fix: fix bug docker

nginx.conf

@@ -1,10 +1,16 @@
 server {
-    listen 80;
+    listen 8080;
     server_name _;
+    server_tokens off;
 
     root /usr/share/nginx/html;
     index index.html;
 
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
     # ---- gzip ----
     gzip on;
     gzip_vary on;
@@ -26,33 +32,32 @@ server {
         font/woff2
         application/vnd.ms-fontobject;
 
-    # ---- Hashed static assets: cache hard ----
-    # ^~ so this wins over the regex block below for Vite's fingerprinted files
+    location = /healthz {
+        access_log off;
+        default_type text/plain;
+        return 200 "ok\n";
+    }
+
+    # Vite fingerprints files under /assets, so they can be cached for a year.
     location ^~ /assets/ {
         expires 1y;
-        add_header Cache-Control "public, immutable";
         try_files $uri =404;
     }
 
-    # ---- Other static files by extension ----
     location ~* \.(?:js|css|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|eot|mp4|webm)$ {
         expires 30d;
-        add_header Cache-Control "public";
         try_files $uri =404;
     }
 
-    # ---- SPA fallback: unknown routes -> index.html (React Router) ----
     location / {
         try_files $uri $uri/ /index.html;
     }
 
-    # index.html must never be cached, so new deploys are picked up
+    # Always revalidate the entrypoint so deployments are picked up immediately.
     location = /index.html {
-        add_header Cache-Control "no-cache, no-store, must-revalidate";
         expires -1;
     }
 
-    # Don't log noise / don't cache the favicon aggressively is fine as-is
     location = /favicon.ico {
         log_not_found off;
         access_log off;