Create nginx.conf

nginx.conf

@@ -0,0 +1,86 @@
+worker_processes auto;
+pid /tmp/nginx.pid;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    # --- Kernel Static Serving Performance Optimizations ---
+    sendfile        on;
+    tcp_nopush      on;
+    tcp_nodelay     on;
+    keepalive_timeout 65;
+
+    # --- Production Gzip Compression Matrix ---
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_min_length 1024;
+    gzip_comp_level 5;
+    gzip_types
+        text/plain
+        text/css
+        text/xml
+        image/svg+xml
+        application/javascript
+        application/x-javascript
+        application/json
+        application/xml
+        application/xml+rss;
+
+    # --- Rootless Unprivileged Temp Write Paths ---
+    client_body_temp_path /tmp/client_temp;
+    proxy_temp_path       /tmp/proxy_temp;
+    fastcgi_temp_path     /tmp/fastcgi_temp;
+    uwsgi_temp_path       /tmp/uwsgi_temp;
+    scgi_temp_path        /tmp/scgi_temp;
+
+    server {
+        listen 8080;
+        server_name localhost;
+        root /usr/share/nginx/html;
+
+        # --- Adjusted Cross-Origin Integration Hardening Headers ---
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+        add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
+        add_header X-Permitted-Cross-Domain-Policies "none" always;
+        add_header X-Download-Options "noopen" always;
+
+        # Global Single Page App fallback routing
+        location / {
+            index index.html;
+            try_files $uri $uri/ /index.html;
+        }
+
+        # Force immediate cache validation over mutable structural assets
+        location = /index.html {
+            expires -1;
+            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
+        }
+
+        location = /registry.json {
+            expires -1;
+            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
+        }
+
+        # Safe Long-Term Caching: Target explicitly hashed Vite compilation output bundles
+        location ~* \.(css|js|mjs)$ {
+            expires 1y;
+            add_header Cache-Control "public, no-transform, immutable" always;
+        }
+
+        # Defensive Short-Term Cache: Un-hashed UI assets/icons revalidate daily
+        location ~* \.(png|jpg|jpeg|gif|svg|webp|ico|woff|woff2|ttf|eot)$ {
+            expires 1d;
+            add_header Cache-Control "public, must-revalidate" always;
+        }
+    }
+}