nginx.conf

upstream webserver {
    # refers to the docker container of the flask application
    # backend is the name of the service in the docker-compose file
    server backend:5000;
}

server {
    listen 80;

    server_name xxxx.com; # server domain name

    # redirect all http traffic to https
    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2 default_server;

    server_name xxxx.com; # server domain name

    ssl_certificate             /etc/nginx/ssl/live/xxxx.com/fullchain.pem;
    ssl_certificate_key         /etc/nginx/ssl/live/xxxx.com/privkey.pem;
    ssl_dhparam                 /etc/nginx/params/dhparam4096.pem;
    
    # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&ocsp=false&guideline=5.6
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off; # because all ciphers are strong enough to let the client choose according to its capabilities
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    keepalive_timeout 75;
    
    ## Security headers
    # HSTS
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    # X-XSS-Protection
    add_header X-XSS-Protection "1; mode=block";
    # X-Frame-Options (clickjacking attack)
    add_header X-Frame-Options "SAMEORIGIN";
    # X-Content-Type-Options (prevents web browser such as, Internet Explorer and Google Chrome from sniffing a response away from the declared Content-Type)
    add_header X-Content-Type-Options nosniff;
    # Referrer-Policy (Instruct the browser to not inform the destination site any URL information)
    add_header Referrer-Policy "strict-origin";
    


    ## OCSP stapling (server checks certficate validity instead of client)
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/ssl/live/xxxx.com/fullchain.pem;
    # DNS resolver for OCSP stapling
    resolver x.x.x.x y.y.y.y;
    

    # Display nginx Version number in error or http header may result in hacker to search for known vulnerability. 
    # Therefore, the version number should be removed for every http response.
    server_tokens off;

    # proxy directives
    proxy_redirect off;
    proxy_set_header Host $host; # $host contains information about the original host being requested (the top of the proxy chain to which the client talked to initially)
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Real-IP $remote_addr; # pass to proxied server the real ip of the client (instead of the proxy ip)
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # this header is a list containing the IP addresses of every server the client has been proxied through up to this point. The variable takes the value of the original X-Forwarded-For header retrieved from the client and adds the Nginx server’s IP address to the end.
    proxy_set_header X-Forwarded-Proto $scheme; # gives the proxied server information about the schema of the original client request (whether it was an http or an https request).        
    proxy_read_timeout  90;

    location / {
        proxy_pass http://webserver/;
    }

    location /auth/ {
        proxy_pass http://keycloak:8080;

        # Needed for keycloak 
        proxy_busy_buffers_size   512k;
        proxy_buffers           4 512k;
        proxy_buffer_size         256k;
    }

    location /static/ {
        alias /etc/nginx/static/;
    }
}