make it production ready

Dockerfile

@@ -1,4 +1,4 @@
-FROM nginx:alpine
+FROM nginx:1.30.5-alpine
 
 # Xóa file cấu hình mặc định của Nginx
 RUN rm -rf /etc/nginx/conf.d/*

nginx.conf

@@ -6,6 +6,12 @@ server {
     root /usr/share/nginx/html;
     index index.html index.htm;
 
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+    add_header Strict-Transport-Security "max-age=31536000" always;
+
     # Cấu hình nén để website tải nhanh hơn
     gzip on;
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
@@ -20,6 +26,11 @@ server {
     location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf)$ {
         expires 30d;
         add_header Cache-Control "public, no-transform";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+        add_header Strict-Transport-Security "max-age=31536000" always;
     }
 
     # Trang lỗi tùy chỉnh (tùy chọn)