|
# Block hidden files and common sensitive paths
|
|
location ~ /\. {
|
|
deny all;
|
|
return 404;
|
|
}
|
|
|
|
location / {
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
|
|
# Custom error pages
|
|
error_page 404 /index.html;
|
|
error_page 500 502 503 504 /index.html;
|
|
}
|
|
}
|