aurum/frontend/nginx.conf

# Rate limit shared by every /api/ request. This file is included from inside
# nginx's http{} block, which is the only context where a zone can be declared.
# Basic Auth has no lockout, no captcha and no delay of its own, so without
# this the single instance password can be guessed at network speed. The rate
# is deliberately well above what the UI needs (a dashboard load fires a
# dozen or so queries at once, and CSV import pages through history) and still
# cuts a brute-force attempt by orders of magnitude.
limit_req_zone $binary_remote_addr zone=aurum_api:10m rate=20r/s;

server {
    listen 80;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    # Don't advertise the exact nginx version — it turns "is this instance
    # vulnerable to X" into a lookup instead of a probe.
    server_tokens off;

    # Rejects requests whose Host header isn't one we expect (DNS rebinding —
    # see docker-entrypoint.d/25-allowed-hosts.sh, which generates this and
    # explains the attack). Empty file when the check is switched off.
    include /etc/nginx/allowed-hosts.conf;

    # Security headers, applied at server level so every location inherits
    # them. Note for whoever edits this next: adding an add_header inside a
    # location block drops ALL of these for that location — nginx does not
    # merge them.
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

    # Enforced. This started out as Content-Security-Policy-Report-Only, but
    # Report-Only without a report-uri/report-to endpoint is inert in Firefox
    # — it says so itself in the console: "CSP will not block and cannot
    # report violations of this policy". So an empty console proved nothing,
    # and the choice was between standing up a report-collecting endpoint for
    # a single self-hosted app or enforcing and watching. Enforcing wins: a
    # violation then shows up in every browser's console *and* as a visibly
    # broken element, and rolling back is renaming this one header.
    #
    # Why each part is the way it is:
    #   script-src 'self'       — verified: the built bundle contains no eval/
    #                             new Function, and the theme script was moved
    #                             out of index.html into /theme-init.js.
    #   style-src 'unsafe-inline' — unavoidable for now: 27 components use
    #                             style={{...}} and Recharts injects inline
    #                             styles of its own.
    #   img-src ... coingecko   — coin icons come straight from CoinGecko's
    #                             CDN (thumb_url on a holding); both the
    #                             current and the older asset host are listed.
    #   img-src blob:           — the chart/download paths build blob URLs.
    #   connect-src 'self'      — the API is same-origin; nothing else is called.
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://coin-images.coingecko.com https://assets.coingecko.com; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;

    # Always open, no auth — this is what Docker's own HEALTHCHECK and any
    # external uptime monitor hit, and it returns nothing but {"status":"ok"}.
    # docker-entrypoint.d/20-basic-auth.sh writes basic-auth.conf; without an
    # explicit "auth_basic off" here this location would inherit whatever it
    # sets below and healthchecks would start failing with 401.
    location = /api/health {
        auth_basic off;
        # Rate limited too: this is the one unauthenticated route, so it's the
        # one an attacker can hammer for free. Docker's HEALTHCHECK hits it
        # once every 10s, nowhere near the limit.
        limit_req zone=aurum_api burst=40 nodelay;
        limit_req_status 429;
        proxy_pass http://backend:8000/api/health;
        proxy_set_header Host $host;
    }

    # Reverse proxy to the FastAPI backend container. basic-auth.conf is
    # generated at container start (empty if AURUM_BASIC_AUTH_USER/PASSWORD
    # aren't set, so this is a no-op by default) — see docker-entrypoint.d/.
    location /api/ {
        include /etc/nginx/basic-auth.conf;

        limit_req zone=aurum_api burst=40 nodelay;
        limit_req_status 429;

        # Backup restore posts the whole snapshot as one JSON body, and a
        # real one runs to several MB — nginx's 1m default silently rejected
        # those with a 413 before they ever reached the backend, which meant
        # backups could be taken but not restored. Bounded on purpose rather
        # than disabled (0), so an oversized upload still can't exhaust memory.
        client_max_body_size 64m;
        client_body_timeout 60s;
        # A large restore rewrites every table in one transaction; the default
        # 60s read timeout can cut that off midway.
        proxy_read_timeout 120s;

        proxy_pass http://backend:8000/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # SPA fallback — client-side routing handles the rest. Deliberately NOT
    # behind auth_basic: this is just the built HTML/JS/CSS shell, no
    # financial data lives in it. The app's own branded login screen
    # (frontend/src/components/auth/LoginGate.tsx) is what actually gates
    # entry, by requiring a valid Authorization header on every /api/ call
    # above — the real protection stays exactly where it was.
    location / {
        try_files $uri $uri/ /index.html;
    }

    gzip on;
    gzip_types text/css application/javascript application/json image/svg+xml;
}