upgraded configs

.dockerignore

@@ -0,0 +1,5 @@
+.git
+.dockerignore
+Dockerfile
+compose.yaml
+README.md

Dockerfile

@@ -4,6 +4,9 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf
 
 COPY . /usr/share/nginx/html
 
+# nginx.conf is needed in the build context but must not be served
+RUN rm /usr/share/nginx/html/nginx.conf
+
 EXPOSE 8081
 
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["nginx", "-g", "daemon off;"]

nginx.conf

@@ -1,6 +1,26 @@
 server {
     listen 8081;
     server_name localhost;
+    server_tokens off;
 
     root /usr/share/nginx/html;
-}
+
+    # Compression
+    gzip on;
+    gzip_types text/css application/javascript application/json image/svg+xml;
+
+    # Security headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Never serve dotfiles (.git, .dockerignore, ...)
+    location ~ /\. {
+        deny all;
+    }
+
+    # Images and PDFs rarely change. HTML, JS, CSS and JSON are not fingerprinted,
+    # so they keep nginx's default (ETag / Last-Modified revalidation).
+    location ~* \.(jpg|png|pdf)$ {
+        expires 30d;
+    }
+}