PassKeeper/scripts/passkeeper-nginx.conf

# /etc/nginx/sites-available/passkeeper
#
# Hardened production Nginx config for PassKeeper.
# Phase 5 additions vs original:
#   - Strict-Transport-Security (HSTS) with preload
#   - X-Frame-Options: DENY
#   - X-Content-Type-Options: nosniff
#   - Referrer-Policy
#   - Permissions-Policy
#   - Content-Security-Policy (HTTP header level — authoritative over meta tag)
#   - Connection-level rate limiting zones for auth endpoints
#   - Buffer and timeout hardening
#
# Phase 6 (502 fixes):
#   - proxy_connect_timeout / proxy_read_timeout / proxy_send_timeout made
#     explicit. proxy_read_timeout MUST stay BELOW the `timeout` value in
#     gunicorn.conf.py (90s): if Gunicorn kills the worker first the connection
#     is severed mid-response and Nginx reports 502; if Nginx gives up first the
#     client gets a clean 504 instead.
#   - Security headers repeated inside the /static/ location block. Nginx drops
#     ALL inherited add_header directives in any block that declares one of its
#     own, so /static/'s Cache-Control header was silently stripping CSP, HSTS,
#     X-Frame-Options and nosniff from every JS and CSS asset.

# ── Rate limiting zones ────────────────────────────────────────────────────────
# NOTE the units: these are per MINUTE (r/m), not per second. api_limit is
# therefore 1 req/s sustained for the whole API, with burst=20 absorbing spikes.
# A vault page load fires several /api/* calls, so tightening these further will
# surface as 429s to normal users.
# auth_limit: 10 req/min per IP for auth endpoints (login, register, MFA verify)
# api_limit:  60 req/min per IP for all other API endpoints
limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=10r/m;
limit_req_zone $binary_remote_addr zone=api_limit:10m  rate=60r/m;

server {
    server_name pwkeeper.ngodanguyen.tech passkeeper.ngodanguyen.tech;

    # ── TLS ───────────────────────────────────────────────────────────────────
    listen 443 ssl;
    ssl_certificate     /etc/letsencrypt/live/pwkeeper.ngodanguyen.tech/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/pwkeeper.ngodanguyen.tech/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    # options-ssl-nginx.conf (managed by Certbot) already sets ssl_protocols,
    # ssl_prefer_server_ciphers, ssl_session_timeout and ssl_session_tickets.
    # Repeating them here conflicts whenever Certbot updates its managed file.
    ssl_session_cache shared:SSL:10m;

    # ── Security headers ──────────────────────────────────────────────────────
    # IMPORTANT: these are repeated verbatim inside the /static/ block below.
    # Keep the two copies in sync whenever either is modified.
    # HSTS: enforce HTTPS for 1 year; include subdomains; allow preload submission
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # Clickjacking protection
    add_header X-Frame-Options "DENY" always;

    # Prevent MIME sniffing
    add_header X-Content-Type-Options "nosniff" always;

    # Control referrer leakage
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Disable unused browser features
    add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;

    # Content-Security-Policy (HTTP header takes precedence over meta tag)
    add_header Content-Security-Policy
        "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://api.pwnedpasswords.com; frame-ancestors 'none';"
        always;

    # ── Request hardening ─────────────────────────────────────────────────────
    # Hide Nginx version
    server_tokens off;

    # Limit request body size (vault items are small; prevent large payload abuse)
    client_max_body_size 1m;

    # Timeouts
    client_body_timeout   12s;
    client_header_timeout 12s;
    keepalive_timeout     15s;
    send_timeout          10s;

    # ── Proxy timeouts ────────────────────────────────────────────────────────
    # proxy_read_timeout must stay BELOW gunicorn.conf.py `timeout` (90s) so
    # Nginx is the side that gives up first and the client sees 504, not 502.
    # proxy_connect_timeout is short — Gunicorn is on loopback.
    proxy_connect_timeout  5s;
    proxy_read_timeout    60s;
    proxy_send_timeout    10s;

    # ── Static files ──────────────────────────────────────────────────────────
    # Every add_header from the server block MUST be repeated here. Nginx drops
    # all inherited add_header directives in any location that declares one of
    # its own, so without this the Cache-Control below silently strips CSP,
    # HSTS, X-Frame-Options and nosniff from every static asset.
    location /static/ {
        alias   /home/spuser/PassKeeper/app/static/;
        expires 30d;
        add_header Cache-Control             "public, immutable"                            always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
        add_header X-Frame-Options           "DENY"                                         always;
        add_header X-Content-Type-Options    "nosniff"                                      always;
        add_header Referrer-Policy           "strict-origin-when-cross-origin"              always;
        add_header Permissions-Policy        "geolocation=(), camera=(), microphone=()"     always;
        add_header Content-Security-Policy
            "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://api.pwnedpasswords.com; frame-ancestors 'none';"
            always;
    }

    # ── Auth endpoints — stricter Nginx-level rate limit ──────────────────────
    # Flask-Limiter (Redis-backed) is the primary guard; Nginx adds a network-level
    # burst buffer of 5 before returning 429 directly, saving upstream connections.
    location ~ ^/api/auth/(login|register|mfa/verify) {
        limit_req zone=auth_limit burst=5 nodelay;
        limit_req_status 429;

        proxy_pass http://127.0.0.1:5000;
        proxy_http_version 1.1;
        proxy_set_header Connection        "";
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # ── All other requests ────────────────────────────────────────────────────
    location / {
        limit_req zone=api_limit burst=20 nodelay;
        limit_req_status 429;

        proxy_pass http://127.0.0.1:5000;
        proxy_http_version 1.1;
        proxy_set_header Connection        "";
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# ── HTTP → HTTPS redirect ─────────────────────────────────────────────────────
server {
    listen      80;
    server_name pwkeeper.ngodanguyen.tech passkeeper.ngodanguyen.tech;
    return      301 https://$host$request_uri;
}