nginx.conf

# Number of worker processes running in container
worker_processes 1;

# Run NGINX in foreground (necessary for containerized NGINX)
daemon off;

# Set the location of the server's error log
error_log stderr;

events {
  # Set number of simultaneous connections each worker process can serve
  worker_connections 1024;
}

http {

    client_body_temp_path /tmp/client_body_temp;
    proxy_temp_path /tmp/proxy_temp;
    fastcgi_temp_path /tmp/fastcgi_temp;

    charset utf-8;

    # Map media types to file extensions
    types {
        text/html html htm shtml;
        text/css css;
        text/xml xml;
        image/gif gif;
        image/jpeg jpeg jpg;
        application/javascript js;
        application/atom+xml atom;
        application/rss+xml rss;
        font/ttf ttf;
        font/woff woff;
        font/woff2 woff2;
        text/mathml mml;
        text/plain txt;
        text/vnd.sun.j2me.app-descriptor jad;
        text/vnd.wap.wml wml;
        text/x-component htc;
        text/cache-manifest manifest;
        image/png png;
        image/tiff tif tiff;
        image/vnd.wap.wbmp wbmp;
        image/x-icon ico;
        image/x-jng jng;
        image/x-ms-bmp bmp;
        image/svg+xml svg svgz;
        image/webp webp;
        application/java-archive jar war ear;
        application/mac-binhex40 hqx;
        application/msword doc;
        application/pdf pdf;
        application/postscript ps eps ai;
        application/rtf rtf;
        application/vnd.ms-excel xls;
        application/vnd.ms-powerpoint ppt;
        application/vnd.wap.wmlc wmlc;
        application/vnd.google-earth.kml+xml  kml;
        application/vnd.google-earth.kmz kmz;
        application/x-7z-compressed 7z;
        application/x-cocoa cco;
        application/x-java-archive-diff jardiff;
        application/x-java-jnlp-file jnlp;
        application/x-makeself run;
        application/x-perl pl pm;
        application/x-pilot prc pdb;
        application/x-rar-compressed rar;
        application/x-redhat-package-manager  rpm;
        application/x-sea sea;
        application/x-shockwave-flash swf;
        application/x-stuffit sit;
        application/x-tcl tcl tk;
        application/x-x509-ca-cert der pem crt;
        application/x-xpinstall xpi;
        application/xhtml+xml xhtml;
        application/zip zip;
        application/octet-stream bin exe dll;
        application/octet-stream deb;
        application/octet-stream dmg;
        application/octet-stream eot;
        application/octet-stream iso img;
        application/octet-stream msi msp msm;
        application/json json;
        audio/midi mid midi kar;
        audio/mpeg mp3;
        audio/ogg ogg;
        audio/x-m4a m4a;
        audio/x-realaudio ra;
        video/3gpp 3gpp 3gp;
        video/mp4 mp4;
        video/mpeg mpeg mpg;
        video/quicktime mov;
        video/webm webm;
        video/x-flv flv;
        video/x-m4v m4v;
        video/x-mng mng;
        video/x-ms-asf asx asf;
        video/x-ms-wmv wmv;
        video/x-msvideo avi;
    }

    access_log /dev/stdout;

    # Set the default MIME type of responses; 'application/octet-stream'
    # represents an arbitrary byte stream
    default_type application/octet-stream;

    # (Performance) When sending files, skip copying into buffer before sending.
    sendfile on;
    # (Only active with sendfile on) wait for packets to reach max size before
    # sending.
    tcp_nopush on;

    # (Performance) Enable compressing responses
    gzip on;
    # For all clients
    gzip_static always;
    # Including responses to proxied requests
    gzip_proxied any;
    # For responses above a certain length
    gzip_min_length 1100;
    # That are one of the following MIME types
    gzip_types
        text/plain
        text/css
        text/js
        text/xml
        text/javascript
        application/javascript
        application/x-javascript
        application/json
        application/xml
        application/xml+rss
        font/eot
        font/otf
        font/ttf
        image/svg+xml;
    # Compress responses to a medium degree
    gzip_comp_level 6;
    # Using 16 buffers of 8k bytes each
    gzip_buffers 16 8k;

    # Add "Vary: Accept-Encoding” response header to compressed responses
    gzip_vary on;

    # Decompress responses if client doesn't support compressed
    gunzip on;

    # Don't compress responses if client is Internet Explorer 6
    gzip_disable "msie6";

    # Set a timeout during which a keep-alive client connection will stay open on
    # the server side
    keepalive_timeout 30;

    # Ensure that redirects don't include the internal container PORT
    # Set PORT_IN_REDIRECT environment variable to "on" or "off"
    port_in_redirect {{env "PORT_IN_REDIRECT"}};

    # (Security) Disable emitting nginx version on error pages and in the
    # “Server” response header field
    server_tokens off;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    server {
        listen  {{env "NGINX_PORT"}} default_server;
        server_name _;

        # Directory where static files are located
        root /workspace;

        location = /.etc/nginx/rewrite.conf {
            deny    all;
            return  404;
        }

        include /workspace/.etc/nginx/rewrite.conf*;

        # Handle static assets with aggressive caching
        location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|webp)$ {
            expires 1y;
            add_header Cache-Control "public, immutable";
            add_header Vary Accept-Encoding;
            access_log off;
            try_files $uri =404;
        }

        # Handle special asset directories
        location ~* ^/_/(css|js|img|font|assets)/ {
            expires 1y;
            add_header Cache-Control "public, immutable";
            add_header Vary Accept-Encoding;
            access_log off;
            try_files $uri =404;
        }

        # Security: Block access to hidden files (except .well-known)
        location ~ /\.(?!well-known) {
            deny all;
            return 404;
        }

        # Security: Block access to sensitive file types
        location ~* \.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist|env)$ {
            deny all;
            return 404;
        }

        # Security: Block access to common backup and temporary files
        location ~* (~|\.sw[op]|\.bak|\.orig|\.save)$ {
            deny all;
            return 404;
        }

        # Main location block
        location / {
            index  index.html;
            # Try files, then directories, then 404
            try_files $uri $uri/ =404;

            # Add security headers for HTML content
            location ~* \.html$ {
                add_header X-Frame-Options "SAMEORIGIN" always;
                add_header X-Content-Type-Options "nosniff" always;
            }
        }

        # Custom error pages
        error_page  404  /404.html;

        # Health check endpoint
        location = /health {
            access_log off;
            return 200 "healthy\n";
            add_header Content-Type text/plain;
        }
    }

}