Crussell/nginx/conf.d/default.conf

# Rate limiting (per IP) — must be at http level, not inside server block
# api_limit mirrors the backend's own per-IP cap (mw.RateLimit(120, time.Minute)).
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=120r/m;
limit_req_zone $binary_remote_addr zone=dav_limit:10m rate=100r/m;
# Webhook bursts (Square retry storms) need a higher ceiling than the API limit
limit_req_zone $binary_remote_addr zone=webhook_limit:10m rate=120r/m;

# Real client IP resolution behind Cloudflare (FAULT A4): Cloudflare sets
# CF-Connecting-IP BEFORE nginx, so stripping it (as the old config did) hid
# the real client from the backend and collapsed per-IP rate limiting to
# per-Cloudflare-edge-IP buckets. Instead the real_ip module rewrites
# $remote_addr to the CF-Connecting-IP value ONLY when the actual TCP peer
# matches one of the trusted Cloudflare ranges below — a direct client cannot
# spoof it, because its own address is never in these ranges. The rewritten
# $remote_addr then flows into X-Real-IP (and CF-Connecting-IP) downstream.
# Must be at http level so every server/location sees the resolved address.
# Cloudflare IPv4 ranges (https://www.cloudflare.com/ips/).
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;
# Cloudflare IPv6 ranges.
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2c0f:f248::/32;
real_ip_header CF-Connecting-IP;

# Only redirect to HTTPS for non-local hosts, so local dev on :80 keeps working.
# nginx map keys support regexes, which is how the RFC1918 ranges are matched.
# Every regex is anchored with $ so a hostname like 127.0.0.1.evil.com cannot
# match a private-IP prefix and bypass the HTTPS redirect.
map $host $ssl_redirect {
    default 1;
    ~^localhost$ 0;
    ~^127\.\d+\.\d+\.\d+$ 0;
    ~^10\.\d+\.\d+\.\d+$ 0;
    ~^192\.168\.\d+\.\d+$ 0;
    ~^172\.(1[6-9]|2[0-9]|3[01])\.\d+\.\d+$ 0;
    ~^\[::1\]$ 0;
}

# Port 80: serve normally for localhost/private hosts, redirect everything else
server {
    listen 80;
    server_name _;

    # Non-local hosts are forced to HTTPS; local/private hosts fall through
    # and are served normally below.
    if ($ssl_redirect) {
        return 301 https://$host$request_uri;
    }

    # Security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
    # Square Web Payments SDK: script from *.squarecdn.com, card-entry iframe
    # from js.squareup.com (frame-src; without it the payment form cannot
    # tokenize behind this proxy). connect-src allows the SDK's own network calls.
    # The SvelteKit SPA emits one inline bootstrap <script> in index.html whose
    # content changes every build, so a static 'sha256-...' would break rebuilds.
    # sub_filter injects a per-request nonce ($request_id, unique per request)
    # into that inline script, and the same nonce appears in script-src below.
    sub_filter '<script>' '<script nonce="$request_id">';
    sub_filter_once on;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-$request_id' https://*.squarecdn.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://*.squareup.com https://*.squarecdn.com; frame-src https://js.squareup.com https://*.squareup.com; frame-ancestors 'none';" always;

    # Serve static frontend
    root /usr/share/nginx/html;
    index index.html;

    # Cache immutable assets aggressively
    location ~ ^/_app/immutable/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Normal frontend routes (SPA fallback)
    location / {
        try_files $uri /index.html;
    }

    # Square webhook — registered at the root in the Go app, NOT under /api/.
    # Exact match takes precedence over the static location / fallback.
    location = /webhooks/square {
        limit_req zone=webhook_limit burst=10 nodelay;

        proxy_pass http://backend:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # Forward the real client IP as CF-Connecting-IP: $remote_addr has
        # already been rewritten by the real_ip module from Cloudflare's
        # CF-Connecting-IP (validated against the set_real_ip_from ranges
        # above), or is the genuine peer address when no trusted edge is in
        # front. Any client-supplied value is overwritten with the validated
        # $remote_addr, so a direct client cannot spoof it. The backend
        # additionally only honors it with TRUST_PROXY_HEADERS=true.
        proxy_set_header CF-Connecting-IP $remote_addr;
    }

    # Proxy API requests to backend. No response caching here: the backend sends
    # no Cache-Control headers, so a shared cache keyed on URI alone would serve
    # one user's authenticated GETs to any caller.
    location /api/ {
        limit_req zone=api_limit burst=20 nodelay;

        proxy_pass http://backend:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # Forward the real client IP as CF-Connecting-IP: $remote_addr has
        # already been rewritten by the real_ip module from Cloudflare's
        # CF-Connecting-IP (validated against the set_real_ip_from ranges
        # above), or is the genuine peer address when no trusted edge is in
        # front. Any client-supplied value is overwritten with the validated
        # $remote_addr, so a direct client cannot spoof it. The backend
        # additionally only honors it with TRUST_PROXY_HEADERS=true.
        proxy_set_header CF-Connecting-IP $remote_addr;
    }

    # SabreDAV - CardDAV and CalDAV
    location /dav/ {
        limit_req zone=dav_limit burst=20 nodelay;

        # Important: rewrite to remove /dav prefix for PHP processing
        rewrite ^/dav/(.*)$ /server.php/$1 break;

        # Pass to PHP-FPM in sabredav container
        fastcgi_pass sabredav:9000;
        fastcgi_index server.php;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;

        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME /var/www/dav/server.php;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param REQUEST_URI $request_uri;

        # Required for DAV
        fastcgi_param HTTPS $https if_not_empty;
        fastcgi_read_timeout 300;
        fastcgi_buffering off;

        # Disable caching for DAV
        proxy_cache off;
        add_header Cache-Control "no-store, no-cache, must-revalidate";

        # Allow DAV methods
        if ($request_method = 'OPTIONS') {
            add_header 'Access-Control-Allow-Origin' '$http_origin';
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE, PROPFIND, PROPPATCH, REPORT, MKCOL, MOVE, COPY';
            add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-None-Match,If-Modified-Since,Cache-Control,Content-Type,Range,Depth,Authorization,If-Match,Destination,Overwrite,Lock-Token,Timeout';
            add_header 'Access-Control-Max-Age' 1728000;
            add_header 'Content-Type' 'text/plain; charset=utf-8';
            add_header 'Content-Length' 0;
            return 204;
        }

        # Remove security headers that interfere with DAV
        add_header X-Content-Type-Options "" always;
        add_header X-Frame-Options "" always;
        add_header X-XSS-Protection "" always;
    }

    # Legacy CardDAV endpoint (backward compatibility)
    location /carddav/ {
        return 301 $scheme://$host/dav/addressbooks$request_uri;
    }

    # Legacy CalDAV endpoint (backward compatibility)
    location /caldav/ {
        return 301 $scheme://$host/dav/calendars$request_uri;
    }
}

# Port 443: production TLS, adds HSTS
server {
    listen 443 ssl http2;

    server_name _;

    # TLS certs (you'll mount them into /etc/nginx/certs)
    ssl_certificate     /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;

    # Security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    # Square Web Payments SDK: script from *.squarecdn.com, card-entry iframe
    # from js.squareup.com (frame-src; without it the payment form cannot
    # tokenize behind this proxy). connect-src allows the SDK's own network calls.
    # The SvelteKit SPA emits one inline bootstrap <script> in index.html whose
    # content changes every build, so a static 'sha256-...' would break rebuilds.
    # sub_filter injects a per-request nonce ($request_id, unique per request)
    # into that inline script, and the same nonce appears in script-src below.
    sub_filter '<script>' '<script nonce="$request_id">';
    sub_filter_once on;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-$request_id' https://*.squarecdn.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://*.squareup.com https://*.squarecdn.com; frame-src https://js.squareup.com https://*.squareup.com; frame-ancestors 'none';" always;

    # Serve static frontend
    root /usr/share/nginx/html;
    index index.html;

    # Cache immutable assets aggressively
    location ~ ^/_app/immutable/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Normal frontend routes (SPA fallback)
    location / {
        try_files $uri /index.html;
    }

    # Square webhook — registered at the root in the Go app, NOT under /api/.
    # Exact match takes precedence over the static location / fallback.
    location = /webhooks/square {
        limit_req zone=webhook_limit burst=10 nodelay;

        proxy_pass http://backend:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # Forward the real client IP as CF-Connecting-IP: $remote_addr has
        # already been rewritten by the real_ip module from Cloudflare's
        # CF-Connecting-IP (validated against the set_real_ip_from ranges
        # above), or is the genuine peer address when no trusted edge is in
        # front. Any client-supplied value is overwritten with the validated
        # $remote_addr, so a direct client cannot spoof it. The backend
        # additionally only honors it with TRUST_PROXY_HEADERS=true.
        proxy_set_header CF-Connecting-IP $remote_addr;
    }

    # Proxy API requests to backend. No response caching here: the backend sends
    # no Cache-Control headers, so a shared cache keyed on URI alone would serve
    # one user's authenticated GETs to any caller.
    location /api/ {
        limit_req zone=api_limit burst=20 nodelay;

        proxy_pass http://backend:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # Forward the real client IP as CF-Connecting-IP: $remote_addr has
        # already been rewritten by the real_ip module from Cloudflare's
        # CF-Connecting-IP (validated against the set_real_ip_from ranges
        # above), or is the genuine peer address when no trusted edge is in
        # front. Any client-supplied value is overwritten with the validated
        # $remote_addr, so a direct client cannot spoof it. The backend
        # additionally only honors it with TRUST_PROXY_HEADERS=true.
        proxy_set_header CF-Connecting-IP $remote_addr;
    }

    # SabreDAV - CardDAV and CalDAV
    location /dav/ {
        limit_req zone=dav_limit burst=20 nodelay;

        # Important: rewrite to remove /dav prefix for PHP processing
        rewrite ^/dav/(.*)$ /server.php/$1 break;

        # Pass to PHP-FPM in sabredav container
        fastcgi_pass sabredav:9000;
        fastcgi_index server.php;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;

        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME /var/www/dav/server.php;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param REQUEST_URI $request_uri;

        # Required for DAV
        fastcgi_param HTTPS $https if_not_empty;
        fastcgi_read_timeout 300;
        fastcgi_buffering off;

        # Disable caching for DAV
        proxy_cache off;
        add_header Cache-Control "no-store, no-cache, must-revalidate";

        # Allow DAV methods
        if ($request_method = 'OPTIONS') {
            add_header 'Access-Control-Allow-Origin' '$http_origin';
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE, PROPFIND, PROPPATCH, REPORT, MKCOL, MOVE, COPY';
            add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-None-Match,If-Modified-Since,Cache-Control,Content-Type,Range,Depth,Authorization,If-Match,Destination,Overwrite,Lock-Token,Timeout';
            add_header 'Access-Control-Max-Age' 1728000;
            add_header 'Content-Type' 'text/plain; charset=utf-8';
            add_header 'Content-Length' 0;
            return 204;
        }

        # Remove security headers that interfere with DAV
        add_header X-Content-Type-Options "" always;
        add_header X-Frame-Options "" always;
        add_header X-XSS-Protection "" always;
    }

    # Legacy CardDAV endpoint (backward compatibility)
    location /carddav/ {
        return 301 $scheme://$host/dav/addressbooks$request_uri;
    }

    # Legacy CalDAV endpoint (backward compatibility)
    location /caldav/ {
        return 301 $scheme://$host/dav/calendars$request_uri;
    }
}