# `platform/nginx/`

Nginx configs for two roles:

| File                    | Role                                                              |
| ----------------------- | ----------------------------------------------------------------- |
| `web-angular.conf`      | SPA-serving config baked into the `web-angular` image             |
| `reverse-proxy.conf`    | Standalone edge proxy in front of API + SPA (single-host deploys) |
| `security-headers.conf` | Shared security headers included by both                          |

## Where this runs

- **Inside the `web-angular` image**: `web-angular.conf` + `security-headers.conf` ship inside the container. The container is fronted by either this reverse proxy (single host) or a K8s Ingress (cluster).
- **As a separate edge container**: `reverse-proxy.conf` terminates TLS, applies rate limits, and routes to the `api-dotnet` + `web-angular` services.

## Rate-limit zones

| Zone        | Rate                     | Used for                                         |
| ----------- | ------------------------ | ------------------------------------------------ |
| `api_zone`  | 100 req/min/IP, burst 20 | `/api/*`                                         |
| `auth_zone` | 10 req/min/IP, burst 5   | `/api/auth/*` (login + refresh + password reset) |

## Conventions

- TLS 1.2+ only. ECDHE ciphers; `ssl_prefer_server_ciphers on`.
- HSTS only on HTTPS. Comment out behind a non-HTTPS proxy in dev.
- CSP intentionally tight — relax per-app with an ADR.
- Hashed static assets cached 1 year; `index.html` always `no-store`.
