99 lines
3.0 KiB
Plaintext
99 lines
3.0 KiB
Plaintext
# Coolify Manual Nginx Configuration for Coffee Timer Static Site
|
|
# Copy and paste this into Coolify's "Manual Nginx Configuration" section
|
|
# This replaces the entire server block content
|
|
|
|
server {
|
|
# Enhanced Security Headers - Matching HTML meta tags
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
|
add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.bunny.net; font-src 'self' https://fonts.bunny.net; connect-src 'self'; script-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'self';" always;
|
|
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
|
|
|
# Hide nginx version
|
|
server_tokens off;
|
|
|
|
# Main location for serving static files
|
|
location / {
|
|
root /usr/share/nginx/html;
|
|
index index.html index.htm;
|
|
try_files $uri $uri.html $uri/index.html $uri/index.htm $uri/ =404;
|
|
|
|
# Security headers for all responses
|
|
add_header X-Content-Type-Options nosniff always;
|
|
add_header X-Frame-Options DENY always;
|
|
}
|
|
|
|
# Optimize static assets (CSS, JS, images, fonts)
|
|
location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
|
root /usr/share/nginx/html;
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable";
|
|
add_header X-Content-Type-Options nosniff always;
|
|
}
|
|
|
|
# Cache control for HTML files
|
|
location ~* \.html$ {
|
|
root /usr/share/nginx/html;
|
|
expires 1h;
|
|
add_header Cache-Control "public, must-revalidate";
|
|
}
|
|
|
|
# Deny access to hidden files and directories
|
|
location ~ /\. {
|
|
deny all;
|
|
access_log off;
|
|
log_not_found off;
|
|
}
|
|
|
|
# Deny access to backup and temporary files
|
|
location ~* \.(bak|backup|old|tmp|swp|swo|log)$ {
|
|
deny all;
|
|
access_log off;
|
|
log_not_found off;
|
|
}
|
|
|
|
# Deny access to sensitive files
|
|
location ~* \.(htaccess|htpasswd|ini|conf|sql|sh)$ {
|
|
deny all;
|
|
access_log off;
|
|
log_not_found off;
|
|
}
|
|
|
|
# Handle 404 errors
|
|
error_page 404 /404.html;
|
|
location = /404.html {
|
|
root /usr/share/nginx/html;
|
|
internal;
|
|
}
|
|
|
|
# Handle server errors (50x)
|
|
error_page 500 502 503 504 /50x.html;
|
|
location = /50x.html {
|
|
root /usr/share/nginx/html;
|
|
internal;
|
|
}
|
|
|
|
# Gzip compression
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_min_length 1024;
|
|
gzip_proxied any;
|
|
gzip_comp_level 6;
|
|
gzip_types
|
|
text/plain
|
|
text/css
|
|
text/xml
|
|
text/javascript
|
|
application/javascript
|
|
application/xml+rss
|
|
application/json;
|
|
|
|
# Enable efficient file serving
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
}
|