From e0c424286f702f0562dc73567c84145534ee61f9 Mon Sep 17 00:00:00 2001
From: Marvin <koro.no.omo@gmail.com>
Date: Tue, 22 Sep 2026 16:30:35 +0200
Subject: [PATCH] upgraded configs

---
 .dockerignore |  5 +++++
 Dockerfile    |  5 ++++-
 nginx.conf    | 22 +++++++++++++++++++++-
 3 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..02bc631
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,5 @@
+.git
+.dockerignore
+Dockerfile
+compose.yaml
+README.md
diff --git a/Dockerfile b/Dockerfile
index 6cc9a44..2643164 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,6 +4,9 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf
 
 COPY . /usr/share/nginx/html
 
+# nginx.conf is needed in the build context but must not be served
+RUN rm /usr/share/nginx/html/nginx.conf
+
 EXPOSE 8081
 
-CMD ["nginx", "-g", "daemon off;"]
\ No newline at end of file
+CMD ["nginx", "-g", "daemon off;"]
diff --git a/nginx.conf b/nginx.conf
index 026e9db..47647a2 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -1,6 +1,26 @@
 server {
     listen 8081;
     server_name localhost;
+    server_tokens off;
 
     root /usr/share/nginx/html;
-}
\ No newline at end of file
+
+    # Compression
+    gzip on;
+    gzip_types text/css application/javascript application/json image/svg+xml;
+
+    # Security headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Never serve dotfiles (.git, .dockerignore, ...)
+    location ~ /\. {
+        deny all;
+    }
+
+    # Images and PDFs rarely change. HTML, JS, CSS and JSON are not fingerprinted,
+    # so they keep nginx's default (ETag / Last-Modified revalidation).
+    location ~* \.(jpg|png|pdf)$ {
+        expires 30d;
+    }
+}