projet_gestion_commande/docker/backend/nginx.conf

# =========================================================
# Request ID correlation
# =========================================================
map $http_x_request_id $req_id {
    default $http_x_request_id;
    ""      $request_id;
}

# =========================================================
# Upstreams
# =========================================================
upstream backend {
    server backend:8080;
    keepalive 32;
}

upstream frontend {
    server frontend:80;
    keepalive 8;
}

# =========================================================
# HTTP → HTTPS redirect
# =========================================================
server {
    listen 80;
    listen [::]:80;
    server_name _;

    return 301 https://$host$request_uri;
}

# =========================================================
# HTTPS — Hardened
# =========================================================
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name _;

    server_tokens off;

    # ---------------------------------------------------
    # TLS
    # ---------------------------------------------------
    ssl_certificate     /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;

    ssl_protocols             TLSv1.2 TLSv1.3;
    ssl_ciphers               ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    ssl_stapling        on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/certs/fullchain.pem;
    resolver 1.1.1.1 8.8.8.8 valid=300s;
    resolver_timeout 5s;

    # ---------------------------------------------------
    # En-têtes de sécurité
    # ---------------------------------------------------
    add_header Strict-Transport-Security  "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options            "SAMEORIGIN"                                   always;
    add_header X-Content-Type-Options     "nosniff"                                      always;
    add_header X-XSS-Protection           "0"                                            always;
    add_header Referrer-Policy            "strict-origin-when-cross-origin"              always;
    add_header Permissions-Policy         "geolocation=(), microphone=(), camera=(), payment=()" always;
    add_header Content-Security-Policy    "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'self';" always;

    # ---------------------------------------------------
    # Limites et timeouts
    # ---------------------------------------------------
    client_max_body_size        100M;
    client_body_buffer_size     128k;
    client_header_buffer_size   1k;
    large_client_header_buffers 4 8k;

    client_body_timeout   30s;
    client_header_timeout 30s;
    send_timeout          30s;
    keepalive_timeout     65s;

    # ---------------------------------------------------
    # Gzip (statique uniquement — évite BREACH sur l'API)
    # ---------------------------------------------------
    gzip              on;
    gzip_vary         on;
    gzip_proxied      any;
    gzip_comp_level   5;
    gzip_min_length   1000;
    gzip_types        text/plain text/css text/javascript application/javascript application/json image/svg+xml;

    # ---------------------------------------------------
    # ModSecurity WAF
    # ---------------------------------------------------
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsec/custom-rules.conf;

    # ---------------------------------------------------
    # API backend Go
    # ---------------------------------------------------
    location /api/ {
        limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; }

        if ($request_method = 'OPTIONS') {
            add_header 'Access-Control-Allow-Origin'      "$http_origin"                               always;
            add_header 'Access-Control-Allow-Methods'     'GET, POST, PUT, PATCH, DELETE, OPTIONS'     always;
            add_header 'Access-Control-Allow-Headers'     'Authorization, Content-Type, X-Request-ID'  always;
            add_header 'Access-Control-Allow-Credentials' 'true'                                       always;
            add_header 'Access-Control-Max-Age'           86400                                        always;
            add_header 'Content-Length'                   0;
            add_header 'Content-Type'                     'text/plain charset=UTF-8';
            return 204;
        }

        proxy_pass         http://backend;
        proxy_http_version 1.1;
        proxy_set_header   Connection        "";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   X-Request-ID      $req_id;
        proxy_hide_header  X-Powered-By;

        proxy_connect_timeout 60s;
        proxy_send_timeout    300s;
        proxy_read_timeout    300s;

        proxy_buffer_size        128k;
        proxy_buffers            4 256k;
        proxy_busy_buffers_size  256k;
    }

    # ---------------------------------------------------
    # Webhook Telegram
    # ---------------------------------------------------
    location = /webhook/telegram {
        limit_except POST { deny all; }

        proxy_pass         http://backend;
        proxy_http_version 1.1;
        proxy_set_header   Connection        "";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }

    # ---------------------------------------------------
    # Fichiers uploadés (images / vidéos)
    # ---------------------------------------------------
    location /uploads/ {
        alias /usr/share/nginx/html/uploads/;
        expires 7d;
        add_header Cache-Control      "public, no-transform" always;
        add_header X-Content-Type-Options "nosniff"         always;

        location ~* \.(php|pl|py|cgi|sh|rb|exe)$ {
            deny all;
        }
    }

    # ---------------------------------------------------
    # Frontend React SPA
    # ---------------------------------------------------
    location / {
        proxy_pass         http://frontend;
        proxy_http_version 1.1;
        proxy_set_header   Connection        "";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }

    # ---------------------------------------------------
    # Blocage fichiers sensibles
    # ---------------------------------------------------
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    location ~* \.(env|git|sql|bak|log|conf|ini|sh)$ {
        deny all;
        access_log off;
        log_not_found off;
    }

    location ~* (package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose)$ {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Bloquer scans WordPress / PHP courants
    location ~* (wp-admin|wp-login|wp-content|xmlrpc|\.php)$ {
        deny all;
        access_log off;
        log_not_found off;
    }
}