4nk/lecoffre_node
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(nginx): add security headers and static cache rules

Browse Source
This commit is contained in:
Nicolas Cantu 2025-09-16 15:56:50 +00:00
parent a360dce567
commit 9d4189927d
1 changed files with 41 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
conf/nginx/dev4.4nkweb.com-https.conf
View File

@ -11,6 +11,15 @@ server {
ssl_certificate /etc/letsencrypt/live/dev4.4nkweb.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/dev4.4nkweb.com/privkey.pem;
# Security headers (basic hardening)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
# Minimal CSP allowing Next.js static and same-origin; adjust later if needed
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' https: wss:; font-src 'self' data:" always;
# ihm_client (root)
location / {
proxy_pass http://127.0.0.1:3003;
@ -29,17 +38,42 @@ server {
expires 30d;
}
# Static assets long cache (root and /lecoffre)
location ~* ^(/_next/static/|/lecoffre/_next/static/|/.+\.(?:css|js|png|jpg|jpeg|gif|svg|ico|webp|woff2?))$ {
expires 30d;
add_header Cache-Control "public, max-age=2592000, immutable" always;
proxy_pass http://127.0.0.1:3000$request_uri;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https;
proxy_read_timeout 300;
}
# lecoffre-front
location /lecoffre/ {
proxy_pass http://127.0.0.1:3000/;
include /etc/nginx/proxy_params;
# Sub-filter to ensure assets/links are prefixed with /lecoffre
proxy_set_header Accept-Encoding "";
sub_filter_types text/html application/javascript text/css;
sub_filter_once off;
sub_filter 'href="/' 'href="/lecoffre/';
sub_filter 'src="/' 'src="/lecoffre/';
sub_filter 'content="/' 'content="/lecoffre/';
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Prefix /lecoffre;
proxy_read_timeout 300;
}
# Next.js assets and HMR under basePath
location /lecoffre/_next/webpack-hmr {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https;
proxy_buffering off;
proxy_pass http://127.0.0.1:3000/_next/webpack-hmr;
proxy_read_timeout 600s;
}
location /lecoffre/_next/ {
proxy_pass http://127.0.0.1:3000/_next/;
include /etc/nginx/proxy_params;
proxy_read_timeout 300;
}