Shad
553c681ede
Runtime-only Dockerfile.runtime copies a pre-built dist/ into the nginx image; sidesteps the Node-on-emulation libuv crash when building on Apple Silicon for linux/amd64. nginx.conf hardened: - HSTS, X-Content-Type-Options, X-Frame-Options DENY, Referrer-Policy - Permissions-Policy locking down camera/microphone/geolocation/payment - Content-Security-Policy with strict default-src self + connect-src scoped to our backend - COOP / CORP same-origin - X-Robots-Tag noindex (not a public marketing site) - server_tokens off Confidence: high Scope-risk: narrow
8 lines
311 B
Docker
8 lines
311 B
Docker
FROM nginx:1.27-alpine
|
|
COPY dist/ /usr/share/nginx/html/
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
RUN sed -i '/listen.*80/a\ server_name _;' /etc/nginx/conf.d/default.conf || true
|
|
EXPOSE 80
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s \
|
|
CMD wget -q --spider http://127.0.0.1/ || exit 1
|