#cloud-config
package_update: true
package_upgrade: true

packages:
  - nginx
  - certbot
  - python3-certbot-nginx
  - ufw

write_files:
  - path: /etc/nginx/sites-available/default
    content: |
      server {
          listen 80 default_server;
          listen [::]:80 default_server;
          
          root /var/www/html;
          index index.html index.htm index.nginx-debian.html;
          
          server_name _;
          
          location / {
              try_files $uri $uri/ =404;
          }
          
          # Security headers
          add_header X-Frame-Options "SAMEORIGIN" always;
          add_header X-XSS-Protection "1; mode=block" always;
          add_header X-Content-Type-Options "nosniff" always;
          add_header Referrer-Policy "no-referrer-when-downgrade" always;
          add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
      }
  - path: /var/www/html/index.html
    content: |
      
      
      
          
      
      
          
Welcome to NGINX
          
Server is running successfully!
      
      

runcmd:
  - systemctl enable nginx
  - systemctl start nginx
  - ufw allow 'Nginx Full'
  - ufw --force enable
  - nginx -t