chore: Improve Nginx configuration and Dockerfile security

Dockerfile

@@ -1,8 +1,20 @@
 FROM nginx:alpine
 
-# Create a custom nginx configuration
-RUN rm /etc/nginx/conf.d/default.conf
-COPY nginx.conf /etc/nginx/conf.d/
+# Create directories and set permissions first
+RUN mkdir -p /var/cache/nginx/client_temp /var/cache/nginx/proxy_temp \
+    /var/cache/nginx/fastcgi_temp /var/cache/nginx/uwsgi_temp /var/cache/nginx/scgi_temp \
+    && chmod 700 /var/cache/nginx/* \
+    && chown -R nginx:nginx /var/cache/nginx
+
+# Copy our custom nginx.conf to replace the default one
+COPY nginx.conf /etc/nginx/nginx.conf
+RUN chown -R nginx:nginx /etc/nginx
+
+# Clean up default conf
+RUN rm -f /etc/nginx/conf.d/default.conf
+
+# Switch to non-root user
+USER nginx
 
 # Expose port 7860
 EXPOSE 7860

nginx.conf

@@ -1,22 +1,44 @@
-server {
-    listen 7860;
-    server_name localhost;
+worker_processes auto;
+pid /tmp/nginx.pid;
 
-    location / {
-        proxy_pass https://sheer-8kp.pages.dev/;
-        proxy_set_header Host sheer-8kp.pages.dev;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_ssl_server_name on;
+events {
+    worker_connections 1024;
+}
 
-        # Additional useful headers
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
 
-        # Timeout settings
-        proxy_read_timeout 90;
-        proxy_connect_timeout 90;
-        proxy_send_timeout 90;
+    # Define temp file paths with permissions we can write to
+    client_body_temp_path /var/cache/nginx/client_temp;
+    proxy_temp_path       /var/cache/nginx/proxy_temp;
+    fastcgi_temp_path     /var/cache/nginx/fastcgi_temp;
+    uwsgi_temp_path       /var/cache/nginx/uwsgi_temp;
+    scgi_temp_path        /var/cache/nginx/scgi_temp;
+
+    sendfile        on;
+    keepalive_timeout  65;
+    
+    server {
+        listen 7860;
+        server_name localhost;
+
+        location / {
+            proxy_pass https://sheer-8kp.pages.dev/;
+            proxy_set_header Host sheer-8kp.pages.dev;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_ssl_server_name on;
+
+            # Additional useful headers
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+
+            # Timeout settings
+            proxy_read_timeout 90;
+            proxy_connect_timeout 90;
+            proxy_send_timeout 90;
+        }
     }
 }