# NGINX TLS 1.3 Configuration for DPDPA Rule 6(1)(a)
# Version: 1.0 | Date: 2026-04-02
# Usage: Include this in your nginx.conf or site config

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name api.example.com;  # Replace with your domain

    # TLS 1.3 only (disable TLS 1.0, 1.1, 1.2)
    ssl_protocols TLSv1.3;

    # Strong cipher suites for TLS 1.3
    ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256;

    # Let client choose cipher (TLS 1.3 best practice)
    ssl_prefer_server_ciphers off;

    # Certificate paths (update with your cert paths)
    ssl_certificate /etc/ssl/certs/api.example.com.crt;
    ssl_certificate_key /etc/ssl/private/api.example.com.key;

    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/ssl/certs/ca-chain.crt;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # Session cache (improve performance)
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;  # Disable for forward secrecy

    # HSTS (Strict-Transport-Security) - 1 year
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # Additional security headers
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # HTTP/2 settings
    http2_push_preload on;

    location / {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# HTTP to HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name api.example.com;

    return 301 https://$server_name$request_uri;
}