Removed nginx container. Added supervisord and nginx to build.

Dockerfile

@@ -15,8 +15,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
     libpq-dev \
     curl \
+    nginx \
     nodejs \
     npm \
+    supervisor \
     && rm -rf /var/lib/apt/lists/*
 
 # =============================================
@@ -42,16 +44,24 @@ RUN pip install --upgrade pip \
 WORKDIR /app
 COPY ./app .
 
+COPY nginx/configs/nginx.conf /etc/nginx/nginx.conf
+COPY nginx/configs/options-* /etc/nginx/
+#COPY nginx/configs/sites/ /etc/nginx/conf.d/
+COPY supervisor/supervisord.conf /etc/supervisor/supervisord.conf
+
 RUN python manage.py collectstatic --noinput
-RUN chmod +x /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh /app/scripts/gunicorn.sh
 
 # =============================================
-# 5. Create non-root user
+# 5. Create users for services
 # =============================================
-RUN adduser --disabled-password --gecos '' djangouser
+RUN adduser --system --no-create-home --group nginx \
-USER djangouser
+    && adduser --disabled-password --gecos '' djangouser
 
-EXPOSE 80
+RUN mkdir -p /var/cache/nginx \
+    && chown -R nginx:nginx /var/cache/nginx
+
+EXPOSE 443 8008
 
 # =============================================
 # 6. Launch the app

app/entrypoint.sh

@@ -11,6 +11,5 @@ python manage.py collectstatic --noinput
 python manage.py migrate --noinput
 python manage.py ensure_admin
 
-exec gunicorn keywarden.wsgi:application --bind 0.0.0.0:80 --workers 3
+exec /usr/bin/supervisord -c /etc/supervisor/supervisord.conf
-
 

app/scripts/gunicorn.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+
+exec gunicorn keywarden.wsgi:application --bind 0.0.0.0:8000 --workers 3

app/static/unfold/js/app.js

@@ -10,8 +10,41 @@ window.addEventListener("load", (e) => {
   warnWithoutSaving();
 
   tabNavigation();
+
+  scrollSidebarNav();
 });
 
+/*************************************************************
+ * Scroll sidebar to active item
+ *************************************************************/
+function scrollSidebarNav() {
+  const sidebarNav = document.getElementById("nav-sidebar-apps");
+
+  if (!sidebarNav) {
+    return;
+  }
+
+  const instance = SimpleBar.instances.get(sidebarNav);
+  const activeItem = sidebarNav.querySelector("a.active");
+
+  if (!instance || !activeItem) {
+    return;
+  }
+
+  function isActiveItemVisible() {
+    const sidebarRect = sidebarNav.getBoundingClientRect();
+    const itemRect = activeItem.getBoundingClientRect();
+
+    return (
+      itemRect.top >= sidebarRect.top && itemRect.bottom <= sidebarRect.bottom
+    );
+  }
+
+  if (instance && !isActiveItemVisible()) {
+    instance.getScrollElement().scroll(0, activeItem.offsetTop);
+  }
+}
+
 /*************************************************************
  * Move not visible tab items to dropdown
  *************************************************************/

nginx/configs/.sites/default.conf

@@ -9,9 +9,8 @@ server {
 
 
 server {
-    listen 443 ssl;
+    listen 443 ssl http2;
-    listen [::]:443 ssl;
+    listen [::]:443 ssl http2;
-        http2 on;
 
     server_name _;
 
@@ -22,7 +21,7 @@ server {
     client_max_body_size 50M;
 
     location / {
-        proxy_pass  http://keywarden:80;
+        proxy_pass  http://127.0.0.1:8000;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

nginx/configs/nginx.conf

@@ -14,14 +14,45 @@ events {
 http {
     real_ip_header X-Forwarded-For;
     include       /etc/nginx/mime.types;
+    include options-ssl.conf;
+    include options-http-headers.conf;
     default_type  application/octet-stream;
 
     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for"';
 
-    access_log  /var/log/nginx/access.log main;
+    server {
-    include /etc/nginx/conf.d/*.conf;
+        listen 80 default_server;
+        listen [::]:80 default_server;
+        server_name _;
+        return 301 https://$host$request_uri;
+    }
 
+    server {
+        listen 443 ssl;
+        listen [::]:443 ssl;
+        http2 on;
+        server_name _;
+
+        ssl_certificate /certs/certificate.pem;
+        ssl_certificate_key /certs/key.pem;
+        include options-ssl.conf;
+        include options-https-headers.conf;
+
+        client_max_body_size 50M;
+        
+        location / {
+            proxy_pass  http://127.0.0.1:8000;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto  $scheme;
+            include options-https-headers.conf;        
+            }
+    }
+
+    access_log  /var/log/nginx/access.log main;
     types_hash_bucket_size 128;
 }
+

nginx/configs/options-http-headers.conf

@@ -0,0 +1,5 @@
+add_header Content-Security-Policy "default-src 'self'; font-src *;img-src * data:; script-src * 'unsafe-eval'; style-src * 'unsafe-inline'";
+add_header X-Frame-Options "SAMEORIGIN";
+add_header X-Content-Type-Options nosniff;
+add_header Referrer-Policy "strict-origin";
+add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()";

nginx/configs/options-https-headers.conf

@@ -0,0 +1,2 @@
+include options-http-headers.conf;
+add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload';

nginx/configs/options-ssl.conf

@@ -4,11 +4,13 @@
 # the up-to-date file that you will need to refer to when manually updating
 # this file.
 
-ssl_session_cache shared:le_nginx_SSL:10m;
+ssl_session_cache shared:SSL:50m;
-ssl_session_timeout 1440m;
+ssl_session_timeout 1d;
 ssl_session_tickets off;
 
 ssl_protocols TLSv1.2 TLSv1.3;
-ssl_prefer_server_ciphers off;
+ssl_prefer_server_ciphers on;
 
 ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+
+server_tokens off;

supervisor/supervisord.conf

@@ -0,0 +1,28 @@
+[supervisord]
+nodaemon=true
+logfile=/var/log/supervisord.log
+pidfile=/var/run/supervisord.pid
+
+[program:gunicorn]
+command=/app/scripts/gunicorn.sh
+directory=/app
+user=djangouser
+autostart=true
+autorestart=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+stopsignal=TERM
+stopasgroup=true
+killasgroup=true
+
+[program:nginx]
+command=/usr/sbin/nginx -g "daemon off;"
+autostart=true
+autorestart=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+stopsignal=QUIT