| 1 | server { |
| 2 | listen 80 default_server; |
| 3 | listen [::]:80 default_server; |
| 4 | |
| 5 | # Disable access logs |
| 6 | access_log off; |
| 7 | log_not_found off; |
| 8 | error_log /dev/stderr error; |
| 9 | |
| 10 | return 301 https://$host$request_uri; |
| 11 | } |
| 12 | |
| 13 | server { |
| 14 | listen 443 ssl http2; |
| 15 | listen [::]:443 ssl http2; |
| 16 | |
| 17 | # define the root dir |
| 18 | root /var/www/copilot; |
| 19 | index index.html; |
| 20 | |
| 21 | client_max_body_size 0; |
| 22 | |
| 23 | # disable access logs |
| 24 | access_log off; |
| 25 | log_not_found off; |
| 26 | error_log /dev/stderr error; |
| 27 | |
| 28 | ssl_certificate ${TLS_CERT_PATH}; |
| 29 | ssl_certificate_key ${TLS_KEY_PATH}; |
| 30 | ssl_session_timeout 1d; |
| 31 | ssl_session_cache shared:MozSSL:10m; # about 40000 sessions |
| 32 | ssl_session_tickets off; |
| 33 | |
| 34 | # intermediate configuration |
| 35 | ssl_dhparam /etc/nginx/certs/dhparams.pem; |
| 36 | ssl_protocols TLSv1.2 TLSv1.3; |
| 37 | ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; |
| 38 | ssl_prefer_server_ciphers off; |
| 39 | |
| 40 | # enable HSTS |
| 41 | add_header Strict-Transport-Security "max-age=15768000; includeSubdomains"; |
| 42 | add_header X-Frame-Options SAMEORIGIN; |
| 43 | |
| 44 | # added headers for hardening browser security |
| 45 | add_header Referrer-Policy "no-referrer" always; |
| 46 | add_header X-Content-Type-Options "nosniff" always; |
| 47 | add_header X-Download-Options "noopen" always; |
| 48 | add_header X-Frame-Options "SAMEORIGIN" always; |
| 49 | add_header X-Permitted-Cross-Domain-Policies "none" always; |
| 50 | add_header X-Robots-Tag "none" always; |
| 51 | add_header X-XSS-Protection "1; mode=block" always; |
| 52 | |
| 53 | # remove X-Powered-By, which is an information leak |
| 54 | fastcgi_hide_header X-Powered-By; |
| 55 | |
| 56 | # Proxy /api requests to the FastAPI backend |
| 57 | location /api { |
| 58 | proxy_set_header Host $host; |
| 59 | proxy_set_header X-Real-IP $remote_addr; |
| 60 | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
| 61 | proxy_set_header X-Forwarded-Proto $scheme; |
| 62 | proxy_pass http://copilot-backend:5000; |
| 63 | } |
| 64 | |
| 65 | # location for scoutsuite-report |
| 66 | location /scoutsuite-report { |
| 67 | proxy_set_header Host $host; |
| 68 | proxy_set_header X-Real-IP $remote_addr; |
| 69 | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
| 70 | proxy_set_header X-Forwarded-Proto $scheme; |
| 71 | proxy_pass http://copilot-backend:5000; |
| 72 | } |
| 73 | |
| 74 | # Run all other routes through the frontend |
| 75 | location / { |
| 76 | client_max_body_size 0; |
| 77 | try_files $uri $uri/ /index.html; |
| 78 | } |
| 79 | } |