feat: Phase 1 – Plattform-Grundgerüst (Docker, NestJS, React, Auth)

docker/nginx/nginx.conf

@@ -0,0 +1,79 @@
+# =============================================================
+# MPM – Reverse Proxy (Nginx)
+# Läuft als unprivilegierter Benutzer "app" auf Port 8080.
+# - /            -> Management-Frontend (SPA, statische Dateien)
+# - /api/        -> Management-Backend (127.0.0.1:3000)
+# Ab Phase 4 werden hier dynamisch Modul-Routen (/slug) ergänzt.
+# =============================================================
+
+worker_processes auto;
+pid /tmp/nginx.pid;
+error_log /dev/stderr warn;
+
+events {
+  worker_connections 1024;
+}
+
+http {
+  include /etc/nginx/mime.types;
+  default_type application/octet-stream;
+
+  access_log /dev/stdout;
+  server_tokens off;
+
+  sendfile on;
+  tcp_nopush on;
+
+  # Upload-Grenze (z. B. für Modul-ZIP-Pakete ab Phase 3)
+  client_max_body_size 10m;
+
+  gzip on;
+  gzip_types text/plain text/css application/javascript application/json image/svg+xml;
+  gzip_min_length 1024;
+
+  client_body_temp_path /tmp/nginx/client_body;
+  proxy_temp_path /tmp/nginx/proxy;
+  fastcgi_temp_path /tmp/nginx/fastcgi;
+  uwsgi_temp_path /tmp/nginx/uwsgi;
+  scgi_temp_path /tmp/nginx/scgi;
+
+  upstream platform_backend {
+    server 127.0.0.1:3000;
+  }
+
+  server {
+    listen 8080;
+    server_name _;
+
+    root /app/public;
+    index index.html;
+
+    # Sicherheits-Header
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
+
+    # Gehashte Frontend-Assets: lange cachen
+    location /assets/ {
+      expires 1y;
+      try_files $uri =404;
+    }
+
+    # Management-API ans Backend proxien
+    location /api/ {
+      proxy_pass http://platform_backend;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_read_timeout 30s;
+    }
+
+    # SPA-Fallback für React Router
+    location / {
+      try_files $uri $uri/ /index.html;
+    }
+  }
+}