Add SSL configuration script and Nginx default configuration for HTTPS support
taylorwalton committed
Nov 30, 2025 at 10:27 UTC
55742d8d295aba71cc15102caec0ce0ee44dcfaf
3 files changed
+85
-1
.gitignore
+1
-1
@@ -36,7 +36,7 @@ cypress/screenshots/
36
# Python Virtualenv
37
__pycache__/
38
*.py[cod]
39
-build/
39
+#build/
40
.venv/
41
wheels/
42
*.egg-info/
customer_portal/build/docker-entrypoint.d/90-copilot-ssl.sh
new
+14
@@ -0,0 +1,14 @@
1
+#!/bin/sh
2
+set -e
3
+
4
+# This script can be used to configure SSL certificates at runtime
5
+# Only runs if certificates are mounted/available
6
+
7
+if [ -f "/etc/nginx/ssl/cert.pem" ] && [ -f "/etc/nginx/ssl/key.pem" ]; then
8
+ echo "SSL certificates found, enabling HTTPS..."
9
+
10
+ # Update nginx config to enable SSL
11
+ # This is a placeholder - adjust based on your SSL needs
12
+fi
13
+
14
+exit 0
customer_portal/build/etc/nginx/sites-enabled/default.conf
new
+70
@@ -0,0 +1,70 @@
1
+server {
2
+ listen 80 default_server;
3
+ listen [::]:80 default_server;
4
+
5
+ # Disable access logs
6
+ access_log off;
7
+ log_not_found off;
8
+ error_log /dev/stderr error;
9
+
10
+ return 301 https://$host$request_uri;
11
+}
12
+
13
+server {
14
+ listen 443 ssl http2;
15
+ listen [::]:443 ssl http2;
16
+
17
+ # define the root dir
18
+ root /var/www/copilot;
19
+ index index.html;
20
+
21
+ client_max_body_size 0;
22
+
23
+ # disable access logs
24
+ access_log off;
25
+ log_not_found off;
26
+ error_log /dev/stderr error;
27
+
28
+ ssl_certificate ${TLS_CERT_PATH};
29
+ ssl_certificate_key ${TLS_KEY_PATH};
30
+ ssl_session_timeout 1d;
31
+ ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
32
+ ssl_session_tickets off;
33
+
34
+ # intermediate configuration
35
+ ssl_dhparam /etc/nginx/certs/dhparams.pem;
36
+ ssl_protocols TLSv1.2 TLSv1.3;
37
+ ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
38
+ ssl_prefer_server_ciphers off;
39
+
40
+ # enable HSTS
41
+ add_header Strict-Transport-Security "max-age=15768000; includeSubdomains";
42
+ add_header X-Frame-Options SAMEORIGIN;
43
+
44
+ # added headers for hardening browser security
45
+ add_header Referrer-Policy "no-referrer" always;
46
+ add_header X-Content-Type-Options "nosniff" always;
47
+ add_header X-Download-Options "noopen" always;
48
+ add_header X-Frame-Options "SAMEORIGIN" always;
49
+ add_header X-Permitted-Cross-Domain-Policies "none" always;
50
+ add_header X-Robots-Tag "none" always;
51
+ add_header X-XSS-Protection "1; mode=block" always;
52
+
53
+ # remove X-Powered-By, which is an information leak
54
+ fastcgi_hide_header X-Powered-By;
55
+
56
+ # Proxy /api requests to the FastAPI backend
57
+ location /api {
58
+ proxy_set_header Host $host;
59
+ proxy_set_header X-Real-IP $remote_addr;
60
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
61
+ proxy_set_header X-Forwarded-Proto $scheme;
62
+ proxy_pass http://copilot-backend:5000;
63
+ }
64
+
65
+ # Run all other routes through the frontend
66
+ location / {
67
+ client_max_body_size 0;
68
+ try_files $uri $uri/ /index.html;
69
+ }
70
+}