nginx.conf

# NOVO ARQUIVO nginx.conf LIMPO (Apenas o bloco 'server' ou 'http')

server {
    listen 443 ssl http2;
    server_name _; 

    # REGRAS FAPI
    ssl_protocols TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256';
    ssl_prefer_server_ciphers on;
    ssl_ecdh_curve prime256v1:secp384r1:secp521r1;

    # CERTIFICADOS (Chaves lidas da pasta montada)
    ssl_certificate     /etc/nginx/certs/server.crt;
    ssl_certificate_key /etc/nginx/certs/server.key;

    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

    # Proxy para o servidor OIDC
    location / {
      proxy_pass http://oidc-fapi-server:3000; 
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-Proto https; 
    }
}