Harden production security: Dockerfile build, nginx whitelist, and CSP.

Replace Dokploy runtime git clone with Dockerfile build to keep tokens out of the container, add nginx security headers and path whitelist, and scrub templates from the running image after HTML generation.

Co-authored-by: Cursor <cursoragent@cursor.com>

default.conf

@@ -10,9 +10,24 @@ server {
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml image/svg+xml;
     gzip_min_length 1024;
 
+    # Block hidden files and sensitive extensions
+    location ~ /\. {
+        deny all;
+        return 404;
+    }
+
+    location ~* \.(sh|template|env|yml|yaml|md|git|bak|sql|log)$ {
+        deny all;
+        return 404;
+    }
+
     # Main page
-    location / {
-        try_files $uri $uri/ /index.html;
+    location = / {
+        try_files /index.html =404;
+    }
+
+    location = /index.html {
+        add_header Cache-Control "no-cache";
     }
 
     # Web app manifest
@@ -29,7 +44,15 @@ server {
         try_files $uri =404;
     }
 
+    # Everything else → 404 (no fallback to index.html)
+    location / {
+        return 404;
+    }
+
     # Security headers
     add_header X-Frame-Options SAMEORIGIN always;
     add_header X-Content-Type-Options nosniff always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://www.youtube.com https://www.gstatic.com; style-src 'self' 'unsafe-inline'; img-src 'self' https://img.youtube.com data:; frame-src https://www.youtube.com; connect-src 'self' https://www.youtube.com; base-uri 'self'; form-action 'none'; object-src 'none'; upgrade-insecure-requests;" always;
 }