04/18 Enhance app (security, performance)

2026-04-18 13:20:04 -04:00
parent b51468661e
commit 4d3f9844f0
14 changed files with 529 additions and 7 deletions
@@ -0,0 +1,114 @@
+# /etc/nginx/sites-available/passkeeper
+#
+# Hardened production Nginx config for PassKeeper.
+# Phase 5 additions vs original:
+#   - Strict-Transport-Security (HSTS) with preload
+#   - X-Frame-Options: DENY
+#   - X-Content-Type-Options: nosniff
+#   - Referrer-Policy
+#   - Permissions-Policy
+#   - Content-Security-Policy (HTTP header level — authoritative over meta tag)
+#   - Connection-level rate limiting zones for auth endpoints
+#   - Buffer and timeout hardening
+
+# ── Rate limiting zones ────────────────────────────────────────────────────────
+# auth_limit: 10 req/s per IP for auth endpoints (login, register, MFA verify)
+# api_limit:  60 req/s per IP for all other API endpoints
+limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=10r/m;
+limit_req_zone $binary_remote_addr zone=api_limit:10m  rate=60r/m;
+
+server {
+    server_name pwkeeper.ngodanguyen.tech passkeeper.ngodanguyen.tech;
+
+    # ── TLS ───────────────────────────────────────────────────────────────────
+    listen 443 ssl;
+    ssl_certificate     /etc/letsencrypt/live/pwkeeper.ngodanguyen.tech/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/pwkeeper.ngodanguyen.tech/privkey.pem;
+    include             /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;
+
+    # Modern TLS only
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+
+    # ── Security headers ──────────────────────────────────────────────────────
+    # HSTS: enforce HTTPS for 1 year; include subdomains; allow preload submission
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+
+    # Clickjacking protection
+    add_header X-Frame-Options "DENY" always;
+
+    # Prevent MIME sniffing
+    add_header X-Content-Type-Options "nosniff" always;
+
+    # Control referrer leakage
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Disable unused browser features
+    add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
+
+    # Content-Security-Policy (HTTP header takes precedence over meta tag)
+    add_header Content-Security-Policy
+        "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none';"
+        always;
+
+    # ── Request hardening ─────────────────────────────────────────────────────
+    # Hide Nginx version
+    server_tokens off;
+
+    # Limit request body size (vault items are small; prevent large payload abuse)
+    client_max_body_size 1m;
+
+    # Timeouts
+    client_body_timeout   12s;
+    client_header_timeout 12s;
+    keepalive_timeout     15s;
+    send_timeout          10s;
+
+    # ── Static files ──────────────────────────────────────────────────────────
+    location /static/ {
+        alias   /home/spuser/PassKeeper/app/static/;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # ── Auth endpoints — stricter Nginx-level rate limit ──────────────────────
+    # Flask-Limiter (Redis-backed) is the primary guard; Nginx adds a network-level
+    # burst buffer of 5 before returning 429 directly, saving upstream connections.
+    location ~ ^/api/auth/(login|register|mfa/verify) {
+        limit_req zone=auth_limit burst=5 nodelay;
+        limit_req_status 429;
+
+        proxy_pass http://127.0.0.1:5000;
+        proxy_http_version 1.1;
+        proxy_set_header Connection        "";
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # ── All other requests ────────────────────────────────────────────────────
+    location / {
+        limit_req zone=api_limit burst=20 nodelay;
+        limit_req_status 429;
+
+        proxy_pass http://127.0.0.1:5000;
+        proxy_http_version 1.1;
+        proxy_set_header Connection        "";
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# ── HTTP → HTTPS redirect ─────────────────────────────────────────────────────
+server {
+    listen      80;
+    server_name pwkeeper.ngodanguyen.tech passkeeper.ngodanguyen.tech;
+    return      301 https://$host$request_uri;
+}