eventos/nginx-ssl.conf.template at main · cafebugado/eventos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
# =============================================
# Nginx - Produção com HTTPS/TLS
# Eventos - Comunidade Café Bugado
#
# COMO USAR:
# 1. Obtenha certificados SSL (Let's Encrypt, Cloudflare, etc)
# 2. Copie este arquivo para nginx.conf
# 3. Ajuste server_name, ssl_certificate e ssl_certificate_key
# 4. Rebuild o container Docker
# =============================================

# Rate limiting
limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=static:10m rate=30r/s;

# Redirect HTTP para HTTPS
server {
    listen 80;
    server_name seu-dominio.com.br;
    server_tokens off;

    location / {
        return 301 https://$server_name$request_uri;
    }

    # Manter health check acessível via HTTP
    location = /health {
        access_log off;
        return 200 'OK';
        add_header Content-Type text/plain;
    }
}

# HTTPS Server
server {
    listen 443 ssl http2;
    server_name seu-dominio.com.br;
    root /usr/share/nginx/html;
    index index.html;

    # =========================================
    # SSL/TLS Configuration
    # =========================================
    ssl_certificate /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;

    # Protocolos e ciphers modernos (TLS 1.2+)
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    server_tokens off;
    client_max_body_size 1m;

    # =========================================
    # Security Headers (com HSTS ativo)
    # =========================================
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https://*.supabase.co https://*.supabase.in wss://*.supabase.co https://vitals.vercel-insights.com https://*.ingest.us.sentry.io; frame-ancestors 'self';" always;

    # Gzip, cache, SPA fallback, health checks - mesma config do nginx.conf
    gzip on;
    gzip_vary on;
    gzip_min_length 256;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/javascript application/javascript application/json application/xml image/svg+xml font/woff font/woff2;

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        limit_req zone=static burst=50 nodelay;
    }

    location / {
        try_files $uri $uri/ /index.html;
        limit_req zone=general burst=20 nodelay;

        location = /index.html {
            add_header Cache-Control "no-cache, no-store, must-revalidate";
            add_header Pragma "no-cache";
            add_header Expires "0";
        }
    }

    location = /health/live {
        access_log off;
        return 200 'OK';
        add_header Content-Type text/plain;
    }

    location = /health/ready {
        access_log off;
        try_files /index.html =503;
        add_header Content-Type text/plain;
        return 200 'READY';
    }

    location = /health {
        access_log off;
        return 200 'OK';
        add_header Content-Type text/plain;
    }

    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    error_page 404 /index.html;
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }
}