Update nginx config in line with central (#630)

Co-authored-by: alxndrsn <alxndrsn>

Author: alxndrsn

Procfile

@@ -1,2 +1,2 @@
 vue: vue-cli-service build --mode development --watch
-nginx: nginx -c "$PWD/nginx.conf" -p "$PWD"
+nginx: nginx -c "$PWD/main.nginx.conf" -p "$PWD"

README.md

@@ -60,6 +60,6 @@ ODK Central Frontend communicates with ODK Central Backend in part using a sessi
 
 To build ODK Central Frontend files for production with minification, run `npm run build`. The files will be outputted to `dist/`. For more details on this command, see the [documentation](https://cli.vuejs.org/) for Vue CLI.
 
-Note that this repository's `nginx.conf` is for development only.
+Note that this repository's `main.nginx.conf` is for development only.
 
 For more information on deploying to production, see the [`central`](https://github.com/getodk/central) repository.

common-headers.nginx.conf

@@ -0,0 +1,7 @@
+# This file should be included in server{}, and also in any location{}
+# which has a call to add_header.
+# See: https://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
+
+add_header Strict-Transport-Security "max-age=63072000" always;
+add_header X-Frame-Options "SAMEORIGIN";
+add_header X-Content-Type-Options nosniff;

docs/enketo.md

@@ -47,7 +47,7 @@ Enketo runs as a Node.js server and caches intermediate representations of forms
 
 
 ### Notes on existing Central Frontend configuration
-- The following lines have already been added to [`nginx.conf`](../nginx.conf). They create a reverse proxy for the Enketo server in the same way as the reverse proxy to the ODK Central Backend server.
+- The following lines have already been added to [`main.nginx.conf`](../main.nginx.conf). They create a reverse proxy for the Enketo server in the same way as the reverse proxy to the ODK Central Backend server.
 
 ```
     location /- {

nginx.conf main.nginx.conf

@@ -53,8 +53,7 @@ http {
 
     server_tokens off;
 
-    add_header X-Frame-Options "SAMEORIGIN";
-    add_header X-Content-Type-Options nosniff;
+    include ./common-headers.nginx.conf;
 
     client_max_body_size 100m;
 
@@ -74,6 +73,7 @@ http {
       proxy_pass http://localhost:8383;
       proxy_redirect off;
 
+      include ./common-headers.nginx.conf;
       add_header Set-Cookie $session_cookie;
       proxy_set_header X-Forwarded-Proto https;
 
@@ -87,6 +87,7 @@ http {
       root ./dist;
 
       location /index.html {
+        include ./common-headers.nginx.conf;
         add_header Cache-Control no-cache;
       }
     }

src/components/form-attachment/list.vue

@@ -239,7 +239,7 @@ export default {
     a relatively low-resource device: we expect that a CSV file will not exceed
     a few dozen MBs.
 
-    Note that the development nginx.conf does not support request body
+    Note that the development main.nginx.conf does not support request body
     decompression. That means that in development, if this component gzips a CSV
     file, Backend will store the gzipped contents rather than the file's
     original contents.