From a82c96834f0142eef1adecbea6bbc305485a6d4a Mon Sep 17 00:00:00 2001
From: Marvin <koro.no.omo@gmail.com>
Date: Tue, 22 Sep 2026 17:31:41 +0200
Subject: [PATCH] upgraded config

---
 website/.dockerignore | 37 +++++++++++++++++++++++++++++
 website/nginx.conf    | 55 ++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 91 insertions(+), 1 deletion(-)
 create mode 100644 website/.dockerignore

diff --git a/website/.dockerignore b/website/.dockerignore
new file mode 100644
index 0000000..2833169
--- /dev/null
+++ b/website/.dockerignore
@@ -0,0 +1,37 @@
+node_modules
+dist
+dist-ssr
+
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+# Editor / OS
+.vscode
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
+
+# Env / secrets
+.env
+.env.*
+
+# VCS
+.git
+.gitignore
+
+# Docker
+Dockerfile
+.dockerignore
+
+# Docs
+README.md
diff --git a/website/nginx.conf b/website/nginx.conf
index 4c02e3f..f1a1a09 100644
--- a/website/nginx.conf
+++ b/website/nginx.conf
@@ -5,7 +5,60 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    server_tokens off;
+
+    gzip on;
+    gzip_vary on;
+    gzip_comp_level 6;
+    gzip_min_length 256;
+    gzip_types
+        text/plain
+        text/css
+        text/xml
+        application/json
+        application/javascript
+        application/xml
+        image/svg+xml;
+
+    # NOTE: add_header does not inherit into a location block that sets
+    # its own add_header, so these three lines are repeated in every
+    # location below rather than declared once here.
+
+    location = /health {
+        access_log off;
+        return 200 "ok\n";
+        add_header Content-Type text/plain always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    }
+
+    # Hashed build assets (Vite output) can be cached forever.
+    location /assets/ {
+        try_files $uri =404;
+        add_header Cache-Control "public, max-age=31536000, immutable" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    }
+
+    # index.html must always be revalidated so SPA routing/asset
+    # references stay in sync with the latest deployed build.
+    location = /index.html {
+        add_header Cache-Control "no-cache" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    }
+
     location / {
         try_files $uri $uri/ /index.html;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     }
-}
\ No newline at end of file
+
+    location ~ /\. {
+        deny all;
+    }
+}