1+ # ============================================================================
2+ # Configuração do Virtual Host - Produção
3+ # ============================================================================
4+ #
5+ # ============================================================================
6+
7+ server {
8+ listen 80;
9+ listen [::]:80;
10+ server_name localhost;
11+
12+ # ========================================================================
13+ # HEADERS DE SEGURANÇA
14+ # ========================================================================
15+ add_header X-Frame-Options "SAMEORIGIN" always;
16+ add_header X-Content-Type-Options "nosniff" always;
17+ add_header X-XSS-Protection "1; mode=block" always;
18+ add_header Referrer-Policy "no-referrer-when-downgrade" always;
19+
20+ # Content Security Policy (ajustar conforme necessário)
21+ add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
22+
23+ # HSTS (descomente quando usar HTTPS)
24+ # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
25+
26+ # ========================================================================
27+ # HEALTHCHECK DO NGINX
28+ # ========================================================================
29+ location /health {
30+ access_log off;
31+ return 200 "healthy\n";
32+ add_header Content-Type text/plain;
33+ }
34+
35+ # ========================================================================
36+ # PROXY PARA APLICAÇÃO NODE.JS
37+ # ========================================================================
38+ location / {
39+ # Rate limiting
40+ limit_req zone=general burst=20 nodelay;
41+ limit_conn addr 10;
42+
43+ # Proxy headers
44+ proxy_pass http://backend;
45+ proxy_http_version 1.1;
46+
47+ # Headers importantes para aplicação
48+ proxy_set_header Host $host;
49+ proxy_set_header X-Real-IP $remote_addr;
50+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
51+ proxy_set_header X-Forwarded-Proto $scheme;
52+ proxy_set_header X-Forwarded-Host $host;
53+ proxy_set_header X-Forwarded-Port $server_port;
54+
55+ # WebSocket support (se necessário)
56+ proxy_set_header Upgrade $http_upgrade;
57+ proxy_set_header Connection "upgrade";
58+
59+ # Timeouts
60+ proxy_connect_timeout 60s;
61+ proxy_send_timeout 60s;
62+ proxy_read_timeout 60s;
63+
64+ # Buffering
65+ proxy_buffering on;
66+ proxy_buffer_size 4k;
67+ proxy_buffers 8 4k;
68+ proxy_busy_buffers_size 8k;
69+
70+ # Keepalive
71+ proxy_set_header Connection "";
72+ }
73+
74+ # ========================================================================
75+ # ROTA DE API COM RATE LIMITING DIFERENTE
76+ # ========================================================================
77+ location /api/ {
78+ limit_req zone=api burst=50 nodelay;
79+ limit_conn addr 20;
80+
81+ proxy_pass http://backend;
82+ proxy_http_version 1.1;
83+
84+ proxy_set_header Host $host;
85+ proxy_set_header X-Real-IP $remote_addr;
86+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
87+ proxy_set_header X-Forwarded-Proto $scheme;
88+
89+ proxy_connect_timeout 30s;
90+ proxy_send_timeout 30s;
91+ proxy_read_timeout 30s;
92+ }
93+
94+ # ========================================================================
95+ # ARQUIVOS ESTÁTICOS (se houver)
96+ # ========================================================================
97+ location /static/ {
98+ alias /usr/share/nginx/html/static/;
99+ expires 30d;
100+ add_header Cache-Control "public, immutable";
101+ }
102+
103+ # ========================================================================
104+ # NEGAÇÃO DE ACESSO A ARQUIVOS SENSÍVEIS
105+ # ========================================================================
106+ location ~ /\. {
107+ deny all;
108+ access_log off;
109+ log_not_found off;
110+ }
111+
112+ location ~ \.(env|git|svn)$ {
113+ deny all;
114+ access_log off;
115+ log_not_found off;
116+ }
117+
118+ # ========================================================================
119+ # ERRO PAGES
120+ # ========================================================================
121+ error_page 404 /404.html;
122+ location = /404.html {
123+ root /usr/share/nginx/html;
124+ internal;
125+ }
126+
127+ error_page 500 502 503 504 /50x.html;
128+ location = /50x.html {
129+ root /usr/share/nginx/html;
130+ internal;
131+ }
132+ }
133+
134+ # ============================================================================
135+ # CONFIGURAÇÃO HTTPS (SSL/TLS) - Descomente quando tiver certificados
136+ # ============================================================================
137+ # server {
138+ # listen 443 ssl http2;
139+ # listen [::]:443 ssl http2;
140+ # server_name localhost;
141+ #
142+ # # Certificados SSL
143+ # ssl_certificate /etc/nginx/certs/cert.pem;
144+ # ssl_certificate_key /etc/nginx/certs/key.pem;
145+ #
146+ # # Configuração SSL moderna
147+ # ssl_protocols TLSv1.2 TLSv1.3;
148+ # ssl_ciphers HIGH:!aNULL:!MD5;
149+ # ssl_prefer_server_ciphers on;
150+ # ssl_session_cache shared:SSL:10m;
151+ # ssl_session_timeout 10m;
152+ #
153+ # # OCSP Stapling
154+ # ssl_stapling on;
155+ # ssl_stapling_verify on;
156+ #
157+ # # Headers de segurança
158+ # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
159+ #
160+ # # ... resto da configuração igual ao server HTTP
161+ # }
162+
163+ # ============================================================================
164+ # Redirect HTTP para HTTPS (descomente quando usar SSL)
165+ # ============================================================================
166+ # server {
167+ # listen 80;
168+ # listen [::]:80;
169+ # server_name localhost;
170+ # return 301 https://$server_name$request_uri;
171+ # }
0 commit comments