worker_processes auto;

error_log /var/log/nginx/error.log warn;

events { worker_connections 1024; }

http {

include /etc/nginx/mime.types;

default_type application/octet-stream;

sendfile on;

keepalive_timeout 65;

# Hide server version

server_tokens off;

server {

listen 443 ssl;

server_name _;

ssl_certificate /etc/nginx/certs/cert.pem;

ssl_certificate_key /etc/nginx/certs/key.pem;

# TLS hardening — TLS 1.2+ only

ssl_protocols TLSv1.2 TLSv1.3;

ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';

ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;

ssl_session_timeout 10m;

# Security headers

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

add_header X-Frame-Options SAMEORIGIN always;

add_header X-Content-Type-Options nosniff always;

add_header Referrer-Policy no-referrer always;

# Frontend (React SPA)

location / {

proxy_pass http://frontend:80;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

}

# Backend API

location /api/ {

proxy_pass http://backend:8000;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_read_timeout 120s;

}

}

# Redirect HTTP to HTTPS

server {

listen 80;

return 301 https://$host$request_uri;

}

}