Nginx setup

server
{
    listen 80;
    return 301 https://$host$request_uri;
}

server
{
    listen  443 default_server ssl;

    server_name  aida.yourcompany.com;
    server_tokens off;

    proxy_set_header host $host;
    proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
    proxy_set_header x-real-ip $remote_addr;
    proxy_set_header x-forwarded-proto $scheme;

    ssl_certificate /etc/ssl/aida.yourcompany.com/fullchain.crt;
    ssl_certificate_key /etc/ssl/aida.yourcompany.com/priv.key;

    # Perfect Forward Security
    ssl_protocols TLSv1.2 TLSv1.3;# Requires nginx >= 1.13.0 else use TLSv1.2
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/nginx/dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096
    ssl_ciphers EECDH+AESGCM:EDH+AESGCM;

    ssl_session_timeout  10m;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off; # Requires nginx >= 1.5.9

    add_header Content-Security-Policy "base-uri 'self'; report-uri /api/v1/csp-violation-report; require-trusted-types-for 'script'; default-src 'self' blob:; img-src * data:; worker-src 'self' blob:; child-src blob: gap:; object-src 'self' blob:; frame-src 'self' blob:; connect-src 'self' wss://aida.yourcompany.com/ blob:; script-src 'self' 'unsafe-eval' blob:; font-src * 'unsafe-inline' data:; style-src 'self' fonts.googleapis.com fonts.cdnfonts.com 'unsafe-inline'";
    
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Referrer-Policy strict-origin-when-cross-origin;
    add_header Cross-Origin-Opener-Policy same-origin;
    add_header Permissions-Policy "geolocation=()";

    location / {
        root   /app/frontend;
        try_files $uri $uri/ /index.html =404;
    }

    error_page   500 502 503 504  /50x.html;

    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    location /ws {
        proxy_pass http://your-aida-ip:5005;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header X-Real-IP $remote_addr;
    }

    location /api/v1 {
         add_header 'Access-Control-Expose-Headers' 'Authorization,Content-Disposition';
         proxy_pass http://your-aida-ip:5005;
         client_max_body_size 10000M;
    }

    access_log /var/log/nginx/nginx-access.log;
}