From d8568849b4fb2f5f3f73e394cdca311c6e7ba672 Mon Sep 17 00:00:00 2001
From: nmemmert <67961292+nmemmert@users.noreply.github.com>
Date: Mon, 31 Aug 2026 08:46:17 -0400
Subject: [PATCH] chore: switch nginx to HTTP-only for Cloudflare Flexible SSL

Cloudflare terminates TLS at the edge; origin only needs port 80.
Removes SSL cert requirement, drops port 443 from compose.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 docker-compose.yml |  2 --
 nginx/nginx.conf   | 18 +++---------------
 2 files changed, 3 insertions(+), 17 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index b98ef7b..a966418 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -53,11 +53,9 @@ services:
     image: nginx:alpine
     restart: unless-stopped
     ports:
-      - "${HOST_PORT:-443}:443"
       - "80:80"
     volumes:
       - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./nginx/ssl:/etc/nginx/ssl:ro
     depends_on:
       - backend
       - frontend
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 4a1414c..94d5da5 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -7,26 +7,14 @@ http {
     keepalive_timeout 65;
     client_max_body_size 110m;
 
-    # Redirect HTTP → HTTPS
     server {
         listen 80;
-        return 301 https://$host$request_uri;
-    }
 
-    server {
-        listen 443 ssl http2;
-        ssl_certificate     /etc/nginx/ssl/fullchain.pem;
-        ssl_certificate_key /etc/nginx/ssl/privkey.pem;
-        ssl_protocols TLSv1.2 TLSv1.3;
-        ssl_ciphers HIGH:!aNULL:!MD5;
-        ssl_session_cache shared:SSL:10m;
-
-        # Security headers
-        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        # Security headers (Cloudflare handles TLS; these still apply)
         add_header X-Frame-Options DENY always;
         add_header X-Content-Type-Options nosniff always;
         add_header Referrer-Policy no-referrer always;
-        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss:;" always;
+        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss: https:;" always;
 
         # API
         location /api/ {
@@ -35,7 +23,7 @@ http {
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
         }
 
         # WebSocket