prevent preview updates from overwriting drawings

frontend/nginx.conf.template

@@ -6,6 +6,14 @@ http {
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
+    # Preserve upstream TLS context (if present) when proxying to backend.
+    # Falls back to current scheme when no forwarded proto is provided.
+    map $http_x_forwarded_proto $forwarded_proto {
+        default $scheme;
+        ~*^https(?:,|$) https;
+        ~*^http(?:,|$) http;
+    }
+
     sendfile on;
     keepalive_timeout 65;
     gzip on;
@@ -21,6 +29,12 @@ http {
         root /usr/share/nginx/html;
         index index.html;
 
+        add_header X-Frame-Options "DENY" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+        add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob: https:; connect-src 'self' https: ws: wss:;" always;
+
         # API and WebSocket proxy to backend
         # BACKEND_URL is substituted at container startup (default: backend:8000)
         location /api/ {
@@ -32,7 +46,7 @@ http {
             proxy_cache_bypass $http_upgrade;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $forwarded_proto;
             
             # Buffer and timeout settings for large payloads
             proxy_buffering on;
@@ -57,7 +71,7 @@ http {
             proxy_cache_bypass $http_upgrade;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $forwarded_proto;
             
             # Longer timeouts for WebSocket connections
             proxy_read_timeout 3600s;