Comment by superkuh

A more secure (and much simpler to maintain) version would be just running nginx from your repos without all these extra things. nginx is secure by default. The insecurity comes when you pile on all the dynamic and container stuff.