nginx.conf

# Production NGINX configuration with HTTP/2 and SSL enabled for Pollution Control Hub
worker_processes auto;

events {
    worker_connections 1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    # Enable logging
    access_log  /var/log/nginx/access.log;
    error_log   /var/log/nginx/error.log warn;

    # Basic Optimization Settings
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;
    types_hash_max_size 2048;
    server_tokens off;

    # Gzip Compression
    gzip on;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;

    # HTTP/2 settings
    http2_max_concurrent_streams 128;

    # HTTP (Port 80) -> Redirect all traffic to HTTPS (Port 443)
    server {
        listen 80;
        listen [::]:80;
        server_name localhost;

        return 301 https://$host$request_uri;
    }

    # HTTPS (Port 443) -> Server with HTTP/2 enabled
    server {
        # Enable HTTP/2 and SSL
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name localhost;

        # SSL Certificates (Configure paths according to your target deployment environment)
        ssl_certificate /etc/nginx/certs/nginx.crt;
        ssl_certificate_key /etc/nginx/certs/nginx.key;

        # Recommended Modern SSL/TLS Configuration
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
        
        # Session Caching
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 1d;
        ssl_session_tickets off;

        # Security Headers
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade" always;
        add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

        # Document Root (Vite production build folder)
        root /usr/share/nginx/html;
        index index.html;

        # SPA routing: fallback to index.html for client-side routing
        location / {
            try_files $uri $uri/ /index.html;
        }

        # Cache static assets (JS, CSS, images, PWA files) for optimal load times
        location ~* \.(?:ico|css|js|gif|jpe?g|png|svg|woff2?|json)$ {
            expires 1y;
            add_header Cache-Control "public, no-transform";
            access_log off;
        }

        # Error Pages fallback
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /usr/share/nginx/html;
        }
    }
}