Aplicativos de Atrair Leads

2026-06-03 22:07:59 -03:00
parent e5c18bb6fc
commit fdfb4606f0
16 changed files with 371 additions and 235 deletions
@@ -0,0 +1,132 @@
+# ============================================================================
+# Configuracao Nginx - Avanzato Tecnologia
+# ============================================================================
+# Inclui: CSP, HSTS, X-Frame-Options, cache headers, gzip, brotli
+# Copiar para: /etc/nginx/sites-available/avanzato.com.br
+# Ativar: ln -s /etc/nginx/sites-available/avanzato.com.br /etc/nginx/sites-enabled/
+# ============================================================================
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name avanzato.com.br www.avanzato.com.br;
+    
+    # Redirecionar HTTP para HTTPS
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name avanzato.com.br www.avanzato.com.br;
+
+    # SSL (certbot gerencia automaticamente)
+    ssl_certificate /etc/letsencrypt/live/avanzato.com.br/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/avanzato.com.br/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/avanzato.com.br/chain.pem;
+
+    # SSL hardening
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+
+    # HSTS - HTTP Strict Transport Security
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+
+    # Root do projeto
+    root /var/www/avanzato/dist;
+    index index.html;
+
+    # Gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_types
+        text/plain
+        text/css
+        text/xml
+        text/javascript
+        application/json
+        application/javascript
+        application/xml+rss
+        application/atom+xml
+        image/svg+xml
+        font/woff2;
+
+    # ============================================================================
+    # CACHE HEADERS - Assets estaticos
+    # ============================================================================
+    
+    # Imagens, fontes, videos - 1 mes
+    location ~* \.(jpg|jpeg|png|gif|ico|svg|webp|woff|woff2|ttf|eot|mp4|webm)$ {
+        expires 1M;
+        add_header Cache-Control "public, immutable" always;
+        add_header Vary "Accept-Encoding" always;
+        access_log off;
+    }
+
+    # CSS e JS - 1 ano (tem hash no nome)
+    location ~* \.(css|js)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable" always;
+        add_header Vary "Accept-Encoding" always;
+        access_log off;
+    }
+
+    # HTML - nao cachear
+    location ~* \.html$ {
+        expires -1;
+        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+        add_header Pragma "no-cache" always;
+    }
+
+    # ============================================================================
+    # SECURITY HEADERS
+    # ============================================================================
+    
+    # Content Security Policy
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://connect.facebook.net https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://dns.google https://crt.sh https://mkt.avanzato.com.br https://www.google-analytics.com https://www.facebook.com; frame-src 'self' https://mkt.avanzato.com.br; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests;" always;
+
+    # X-Frame-Options - protecao contra clickjacking
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    # X-Content-Type-Options
+    add_header X-Content-Type-Options "nosniff" always;
+
+    # Referrer Policy
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Permissions Policy
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=()" always;
+
+    # Cross-Origin Opener Policy
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+
+    # Cross-Origin Resource Policy
+    add_header Cross-Origin-Resource-Policy "cross-origin" always;
+
+    # ============================================================================
+    # REACT ROUTER - SPA fallback
+    # ============================================================================
+    
+    location / {
+        try_files $uri $uri/ /index.html;
+        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+    }
+
+    # Sitemap e robots - acessiveis
+    location = /sitemap.xml {
+        try_files $uri =404;
+        add_header Content-Type "application/xml" always;
+    }
+
+    location = /robots.txt {
+        try_files $uri =404;
+        add_header Content-Type "text/plain" always;
+    }
+}