TODO

HSTS, make sure nginx only can do tls: https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/
Encrypt all data in transit with secure protocols such as TLS with forward secrecy (FS) ciphers, cipher prioritization by the server, and secure parameters. Enforce encryption using directives like HTTP Strict Transport Security (HSTS).

Disable caching for response that contain sensitive data.

secure config (disable directory listing, anything default in nginx)