chore: update nginx docker compose

docker/frontend/Dockerfile

@@ -36,8 +36,8 @@ COPY --from=builder /build/dist /usr/share/nginx/html
 # Logs ModSecurity
 RUN mkdir -p /var/log/modsec && chown -R nginx:nginx /var/log/modsec
 
-COPY docker/docker/frontend/nginx.conf /etc/nginx/conf.d/app.conf
-COPY docker/docker/frontend/custom-rules.conf /etc/nginx/modsec/custom-rules.conf
+COPY docker/frontend/nginx.conf /etc/nginx/conf.d/app.conf
+COPY docker/frontend/custom-rules.conf /etc/nginx/modsec/custom-rules.conf
 RUN echo "Include /etc/nginx/modsec/custom-rules.conf" > /etc/nginx/modsec/custom-includes.conf
 
 RUN rm -f /etc/nginx/templates/conf.d/default.conf.template || true

docker/frontend/Dockerfile.prod

@@ -1,49 +0,0 @@
-# =========================================================
-# Stage 1: Build Frontend
-# =========================================================
-FROM node:20-alpine AS builder
-
-WORKDIR /build
-
-COPY frontend-prep/package*.json ./
-RUN npm ci --only=production
-
-COPY frontend-prep .
-RUN npm run build && ls -la dist/
-
-# =========================================================
-# Stage 2: Nginx + ModSecurity
-# =========================================================
-FROM owasp/modsecurity-crs:nginx-alpine
-
-USER root
-
-# Copier le frontend build
-COPY --from=builder /build/dist /usr/share/nginx/html
-
-# Configs Nginx / ModSecurity
-COPY docker/frontend/nginx.conf.prod /etc/nginx/conf.d/app.conf
-COPY docker/frontend/main.conf /etc/nginx/modsec/main.conf
-COPY docker/frontend/ban-on-crs-scores-delivery-api.conf /etc/nginx/modsec/ban-on-crs-scores-delivery-api.conf
-COPY docker/frontend/crs-setup.conf /etc/nginx/modsec/crs-setup.conf
-
-# Supprimer template par défaut
-RUN rm -f /etc/nginx/templates/conf.d/default.conf.template || true
-
-# Variables ModSecurity
-ENV MODSEC_ENGINE=On \
-    PARANOIA=2 \
-    ANOMALY_INBOUND=5 \
-    ANOMALY_OUTBOUND=4
-
-# Permissions
-RUN chown -R nginx:nginx /usr/share/nginx/html \
-    && mkdir -p /etc/letsencrypt \
-    && chown -R nginx:nginx /etc/letsencrypt
-
-USER nginx
-
-EXPOSE 80 443
-
-STOPSIGNAL SIGQUIT
-CMD ["nginx", "-g", "daemon off;"]

docker/frontend/custom-rules.conf

@@ -6,6 +6,13 @@ SecRule REQUEST_URI "@streq /api/v2/admin/protected/products" \
    ctl:ruleRemoveById=920120,\
    ctl:ruleRemoveById=920121"
 
+SecRule REQUEST_URI "@beginsWith /uploads/" \
+    "id:1000,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ctl:ruleEngine=Off"
+
 SecRule IP:BANNED "@eq 1" \
   "id:100000,phase:1,deny,status:403,log,\
    msg:'IP is banned'"

docker/frontend/nginx.conf

@@ -67,12 +67,68 @@ server {
         add_header Pragma "no-cache" always;
         add_header Expires "0" always;
     }
+    location /uploads/ {
+        # ✅ IMPORTANT : alias doit se terminer par / ET le chemin aussi
+        alias /usr/share/nginx/html/uploads/;
 
-    location ~* \.(css|js|jpg|jpeg|png|gif|svg|ico|woff2?|ttf|eot)$ {
-        expires 1y;
+        # ✅ Désactiver ModSecurity pour les uploads
+        modsecurity off;
+
+        # Cache headers
+        expires 30d;
         add_header Cache-Control "public, immutable";
-        access_log off;
     }
+    location ^~ /uploads/images/ {
+        alias /usr/share/nginx/html/uploads/images/;
+
+        # ✅ Désactiver ModSecurity
+        modsecurity off;
+
+        # ✅ CORS pour images publiques
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
+
+        # Cache agressif
+        expires 30d;
+        add_header Cache-Control "public, immutable" always;
+
+        # Types MIME
+        types {
+            image/jpeg jpg jpeg;
+            image/png png;
+            image/gif gif;
+            image/webp webp;
+            image/svg+xml svg;
+        }
+        default_type image/jpeg;
+    }
+
+    # =========================================================
+    # ✅ UPLOADS VIDEOS (priorité maximale avec ^~)
+    # =========================================================
+    location ^~ /uploads/videos/ {
+        alias /usr/share/nginx/html/uploads/videos/;
+
+        # ✅ Désactiver ModSecurity
+        modsecurity off;
+
+        # ✅ CORS pour vidéos publiques
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
+
+        # Cache agressif
+        expires 30d;
+        add_header Cache-Control "public, immutable" always;
+
+        # Types MIME pour vidéos
+        types {
+            video/mp4 mp4;
+            video/webm webm;
+            video/ogg ogv;
+        }
+        default_type video/mp4;
+    }
+
 
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header X-Content-Type-Options "nosniff" always;