feat: Self-hosting nginx config improvements

[nimish-ks]

🔍 Overview

Misc security, compatibility and quality of life improvements to the self-hosting default.conf Nginx config.

💡 Proposed Changes

• hardened cipher suites - enforce EECDH+AESGCM:EECDH+CHACHA20 on TLSv1.2 TLSv1.3;
• strip nginx version from sever response header - server_tokens off;
• fix: http deprecated directive - http2 on;
• added: cloudflare ip forwarding scaffolding - $http_cf_connecting_ip forwarding logic
• documented routing structure
• removed unused routes

---

Note

Harden Nginx TLS and headers, enable HTTP/2, add Cloudflare IP-forwarding scaffold, restructure config, and remove the /kms/ route.

• Nginx config (nginx/default.conf):
  • Security/Protocol:
    • Enforce ssl_protocols TLSv1.2 TLSv1.3 and set ssl_ciphers EECDH+AESGCM:EECDH+CHACHA20; enable ssl_prefer_server_ciphers on.
    • Hide version with server_tokens off.
    • Enable http2 on.
  • Structure:
    • Wrap configuration in http { server { ... } }; keep listen 80 and listen 443 ssl.
    • Add commented Cloudflare IP-forwarding scaffold using $http_cf_connecting_ip mapping.
  • Routing:
    • Retain /service/ backend routing with rewrite and cookie/security headers.
    • Retain / frontend routing with WebSocket headers.
    • Remove location /kms/ route.

^{Written by Cursor Bugbot for commit 4539944. Configure here.}

[nimish-ks]

@cursor review

[Copilot]

Pull Request Overview

This PR enhances the self-hosting nginx configuration with security hardening, HTTP/2 support via the modern directive syntax, and optional Cloudflare IP forwarding scaffolding. The changes improve TLS security, hide server version information, and remove the cloud-only /kms/ route that's not applicable to self-hosted deployments.

Key changes:

• Hardened TLS configuration with restricted cipher suites (TLSv1.2/1.3 only) and server cipher preference
• Modernized HTTP/2 enablement using the http2 on; directive instead of deprecated listen 443 ssl http2; syntax
• Added security header server_tokens off to hide nginx version information
• Included commented-out Cloudflare IP forwarding configuration for users behind Cloudflare
• Removed the /kms/ route which only exists in cloud-hosted mode (APP_HOST == "cloud")

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.