diff --git a/app/nginx/nginx.conf.example b/app/nginx/nginx.conf.example new file mode 100644 index 0000000..4d20d77 --- /dev/null +++ b/app/nginx/nginx.conf.example @@ -0,0 +1,282 @@ +# Teknav production nginx — native systemd starter template. +# Install as /etc/nginx/sites-available/teknav and symlink to sites-enabled. + +# Rate limits — generous by default. Tighten if you see abuse. +limit_req_zone $binary_remote_addr zone=general:10m rate=300r/m; +limit_req_zone $binary_remote_addr zone=api:10m rate=300r/m; +limit_req_zone $binary_remote_addr zone=auth:10m rate=30r/m; + +# ── HTTP → HTTPS redirect ─────────────────────────────────────────────────── +server { + listen 80; + listen [::]:80; + server_name teknav.ir www.teknav.ir; + server_tokens off; + return 301 https://www.teknav.ir$request_uri; +} + +# ── HTTPS vhost ───────────────────────────────────────────────────────────── +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name teknav.ir www.teknav.ir; + + if ($host = teknav.ir) { + return 301 https://www.teknav.ir$request_uri; + } + + # TLS — ssl-certs/ mounted at /etc/nginx/ssl (read-only). + ssl_certificate /etc/nginx/ssl/_.teknav.ir-fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/_.teknav.ir-privateKey.pem; + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers off; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305; + + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 1d; + ssl_session_tickets off; + + ssl_stapling on; + ssl_stapling_verify on; + resolver 1.1.1.1 8.8.8.8 valid=300s; + resolver_timeout 5s; + + server_tokens off; + + root /opt/teknav/current/dist; + index index.html; + charset utf-8; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + + client_max_body_size 12m; + client_body_timeout 30s; + client_header_timeout 30s; + send_timeout 30s; + keepalive_timeout 65s; + reset_timedout_connection on; + + # Compression + gzip on; + gzip_static on; + # Serve pre-compressed *.br alongside *.gz at server scope so /assets/ (JS, CSS, + # icon SVGs), /fonts/, and HTML inherit it — not just the per-location blocks below. + brotli_static on; + gzip_vary on; + gzip_proxied expired no-cache no-store private auth; + gzip_comp_level 6; + gzip_buffers 16 8k; + gzip_http_version 1.1; + gzip_min_length 512; + gzip_types + text/plain + text/css + text/xml + text/javascript + application/javascript + application/x-javascript + application/json + application/ld+json + application/manifest+json + application/rss+xml + application/atom+xml + application/xml + image/svg+xml + font/ttf + font/otf + font/woff + font/woff2; + + # ── HSTS (1 week — extend to 1 year after you're confident) ───────────── + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + + # ── Security headers ───────────────────────────────────────────────────── + add_header X-Content-Type-Options "nosniff" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; + # CSP — self-only. 'unsafe-inline' on style-src required by Vite CSS-in-JS. + add_header Content-Security-Policy + "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self';" + always; + + # Block dotfiles (.git, .env, etc.) + location ~ /\. { + deny all; + return 404; + } + + # Block operator-only credential notes even if copied beside the app. + location = /ACCOUNTS.md { + deny all; + return 404; + } + + # Static assets — immutable far-future cache. + location /assets/ { + access_log off; + add_header Cache-Control "public, max-age=31536000, immutable"; + try_files $uri =404; + } + location /fonts/ { + access_log off; + add_header Cache-Control "public, max-age=31536000, immutable"; + try_files $uri =404; + } + location = /favicon.png { + access_log off; + add_header Cache-Control "public, max-age=2592000"; + } + location = /robots.txt { + access_log off; + add_header Cache-Control "public, max-age=3600"; + try_files $uri =404; + } + location = /sitemap.xml { + access_log off; + add_header Cache-Control "public, max-age=3600"; + try_files $uri =404; + } + location = /feed.xml { + access_log off; + add_header Cache-Control "public, max-age=3600"; + try_files $uri =404; + } + + # embed.html served with frame-ancestors * so widgets can be iframed cross-origin. + # Exact match ensures correct headers survive nginx's internal try_files redirect. + location = /embed.html { + add_header X-Content-Type-Options "nosniff" always; + add_header Content-Security-Policy "frame-ancestors *;" always; + add_header Cache-Control "no-cache" always; + try_files $uri =404; + } + + # Embed widgets — allow cross-origin framing, serve embed.html as SPA fallback + location /embed/ { + limit_req zone=general burst=200 nodelay; + gzip_static on; + brotli_static on; + add_header X-Content-Type-Options "nosniff" always; + add_header Content-Security-Policy "frame-ancestors *;" always; + add_header Cache-Control "no-cache" always; + try_files $uri $uri/ /embed.html; + } + + # Phase 15: Web Stories, Comparison pages, Tech Directory — pre-rendered static dirs + location ~ ^/(stories|compare|directory)/([^/]+?)/?$ { + gzip_static on; + brotli_static on; + try_files /$1/$2/index.html /index.html; + } + + # Phase 15: listing pages for stories, compare, directory + location ~ ^/(stories|compare|directory)/?$ { + gzip_static on; + brotli_static on; + try_files /$1/index.html /index.html; + } + + # SPA fallback + location / { + limit_req zone=general burst=200 nodelay; + try_files $uri $uri/ /index.html; + add_header Cache-Control "no-cache"; + } + + # Auth endpoints — tighter rate limit + location /api/v1/auth/login { + limit_req zone=auth burst=10 nodelay; + proxy_pass http://127.0.0.1:3010; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Connection ""; + proxy_read_timeout 30s; + proxy_hide_header Server; + proxy_hide_header X-Powered-By; + } + + location /api/v1/auth/signup { + limit_req zone=auth burst=10 nodelay; + proxy_pass http://127.0.0.1:3010; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Connection ""; + proxy_read_timeout 30s; + proxy_hide_header Server; + proxy_hide_header X-Powered-By; + } + + # SSE streams: disable buffering/compression so events arrive immediately. + location ~ ^/api/(admin/stream|auth/notifications/stream)$ { + limit_req zone=api burst=200 nodelay; + proxy_pass http://127.0.0.1:3010; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Connection ""; + proxy_read_timeout 1h; + proxy_send_timeout 1h; + proxy_buffering off; + proxy_cache off; + gzip off; + proxy_hide_header Server; + proxy_hide_header X-Powered-By; + } + + # General API + location /api/ { + limit_req zone=api burst=200 nodelay; + proxy_pass http://127.0.0.1:3010; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Connection ""; + proxy_read_timeout 60s; + proxy_connect_timeout 10s; + proxy_buffering on; + proxy_buffer_size 16k; + proxy_buffers 4 64k; + proxy_hide_header Server; + proxy_hide_header X-Powered-By; + } + + # Uploaded files + location /uploads/ { + access_log off; + alias /var/lib/teknav/uploads/; + add_header Cache-Control "public, max-age=2592000"; + location ~* \.(php|html|htm|js|jsx|ts|sh|py|env|conf)$ { + deny all; + return 404; + } + try_files $uri =404; + } + + # 404 → SPA; API errors pass through. + error_page 404 /index.html; + error_page 429 @rate_limited; + error_page 500 502 503 504 @upstream_error; + + location @rate_limited { + default_type application/json; + return 429 '{"error":"too_many_requests","retryAfter":60}'; + } + location @upstream_error { + default_type application/json; + return 502 '{"error":"service_unavailable"}'; + } +}