# /etc/nginx/sites-available/passkeeper
#
# Hardened production Nginx config for PassKeeper.
# Phase 5 additions vs original:
#   - Strict-Transport-Security (HSTS) with preload
#   - X-Frame-Options: DENY
#   - X-Content-Type-Options: nosniff
#   - Referrer-Policy
#   - Permissions-Policy
#   - Content-Security-Policy (HTTP header level — authoritative over meta tag)
#   - Connection-level rate limiting zones for auth endpoints
#   - Buffer and timeout hardening

# ── Rate limiting zones ────────────────────────────────────────────────────────
# auth_limit: 10 req/s per IP for auth endpoints (login, register, MFA verify)
# api_limit:  60 req/s per IP for all other API endpoints
limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=10r/m;
limit_req_zone $binary_remote_addr zone=api_limit:10m  rate=60r/m;

server {
    server_name pwkeeper.ngodanguyen.tech passkeeper.ngodanguyen.tech;

    # ── TLS ───────────────────────────────────────────────────────────────────
    listen 443 ssl;
    ssl_certificate     /etc/letsencrypt/live/pwkeeper.ngodanguyen.tech/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/pwkeeper.ngodanguyen.tech/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    # Modern TLS only
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # ── Security headers ──────────────────────────────────────────────────────
    # HSTS: enforce HTTPS for 1 year; include subdomains; allow preload submission
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # Clickjacking protection
    add_header X-Frame-Options "DENY" always;

    # Prevent MIME sniffing
    add_header X-Content-Type-Options "nosniff" always;

    # Control referrer leakage
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Disable unused browser features
    add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;

    # Content-Security-Policy (HTTP header takes precedence over meta tag)
    add_header Content-Security-Policy
        "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://api.pwnedpasswords.com; frame-ancestors 'none';"
        always;

    # ── Request hardening ─────────────────────────────────────────────────────
    # Hide Nginx version
    server_tokens off;

    # Limit request body size (vault items are small; prevent large payload abuse)
    client_max_body_size 1m;

    # Timeouts
    client_body_timeout   12s;
    client_header_timeout 12s;
    keepalive_timeout     15s;
    send_timeout          10s;

    # ── Static files ──────────────────────────────────────────────────────────
    location /static/ {
        alias   /home/spuser/PassKeeper/app/static/;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    # ── Auth endpoints — stricter Nginx-level rate limit ──────────────────────
    # Flask-Limiter (Redis-backed) is the primary guard; Nginx adds a network-level
    # burst buffer of 5 before returning 429 directly, saving upstream connections.
    location ~ ^/api/auth/(login|register|mfa/verify) {
        limit_req zone=auth_limit burst=5 nodelay;
        limit_req_status 429;

        proxy_pass http://127.0.0.1:5000;
        proxy_http_version 1.1;
        proxy_set_header Connection        "";
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # ── All other requests ────────────────────────────────────────────────────
    location / {
        limit_req zone=api_limit burst=20 nodelay;
        limit_req_status 429;

        proxy_pass http://127.0.0.1:5000;
        proxy_http_version 1.1;
        proxy_set_header Connection        "";
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# ── HTTP → HTTPS redirect ─────────────────────────────────────────────────────
server {
    listen      80;
    server_name pwkeeper.ngodanguyen.tech passkeeper.ngodanguyen.tech;
    return      301 https://$host$request_uri;
}