chore: complete update

docker/nginx/default.conf

@@ -18,8 +18,8 @@ map $env_mode $should_skip_cache {
 
 # Skip-Cache für Sessions und basierend auf Umgebung
 map $http_cookie$should_skip_cache $skip_cache {
-    "~PHPSESSID"  1;       # Sessions nie cachen
-    "1"           1;       # Cache überspringen, wenn should_skip_cache = 1
+    "~ms_context"  1;       # Sessions nie cachen
+    "~1$"           1;       # Cache überspringen, wenn should_skip_cache = 1
     default       0;       # Ansonsten cachen
 }
 
@@ -41,23 +41,38 @@ server {
 server {
     # Korrigierte HTTP/2 Syntax
     listen 443 ssl;
+    listen [::]:443 ssl;
+    listen 443 quic; # QUIC für HTTP/3 // Removed "reuseport"
+    listen [::]:443 quic;
+
     http2 on;  # Neue Syntax für HTTP/2
+    http3 on;
+
+    add_header Alt-Svc 'h3=":443"; ma=86400; persist=1, h2=":443"; ma=86400';
+
     server_name localhost;
 
     #ssl_certificate /etc/nginx/ssl/localhost+2.pem;
     #ssl_certificate_key /etc/nginx/ssl/localhost+2-key.pem;
-    ssl_certificate /etc/nginx/ssl/fullchain.pem;
-    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
+    #ssl_certificate /etc/nginx/ssl/fullchain.pem;
+    #ssl_certificate_key /etc/nginx/ssl/privkey.pem;
+
+    ssl_certificate /var/www/ssl/fullchain.pem;
+    ssl_certificate_key /var/www/ssl/privkey.pem;
 
 
-    ssl_protocols TLSv1.2 TLSv1.3;
+    # add_header Alt-Svc 'h3=":443"'; # Für HTTP/3 Unterstützung
+    #add_header QUIC-Status $quic;
+
+
+    ssl_protocols TLSv1.3 TLSv1.2;
     ssl_prefer_server_ciphers on;
     ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
 
     # Verbesserte SSL-Konfiguration
-    ssl_session_timeout 1d;
-    ssl_session_cache shared:SSL:10m;
-    ssl_session_tickets off;
+    #ssl_session_timeout 1d;
+    #ssl_session_cache shared:SSL:10m;
+    #ssl_session_tickets off;
 
     # OCSP Stapling (auskommentiert, wenn Zertifikate fehlen)
     # ssl_stapling on;
@@ -68,6 +83,11 @@ server {
     root /var/www/html/public;
     index index.php index.html;
 
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+        autoindex off;
+    }
+
     # Debug-Header für die Entwicklung
     add_header X-Environment $env_mode always;
 
@@ -88,6 +108,34 @@ server {
     client_max_body_size 10m;
     large_client_header_buffers 2 1k;
 
+    brotli on;
+    brotli_comp_level 6;
+    brotli_types
+        application/atom+xml
+        application/javascript
+        application/json
+        application/ld+json
+        application/manifest+json
+        application/rss+xml
+        application/vnd.geo+json
+        application/vnd.ms-fontobject
+        application/x-font-ttf
+        application/x-web-app-manifest+json
+        application/xhtml+xml
+        application/xml
+        font/opentype
+        image/bmp
+        image/svg+xml
+        image/x-icon
+        text/cache-manifest
+        text/css
+        text/plain
+        text/vcard
+        text/vnd.rim.location.xloc
+        text/vtt
+        text/x-componentFs
+        text/x-cross-domain-policy;
+
     # Verbesserte Gzip-Kompression
     gzip on;
     gzip_vary on;
@@ -119,33 +167,43 @@ server {
         text/vcard
         text/vnd.rim.location.xloc
         text/vtt
-        text/x-component
+        text/x-componentFs
         text/x-cross-domain-policy;
 
     # Logs
-    access_log /var/log/nginx/access.log combined;
-    error_log /var/log/nginx/error.log error;
+    #access_log /var/log/nginx/access.log combined;
+    #error_log /var/log/nginx/error.log error;
+    access_log /dev/stdout;
+    error_log /dev/stderr warn;
 
-    location / {
-        try_files $uri $uri/ /index.php?$query_string;
-        autoindex off;
+    # läuft aktuell oben über dynamischen include!
+    #location / {
+    #    try_files $uri $uri/ /index.php?$query_string;
+    #    autoindex off;
+    #}
+
+    # Service-Worker explizit erlauben (auch im Production-Server ungefährlich!)
+    location = /sw.js {
+        # je nach Build-Ordner anpassen!
+        alias /var/www/html/public/sw.js;
+        add_header Cache-Control "no-cache, must-revalidate";
     }
 
     # Caching Header für statische Dateien
-    location ~* \.(jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|eot)$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable, max-age=31536000";
-    }
+    #location ~* \.(jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|eot)$ {
+    #    expires 1y;
+    #    add_header Cache-Control "public, immutable, max-age=31536000";
+    #}
 
     location ~* \.(css|js)$ {
         expires 1w;
         add_header Cache-Control "public, max-age=604800";
     }
 
-    location ~* \.(json|xml)$ {
-        expires 1d;
-        add_header Cache-Control "public, max-age=86400";
-    }
+#     location ~* \.(json|xml)$ {
+#         expires 1d;
+#         add_header Cache-Control "public, max-age=86400";
+#     }
 
     location ~ \.php$ {
         try_files $uri =404;
@@ -182,6 +240,8 @@ server {
 
         # Für bessere Performance
         fastcgi_keep_conn on;
+
+        fastcgi_hide_header X-Powered-By;
     }
 
     # Sicherheitseinstellungen