# /etc/nginx/sites-available/passkeeper
#
# Hardened production Nginx config for PassKeeper.
# Phase 5 additions vs original:
#   - Strict-Transport-Security (HSTS) with preload
#   - X-Frame-Options: DENY
#   - X-Content-Type-Options: nosniff
#   - Referrer-Policy
#   - Permissions-Policy
#   - Content-Security-Policy (HTTP header level — authoritative over meta tag)
#   - Connection-level rate limiting zones for auth endpoints
#   - Buffer and timeout hardening
#
# Phase 6 (502 fixes):
#   - proxy_connect_timeout / proxy_read_timeout / proxy_send_timeout made
#     explicit. proxy_read_timeout MUST stay BELOW the `timeout` value in
#     gunicorn.conf.py (90s): if Gunicorn kills the worker first the connection
#     is severed mid-response and Nginx reports 502; if Nginx gives up first the
#     client gets a clean 504 instead.
#   - Security headers repeated inside the /static/ location block. Nginx drops
#     ALL inherited add_header directives in any block that declares one of its
#     own, so /static/'s Cache-Control header was silently stripping CSP, HSTS,
#     X-Frame-Options and nosniff from every JS and CSS asset.

# ── Rate limiting zones ────────────────────────────────────────────────────────
# MIND THE UNITS — r/s and r/m are easy to confuse, and getting it wrong is
# invisible until users start seeing 429s.
#
# api_limit was 60r/m, i.e. 1 req/s sustained for the ENTIRE API. A single vault
# page load fires several /api/* calls (vault, folders, sharing inbox, me), and
# any active session drains the burst bucket quickly, so normal use produced
# spurious 429s. Now 10r/s, which is generous for a human and still bounds
# scripted abuse.
#
# auth_limit stays deliberately tight — it is the brute-force surface. 20r/m
# with burst=5 is well above what a human retyping a password needs, and
# Flask-Limiter (Redis-backed, 10/min on /login) remains the primary guard;
# this zone exists to shed load before it reaches Gunicorn.
#
# auth_limit: 20 req/MINUTE per IP — login, register, MFA verify
# api_limit:  10 req/SECOND per IP — everything else
limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=20r/m;
limit_req_zone $binary_remote_addr zone=api_limit:10m  rate=10r/s;

server {
    server_name pwkeeper.ngodanguyen.tech passkeeper.ngodanguyen.tech;

    # ── TLS ───────────────────────────────────────────────────────────────────
    listen 443 ssl;
    ssl_certificate     /etc/letsencrypt/live/pwkeeper.ngodanguyen.tech/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/pwkeeper.ngodanguyen.tech/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    # options-ssl-nginx.conf (managed by Certbot) already sets ssl_protocols,
    # ssl_prefer_server_ciphers, ssl_session_timeout and ssl_session_tickets.
    # Repeating them here conflicts whenever Certbot updates its managed file.
    ssl_session_cache shared:SSL:10m;

    # ── Security headers ──────────────────────────────────────────────────────
    # IMPORTANT: these are repeated verbatim inside the /static/ block below.
    # Keep the two copies in sync whenever either is modified.
    # HSTS: enforce HTTPS for 1 year; include subdomains; allow preload submission
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # Clickjacking protection
    add_header X-Frame-Options "DENY" always;

    # Prevent MIME sniffing
    add_header X-Content-Type-Options "nosniff" always;

    # Control referrer leakage
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Disable unused browser features
    add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;

    # Content-Security-Policy (HTTP header takes precedence over meta tag)
    add_header Content-Security-Policy
        "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://api.pwnedpasswords.com; frame-ancestors 'none';"
        always;

    # ── Request hardening ─────────────────────────────────────────────────────
    # Hide Nginx version
    server_tokens off;

    # Limit request body size (vault items are small; prevent large payload abuse)
    client_max_body_size 1m;

    # Timeouts
    client_body_timeout   12s;
    client_header_timeout 12s;
    keepalive_timeout     15s;
    send_timeout          10s;

    # ── Proxy timeouts ────────────────────────────────────────────────────────
    # proxy_read_timeout must stay BELOW gunicorn.conf.py `timeout` (90s) so
    # Nginx is the side that gives up first and the client sees 504, not 502.
    # proxy_connect_timeout is short — Gunicorn is on loopback.
    proxy_connect_timeout  5s;
    proxy_read_timeout    60s;
    proxy_send_timeout    10s;

    # ── Static files ──────────────────────────────────────────────────────────
    # Every add_header from the server block MUST be repeated here. Nginx drops
    # all inherited add_header directives in any location that declares one of
    # its own, so without this the Cache-Control below silently strips CSP,
    # HSTS, X-Frame-Options and nosniff from every static asset.
    location /static/ {
        alias   /home/spuser/PassKeeper/app/static/;
        expires 30d;
        add_header Cache-Control             "public, immutable"                            always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
        add_header X-Frame-Options           "DENY"                                         always;
        add_header X-Content-Type-Options    "nosniff"                                      always;
        add_header Referrer-Policy           "strict-origin-when-cross-origin"              always;
        add_header Permissions-Policy        "geolocation=(), camera=(), microphone=()"     always;
        add_header Content-Security-Policy
            "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://api.pwnedpasswords.com; frame-ancestors 'none';"
            always;
    }

    # ── Auth endpoints — stricter Nginx-level rate limit ──────────────────────
    # Flask-Limiter (Redis-backed) is the primary guard; Nginx adds a network-level
    # burst buffer of 5 before returning 429 directly, saving upstream connections.
    location ~ ^/api/auth/(login|register|mfa/verify) {
        limit_req zone=auth_limit burst=5 nodelay;
        limit_req_status 429;

        proxy_pass http://127.0.0.1:5000;
        proxy_http_version 1.1;
        proxy_set_header Connection        "";
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # ── All other requests ────────────────────────────────────────────────────
    location / {
        limit_req zone=api_limit burst=20 nodelay;
        limit_req_status 429;

        proxy_pass http://127.0.0.1:5000;
        proxy_http_version 1.1;
        proxy_set_header Connection        "";
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# ── HTTP → HTTPS redirect ─────────────────────────────────────────────────────
server {
    listen      80;
    server_name pwkeeper.ngodanguyen.tech passkeeper.ngodanguyen.tech;
    return      301 https://$host$request_uri;
}