Add nginx reverse proxy for Plausible analytics and security filtering

[mroderick]

Summary

This PR implements the proposal from #2580 to run nginx as a reverse proxy in front of Rails on Heroku. This achieves two primary goals:

1. Plausible Proxy — Serve Plausible analytics through our domain, bypassing adblockers
2. Security Filtering — Block obvious bad actors and common attack patterns before they reach Rails

Changes

Infrastructure

• Add heroku-community/nginx buildpack configuration (config/nginx.conf.erb)
• Update Procfile to use bin/start-nginx wrapper
• Configure Puma to bind to Unix socket on Heroku (config/puma.rb)

Analytics

• Update Plausible snippet to use proxied endpoints (/js/script.js, /api/event)
• Pass through Cache-Control headers from Plausible

Security

• Block known malicious user agents (Nikto, sqlmap, etc.) — returns HTTP 444
• Block common attack paths (WordPress, config files, admin tools)
• Add security headers at nginx level:
  • X-Frame-Options: SAMEORIGIN
  • X-Content-Type-Options: nosniff
  • X-XSS-Protection: 1; mode=block
  • Referrer-Policy: strict-origin-when-cross-origin
• Set proxy timeouts (5s connect/send, 10s read)
• Limit request body size on analytics endpoint (1m)
• Restrict Unix socket permissions to owner-only (umask 0077)

Security Review

This implementation has been reviewed against OWASP Top 10 (2021):

• ✅ A01 Broken Access Control — Socket permissions, path blocking
• ✅ A05 Security Misconfiguration — Security headers present
• ✅ A06 Vulnerable Components — Official buildpack, timeouts configured
• All other categories: No issues identified

Deployment

Required (one-time):

heroku buildpacks:add --index 1 heroku-community/nginx --app codebar-staging
heroku buildpacks:add --index 1 heroku-community/nginx --app codebar-production

Deployment:

1. Deploy to staging first
2. Run manual testing checklist (see Testing section below)
3. Monitor for 24 hours
4. Deploy to production

Testing Checklist

Plausible Proxy:

• /js/script.js returns Plausible script with correct content-type
• /api/event accepts POST and forwards to Plausible
• Plausible dashboard shows events from staging
• Response headers include Cache-Control from Plausible

Security Filters:

• curl -A "Nikto" https://staging/ returns 444 (no response)
• curl https://staging/.env returns 444
• curl https://staging/wp-admin returns 444

Rails Functionality:

• Homepage loads correctly
• Login works
• Workshop pages load
• Admin area accessible (with auth)
• Assets load (CSS, JS, images)
• Forms submit correctly

Rollback

If issues arise:

heroku buildpacks:remove heroku-community/nginx --app codebar-production
heroku rollback --app codebar-production

References

• Proposal: Proposal: Nginx for Plausible Proxy + Security Filtering #2580
• Plausible proxy guide: https://plausible.io/docs/proxy/guides/nginx
• Heroku nginx buildpack: https://github.com/heroku/heroku-buildpack-nginx

[till]

Why doesn't this config use proxy_cache etc. as outlined in the docs?

https://plausible.io/docs/proxy/guides/nginx

[till]

And resolver