From b0abcf33370dc628edf728b37e5cf01fe1c8fee4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sascha=20R=C3=BCger?= <rueger@puzzle.ch>
Date: Tue, 19 Sep 2023 14:20:52 +0200
Subject: [PATCH] add nginx.conf and update Dockerfile

---
 Dockerfile |  3 +++
 nginx.conf | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 64 insertions(+)
 create mode 100644 nginx.conf

diff --git a/Dockerfile b/Dockerfile
index 278b565..f62917c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,6 +20,9 @@ COPY --from=builder /src/public /
 RUN wkhtmltopdf --outline-depth 4 --enable-internal-links --enable-local-file-access  ./pdf/index.html /pdf.pdf
 
 FROM docker.io/nginxinc/nginx-unprivileged:1.25-alpine
+USER root
+COPY nginx.conf /etc/nginx/nginx.conf
+USER 101
 
 LABEL maintainer puzzle.ch
 LABEL org.opencontainers.image.title "puzzle.ch's Application Migration and Modernization Techlab"
diff --git a/nginx.conf b/nginx.conf
new file mode 100644
index 0000000..72fed4a
--- /dev/null
+++ b/nginx.conf
@@ -0,0 +1,61 @@
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+pid        /tmp/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    port_in_redirect off;
+    proxy_temp_path /tmp/proxy_temp;
+    client_body_temp_path /tmp/client_temp;
+    fastcgi_temp_path /tmp/fastcgi_temp;
+    uwsgi_temp_path /tmp/uwsgi_temp;
+    scgi_temp_path /tmp/scgi_temp;
+
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+
+    keepalive_timeout  65;
+
+
+    server {
+
+    
+        add_header X-Frame-Options SAMEORIGIN;
+        add_header X-Content-Type-Options nosniff;
+        add_header X-XSS-Protection "1; mode=block";
+        add_header Referrer-Policy strict-origin-when-cross-origin;
+        add_header X-Permitted-Cross-Domain-Policies  none;
+        add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=()";
+        add_header Content-Security-Policy "default-src 'self'; script-src 'self' unpkg.com cdn.jsdelivr.net code.jquery.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com cdn.jsdelivr.net; font-src 'self' fonts.gstatic.com cdn.jsdelivr.net";
+
+        listen       8080;
+        server_name  localhost;
+        server_tokens off;
+
+        location / {
+            root   /usr/share/nginx/html;
+            index  index.html index.htm;
+        }
+
+        error_page   500 502 503 504  /50x.html;
+        location = /50x.html {
+            root   /usr/share/nginx/html;
+        }
+
+    }
+
+}