feat(lab11): hardened nginx

[err0r522]

Goal

Configure Nginx with TLS 1.3 only, the full security-header set, and verify every header lands on real responses.
Operationalize the production posture — rate limiting on auth endpoints, fail-closed timeouts, modern cipher list, cert-rotation runbook.

Changes

• Added submissions/lab11.md - the submission file
• Edited labs/lab11/reverse-proxy/nginx.conf

Testing

   # Installation check
   docker compose version && openssl version
   
   Verify HTTPS redirect
   curl -sI http://localhost | tee labs/lab11/results/http-redirect.txt

   Verify TLS 1.3 negotiation
   echo | openssl s_client -connect localhost:443 -tls1_3 -brief 2>&1 | head -8 \
     | tee labs/lab11/results/tls13.txt

   Verify Security headers
   curl -skI https://localhost | tee labs/lab11/results/headers.txt

   # Rate limit: 60 concurrent POSTs to login should produce many 429s
   seq 1 60 | xargs -n1 -P 30 -I{} curl -sk -o /dev/null -w "%{http_code}\n" \
     https://localhost/rest/user/login 2>/dev/null | sort | uniq -c \
     | tee labs/lab11/results/ratelimit.txt

   # Timeout: send a partial HTTP request slowly; nginx should close after client_header_timeout
   (echo -ne "GET / HTTP/1.0\r\n"; sleep 15) | openssl s_client -connect localhost:443 -quiet 2>&1 | tee labs/lab11/results/timeout.txt

   # Cipher: verify TLS 1.3 cipher in use
   echo | openssl s_client -connect localhost:443 -tls1_3 2>&1 \
     | grep -E "Cipher|Server Temp Key" | tee labs/lab11/results/cipher.txt

Artifacts & Screenshots

nginx.conf

---

Checklist

• Task 1 — TLS 1.3 + 6 security headers (with proof)
• Task 2 — Rate limit + timeouts + cipher hardening + cert-rotation runbook
• Bonus — Coraza/ModSec WAF + OWASP CRS catching a payload Nginx-alone passes