Add Python form API + harden nginx web root

- New api/ Python service (stdlib only — no pip install, no packages):
  validates fields server-side, verifies reCAPTCHA, sends via Resend
  with idempotency key, rate-limited (5 req/IP/15min)
- Matches existing project tooling (build_locations.py, build_services.py)
- Front-end form.js stays vanilla JS, no JS frameworks anywhere
- docker-compose runs nginx + python:3.13-alpine api with healthcheck
- nginx proxies /api/ to Python service, strips prefix
- Dockerfile now copies only public folders into web root (was
  copying everything, exposing /Dockerfile, /build_*.py, /api/.env)
- nginx.conf denies dotfiles, .env, .conf, .yml, .py, .md, .txt
  and Dockerfile as defense in depth
- .dockerignore keeps sensitive files out of build context
- .gitignore protects api/.env and __pycache__ from being committed

This commit is contained in:

Concept Agent

2026-05-08 18:22:46 +02:00

parent b363d19da7

commit e0b9e27b90

9 changed files with 338 additions and 1 deletions

									
										api/Dockerfile
									
		+5
		
												View File
												
				@@ -0,0 +1,5 @@

				FROM python:3.13-alpine

				WORKDIR /app

				COPY server.py .

				EXPOSE 3001

				CMD ["python3", "-u", "server.py"]