nginx.conf

# nginx.conf
worker_processes auto;

pid /tmp/nginx.pid;

events {
  worker_connections 4096;
}

http {
  include /etc/nginx/mime.types;
  client_body_temp_path /tmp/client_temp;
  proxy_temp_path       /tmp/proxy_temp_path;
  fastcgi_temp_path     /tmp/fastcgi_temp;
  uwsgi_temp_path       /tmp/uwsgi_temp;
  scgi_temp_path        /tmp/scgi_temp;
  default_type  application/octet-stream;
  server_tokens off;
  underscores_in_headers on;

  server {
    # Enable HTTP Strict Transport Security (HSTS) to force clients to always
    # connect via HTTPS (do not use if only testing)
    add_header Strict-Transport-Security "max-age=31536000;";

    # Enable cross-site filter (XSS) and tell browser to block detected attacks
    add_header X-XSS-Protection "1; mode=block";

    # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
    add_header X-Content-Type-Options "nosniff";

    # Disallow the site to be rendered within a frame (clickjacking protection)
    add_header X-Frame-Options "DENY";

    # Turn off all caddy caching
    add_header Cache-Control "no-cache,no-store,must-revalidate";
    add_header Pragma "no-cache";

    # Content Security Policy
    add_header Content-Security-Policy "default-src 'self'; frame-src 'self' *.gov.bc.ca *.hotjar.com *.googleapis.com https://*.nr-data.net https://*.newrelic.com https://*.cac1.pure.cloud; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.gov.bc.ca *.hotjar.com *.googleapis.com https://*.nr-data.net https://*.newrelic.com https://*.cac1.pure.cloud; style-src 'self' 'unsafe-inline' *.cloudflare.com; font-src 'self' *.gov.bc.ca *.hotjar.com *.cloudflare.com; img-src 'self' data: *.hotjar.com https://*.cac1.pure.cloud; connect-src 'self' *.gov.bc.ca *.launchdarkly.com *.hotjar.com *.postescanada-canadapost.ca *.sentry.io *.apigee.net wss://*.hotjar.com *.hotjar.io https://*.nr-data.net https://shyrka-prod-cac1.s3.ca-central-1.amazonaws.com https://*.newrelic.com https://*.cac1.pure.cloud wss://*.cac1.pure.cloud; manifest-src 'self'; media-src 'self' https://*.cac1.pure.cloud; object-src 'self' https://*.cac1.pure.cloud; child-src 'self' https://*.cac1.pure.cloud;";

    listen 8080;
    server_name _;

    index index.html;
    error_log /dev/stdout info;
    access_log /dev/stdout;
    root /app;

    location /namerequest {
      alias /app;
      try_files $uri @index;
      gzip on;
      gzip_vary on;
      gzip_min_length 10240;
      gzip_proxied any;
      gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml;
      gzip_disable "MSIE [1-6]\.";
    }

     location @index {
      expires 0;
      try_files /index.html =404;
    }

    # For status of ngnix service, OpenShift is configured to call this
    location /nginx_status {
      # Enable Nginx stats
      stub_status on;

      # Only allow access from localhost
      allow all;

      # Other request should be denied
      # deny all;

      # No need to log this request, its just noise
      access_log off;
    }
  }
}