115 lines
5.3 KiB
Plaintext
115 lines
5.3 KiB
Plaintext
# /etc/nginx/sites-available/passkeeper
|
|
#
|
|
# Hardened production Nginx config for PassKeeper.
|
|
# Phase 5 additions vs original:
|
|
# - Strict-Transport-Security (HSTS) with preload
|
|
# - X-Frame-Options: DENY
|
|
# - X-Content-Type-Options: nosniff
|
|
# - Referrer-Policy
|
|
# - Permissions-Policy
|
|
# - Content-Security-Policy (HTTP header level — authoritative over meta tag)
|
|
# - Connection-level rate limiting zones for auth endpoints
|
|
# - Buffer and timeout hardening
|
|
|
|
# ── Rate limiting zones ────────────────────────────────────────────────────────
|
|
# auth_limit: 10 req/s per IP for auth endpoints (login, register, MFA verify)
|
|
# api_limit: 60 req/s per IP for all other API endpoints
|
|
limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=10r/m;
|
|
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=60r/m;
|
|
|
|
server {
|
|
server_name pwkeeper.ngodanguyen.tech passkeeper.ngodanguyen.tech;
|
|
|
|
# ── TLS ───────────────────────────────────────────────────────────────────
|
|
listen 443 ssl;
|
|
ssl_certificate /etc/letsencrypt/live/pwkeeper.ngodanguyen.tech/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/pwkeeper.ngodanguyen.tech/privkey.pem;
|
|
include /etc/letsencrypt/options-ssl-nginx.conf;
|
|
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
|
|
|
# Modern TLS only
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 1d;
|
|
ssl_session_tickets off;
|
|
|
|
# ── Security headers ──────────────────────────────────────────────────────
|
|
# HSTS: enforce HTTPS for 1 year; include subdomains; allow preload submission
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
|
|
|
# Clickjacking protection
|
|
add_header X-Frame-Options "DENY" always;
|
|
|
|
# Prevent MIME sniffing
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
# Control referrer leakage
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
# Disable unused browser features
|
|
add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
|
|
|
|
# Content-Security-Policy (HTTP header takes precedence over meta tag)
|
|
add_header Content-Security-Policy
|
|
"default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none';"
|
|
always;
|
|
|
|
# ── Request hardening ─────────────────────────────────────────────────────
|
|
# Hide Nginx version
|
|
server_tokens off;
|
|
|
|
# Limit request body size (vault items are small; prevent large payload abuse)
|
|
client_max_body_size 1m;
|
|
|
|
# Timeouts
|
|
client_body_timeout 12s;
|
|
client_header_timeout 12s;
|
|
keepalive_timeout 15s;
|
|
send_timeout 10s;
|
|
|
|
# ── Static files ──────────────────────────────────────────────────────────
|
|
location /static/ {
|
|
alias /home/spuser/PassKeeper/app/static/;
|
|
expires 30d;
|
|
add_header Cache-Control "public, immutable";
|
|
}
|
|
|
|
# ── Auth endpoints — stricter Nginx-level rate limit ──────────────────────
|
|
# Flask-Limiter (Redis-backed) is the primary guard; Nginx adds a network-level
|
|
# burst buffer of 5 before returning 429 directly, saving upstream connections.
|
|
location ~ ^/api/auth/(login|register|mfa/verify) {
|
|
limit_req zone=auth_limit burst=5 nodelay;
|
|
limit_req_status 429;
|
|
|
|
proxy_pass http://127.0.0.1:5000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# ── All other requests ────────────────────────────────────────────────────
|
|
location / {
|
|
limit_req zone=api_limit burst=20 nodelay;
|
|
limit_req_status 429;
|
|
|
|
proxy_pass http://127.0.0.1:5000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|
|
|
|
# ── HTTP → HTTPS redirect ─────────────────────────────────────────────────────
|
|
server {
|
|
listen 80;
|
|
server_name pwkeeper.ngodanguyen.tech passkeeper.ngodanguyen.tech;
|
|
return 301 https://$host$request_uri;
|
|
}
|