From 30c6ee577c698036776d31b03450c40322e21ab2 Mon Sep 17 00:00:00 2001
From: Quang Khai Nguyen <quang_khai.nguyen2@sbb.ch>
Date: Mon, 12 Oct 2026 10:22:41 +0200
Subject: [PATCH] make it production ready

---
 Dockerfile |  2 +-
 nginx.conf | 11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 0f98097..9a8be86 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM nginx:alpine
+FROM nginx:1.30.5-alpine
 
 # Xóa file cấu hình mặc định của Nginx
 RUN rm -rf /etc/nginx/conf.d/*
diff --git a/nginx.conf b/nginx.conf
index 290a0d7..fe8ba36 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -6,6 +6,12 @@ server {
     root /usr/share/nginx/html;
     index index.html index.htm;
 
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+    add_header Strict-Transport-Security "max-age=31536000" always;
+
     # Cấu hình nén để website tải nhanh hơn
     gzip on;
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
@@ -20,6 +26,11 @@ server {
     location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf)$ {
         expires 30d;
         add_header Cache-Control "public, no-transform";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+        add_header Strict-Transport-Security "max-age=31536000" always;
     }
 
     # Trang lỗi tùy chỉnh (tùy chọn)