nginx.conf

events {}
http {
    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;

        server_name pi;

        ssl_certificate /etc/ssl/certs/pi/nginx.crt;
        ssl_certificate_key /etc/ssl/private/pi/nginx.key;
        ssl_dhparam /etc/ssl/certs/pi/dhparam.pem;

        # Enable security headers
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; object-src 'none'" always;
	
        location /register {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_redirect off;
            proxy_cache_bypass $http_upgrade;
            proxy_pass http://127.0.0.1:8080;

            # allow only connections from the private network
            allow   10.0.0.0/8;
            allow   172.16.0.0/12;
            allow   192.168.0.0/16;
            deny all;
        }

        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_redirect off;
            proxy_cache_bypass $http_upgrade;
            proxy_pass http://127.0.0.1:8080;
        }

        # Specify a custom 403 page
        error_page 403 = @handle_403;

        location @handle_403 {
            return 302 /forbidden;
        }
    }
}