My nginx.conf used for reverse proxies for internal Node & React apps

nginx.conf

#user  root;
worker_processes  1;
error_log logs/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections  1024;
}


http {
    include mime.types;
    default_type application/octet-stream;
    server_tokens off;
    charset utf-8;
    log_not_found off;

    # Security headers
    add_header X-XSS-Protection 1;
    add_header X-Content-Type-Options nosniff;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    # add_header Feature-Policy "none 'none'";
    
    # Disable cache
    add_header Last-Modified $date_gmt;
    add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
    if_modified_since off;
    expires off;
    etag off;

    ## Size Limits & Buffer Overflow
    client_body_buffer_size 1K;
    client_header_buffer_size 1k;
    client_max_body_size 1k;
    large_client_header_buffers 2 1k;

    ## Set timeouts
    client_body_timeout 20;
    client_header_timeout 10;
    keepalive_timeout 20;
    send_timeout 10;
    proxy_no_cache 1;
    proxy_cache_bypass 1;    
    
    # System settings
    tcp_nodelay on;
    sendfile on;
    tcp_nopush on;

    # Limit maximum number of connections
    limit_conn_zone $binary_remote_addr zone=addr:5m;

    server {
        listen 80;
        server_name localhost;
        modsecurity on;
        limit_conn addr 5;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Host $remote_addr;
        modsecurity_rules_file /usr/local/nginx/conf/modsecurity.conf;
        proxy_http_version 1.1;

        # First reverse proxy
        location /api/ {
            proxy_pass http://localhost:8081;
        }

        # Second reverse proxy
        location / {
            proxy_pass http://localhost:8080;
        }

        # Allowed http methods
        if ($request_method !~ ^(GET|HEAD|POST|DELETE|PUT|PATCH)$ ){
             return 405;
        }

        # Redirect server error pages to the static page /50x.html
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root html;
        }

    }

    # HTTPS server
    #server {
    #    listen       443 ssl;
    #    server_name  localhost;

    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_cache    shared:SSL:1m;
    #    ssl_session_timeout  5m;

    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers  on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}

}