documentation/nginx.conf.example at main · paxapos/documentation · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138


server {
    # Configuración del servidor
    listen 8080;
    server_name localhost;
    root /usr/share/nginx/html;
    index index.html;

    # Configuración de charset
    charset utf-8;

    # ==========================================
    # HEADERS DE SEGURIDAD
    # ==========================================
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header X-Permitted-Cross-Domain-Policies "none" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Ocultar información del servidor
    server_tokens off;


    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_comp_level 6;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/javascript
        application/xml+rss
        application/json
        application/manifest+json
        image/svg+xml;

    # Headers de seguridad (definidos arriba - removiendo duplicados)
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

    # ==========================================
    # CACHE HEADERS
    # ==========================================
    # Cache para assets estáticos
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        add_header Access-Control-Allow-Origin "*";

        # Headers de seguridad para assets
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
    }

    # Cache para HTML (menor tiempo)
    location ~* \.html$ {
        expires 1h;
        add_header Cache-Control "public, must-revalidate";
    }

    # ==========================================
    # MANEJO DE RUTAS SVELTEKIT
    # ==========================================
    # Health check endpoint
    location /health {
        access_log off;
        return 200 "OK\n";
        add_header Content-Type text/plain;
    }

    # Intentar archivo, luego directorio, luego index.html para SPA
    location / {
        try_files $uri $uri/ $uri.html /index.html;

        # Headers para HTML
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
    }

    # ==========================================
    # ENDPOINTS ESPECIALES
    # ==========================================
    # Robots.txt
    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # Favicon
    location = /favicon.ico {
        log_not_found off;
        access_log off;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # ==========================================
    # BLOQUEO DE ARCHIVOS SENSIBLES
    # ==========================================
    # Bloquear acceso a archivos de configuración
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Bloquear acceso a archivos de backup
    location ~ ~$ {
        deny all;
        access_log off;
        log_not_found off;
    }

    # ==========================================
    # LOGGING
    # ==========================================
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log warn;

    # ==========================================
    # ERROR PAGES
    # ==========================================
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;

    location = /50x.html {
        root /usr/share/nginx/html;
    }

    # Cache rules definidos arriba - removiendo duplicados
}