Claude
96dca2a802
Implémente l'intégralité de la maquette « SLUC Business Club.dc.html » : - Site public : accueil (héro administrable, carrousel membres, agenda avec inscription en ligne, rencontres passées, demande d'adhésion), annuaire avec recherche/filtres/fiche détaillée, page association - Espace membre : connexion, édition de fiche avec aperçu direct, upload logo/photo, statut d'adhésion par saison, changement de mot de passe - Espace admin : tableau de bord, membres (validation par saison), rencontres (CRUD + inscrits + impression + export Excel), inscriptions, catégories, contenu du site Architecture : 3 conteneurs Docker Compose — PostgreSQL 16 (réseau interne, rôle applicatif restreint), API Express (non-root, read-only fs), nginx non privilégié (frontend React + reverse-proxy + CSP stricte). Sécurité : requêtes 100 % paramétrées, bcrypt + JWT httpOnly SameSite=Strict, vérification d'Origin (CSRF), validation zod, rate limiting, uploads vérifiés par octets magiques avec noms aléatoires, aucun secret committé. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fkg15RCxNgUys4ru73He2o
56 lines
2.1 KiB
Nginx Configuration File
56 lines
2.1 KiB
Nginx Configuration File
server {
|
|
listen 8080;
|
|
server_name _;
|
|
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
server_tokens off;
|
|
client_max_body_size 3m;
|
|
|
|
# Security headers
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data: blob:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" always;
|
|
|
|
gzip on;
|
|
gzip_types text/css application/javascript application/json image/svg+xml;
|
|
|
|
# API proxied to the backend container
|
|
location /api/ {
|
|
proxy_pass http://api:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# Uploaded images: served directly from the shared volume, never executed
|
|
location /uploads/ {
|
|
alias /var/www/uploads/;
|
|
types { image/jpeg jpg; image/png png; image/webp webp; }
|
|
default_type application/octet-stream;
|
|
# user-uploaded content: never allow it to script or be framed
|
|
add_header Content-Security-Policy "default-src 'none'; frame-ancestors 'none'" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Content-Disposition "inline" always;
|
|
add_header Cache-Control "public, max-age=86400" always;
|
|
}
|
|
|
|
# Static assets (immutable hashed filenames from Vite)
|
|
location /assets/ {
|
|
add_header Cache-Control "public, max-age=31536000, immutable" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
try_files $uri =404;
|
|
}
|
|
|
|
# SPA fallback
|
|
location / {
|
|
try_files $uri /index.html;
|
|
}
|
|
}
|