Finalized Nginx HTTPS config with shared SSL settings and security headers

docker-compose.yml

@@ -55,6 +55,7 @@ services:
       - "443:443"
     volumes:
       - ./infrastructure/nginx/conf.d:/etc/nginx/conf.d
+      - ./infrastructure/nginx/ssl.conf:/etc/nginx/ssl.conf:ro
       - /etc/letsencrypt:/etc/letsencrypt:ro
     depends_on:
       - api

infrastructure/nginx/conf.d/api.conf

@@ -1,7 +1,9 @@
 server {
     listen 80;
     server_name api.proselitigant.tech;
-    return 301 https://$host$request_uri;
+    location / {
+        return 301 https://$host$request_uri;
+    }
 }
 
 server {
@@ -10,6 +12,7 @@ server {
 
     ssl_certificate /etc/letsencrypt/live/proselitigant.tech/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/proselitigant.tech/privkey.pem;
+    include /etc/nginx/ssl.conf;
 
     # Security headers
     add_header X-Frame-Options DENY;

infrastructure/nginx/conf.d/default.conf

@@ -1,23 +0,0 @@
-server {
-    listen 80;
-    server_name localhost;
-
-    location / {
-        proxy_pass http://web:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection 'upgrade';
-        proxy_set_header Host $host;
-        proxy_cache_bypass $http_upgrade;
-    }
-
-    location /api {
-        rewrite ^/api/(.*) /$1 break;
-        proxy_pass http://api:4000;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection 'upgrade';
-        proxy_set_header Host $host;
-        proxy_cache_bypass $http_upgrade;
-    }
-}

infrastructure/nginx/conf.d/web.conf

@@ -1,7 +1,9 @@
 server {
     listen 80;
     server_name proselitigant.tech;
-    return 301 https://$host$request_uri;
+    location / {
+        return 301 https://$host$request_uri;
+    }
 }
 
 server {
@@ -10,6 +12,7 @@ server {
 
     ssl_certificate /etc/letsencrypt/live/proselitigant.tech/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/proselitigant.tech/privkey.pem;
+    include /etc/nginx/ssl.conf;
 
     # Security headers
     add_header X-Frame-Options SAMEORIGIN;

infrastructure/nginx/ssl.conf

@@ -0,0 +1,10 @@
+ssl_session_timeout 1d;
+ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+ssl_session_tickets off;
+
+# modern configuration
+ssl_protocols TLSv1.3;
+ssl_prefer_server_ciphers off;
+
+# HSTS (ngx_http_headers_module is required) (6 months)
+add_header Strict-Transport-Security "max-age=15768000" always;