RecipesCam/docker/frontend/nginx.conf

# Static SPA + API proxy. TLS/domain are terminated outside (Nginx Proxy
# Manager), so this container only ever speaks plain HTTP on port 80.
server {
  listen 80;
  server_name _;
  root /usr/share/nginx/html;
  index index.html;

  # Static only, plus the API proxy below; a stricter CSP needs a per-app tune
  # (canvas wasm, the QR image host) and belongs here once it is done.
  # Cross-origin isolation: super-resolution runs onnxruntime's threaded wasm,
  # which needs a SharedArrayBuffer, which the browser only hands over when the
  # page is isolated. Both headers are required, and both must also sit on the
  # script responses a nested worker fetches — see the two locations below.
  add_header Cross-Origin-Opener-Policy "same-origin" always;
  add_header Cross-Origin-Embedder-Policy "require-corp" always;
  add_header X-Content-Type-Options "nosniff" always;
  add_header X-Frame-Options "DENY" always;
  add_header Referrer-Policy "strict-origin-when-cross-origin" always;

  gzip on;
  gzip_comp_level 5;
  gzip_min_length 1024;
  gzip_types text/css application/javascript application/json application/wasm image/svg+xml;

  # nginx's stock mime.types has no .mjs, and the browser refuses to run a module
  # the server hands over as octet-stream: onnxruntime's glue is one of those.
  # First match wins among regex locations, so this one stands before the
  # /wasm/ block that would otherwise swallow the file.
  # (Both locations below restate the isolation headers from above: an add_header
  # in a location drops every add_header inherited, and a worker script is fetched
  # under the embedder's COEP — Chromium blocks it as
  # `coep-frame-resource-needs-coep-header` without them.)
  location ~* \.mjs$ {
    types { application/javascript mjs; }
    expires 30d;
    add_header Cache-Control "public, immutable";
    add_header Cross-Origin-Opener-Policy "same-origin" always;
    add_header Cross-Origin-Embedder-Policy "require-corp" always;
    try_files $uri =404;
  }

  # canvas.wasm is ~8MB and the super-resolution model is ~5MB: immutable, hashed
  # or not, they never change under a given build. Fonts and the wall-frame
  # artwork are likewise static.
  location ~* ^/(wasm|models|assets)/ {
    expires 30d;
    add_header Cache-Control "public, immutable";
    add_header Cross-Origin-Opener-Policy "same-origin" always;
    add_header Cross-Origin-Embedder-Policy "require-corp" always;
    try_files $uri =404;
  }

  # The two files whose names never change but whose contents must: a cached worker
  # keeps answering with the previous build's shell long after the deploy that
  # replaced it, and a cached manifest keeps pointing at the icon set it shipped with.
  # Nothing else would ever flush them, which is exactly why they opt out of the
  # long-lived caching above. The worker is a script under the embedder's COEP like
  # the .mjs files, so it restates the two isolation headers for the same reason.
  location = /sw.js {
    add_header Cache-Control "no-cache";
    add_header Cross-Origin-Opener-Policy "same-origin" always;
    add_header Cross-Origin-Embedder-Policy "require-corp" always;
    try_files $uri =404;
  }

  location = /manifest.json {
    add_header Cache-Control "no-cache";
    try_files $uri =404;
  }

  # The shell is the third name that never changes and whose contents do: with no
  # header of its own a browser is free to guess a freshness window out of
  # Last-Modified — a tenth of the file's age — and hand a visitor the PREVIOUS
  # build's index.html for hours after a deploy. That page names that build's
  # hashed bundle, so a fixed shader keeps running as the broken one and a hard
  # reload is the only way out. The SPA fallback below lands here too (the
  # internal redirect re-matches locations), so /app and /library are covered by
  # the same line.
  # (Restated: an add_header in a location drops every add_header inherited, and
  # this document needs the isolation pair for the wasm renderer.)
  location = /index.html {
    add_header Cache-Control "no-cache";
    add_header Cross-Origin-Opener-Policy "same-origin" always;
    add_header Cross-Origin-Embedder-Policy "require-corp" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    try_files $uri =404;
  }

  # The one route that carries a whole data dir back in (see /api/admin/restore
  # — who may call it is the API's own admin check, done before it reads a byte).
  # The upload cap that holds everywhere else would reject it, and unpacking the
  # archive plus the restart takes longer than the stock read timeout. nginx
  # takes the longest matching prefix, so this one holds for that route while
  # /api/ below keeps the rest.
  location /api/admin/restore {
    resolver 127.0.0.11 valid=10s ipv6=off;
    set $api_upstream http://api:3000;
    proxy_pass $api_upstream$request_uri;
    proxy_http_version 1.1;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
    client_max_body_size 0;
    proxy_read_timeout 600s;
    proxy_send_timeout 600s;
  }

  location /api/ {
    # Resolved per request through Docker's embedded DNS, so the frontend can
    # start before the API container without nginx refusing to boot.
    resolver 127.0.0.11 valid=10s ipv6=off;
    set $api_upstream http://api:3000;
    proxy_pass $api_upstream$request_uri;
    proxy_http_version 1.1;
    # $http_host, not $host: keep the port when the visitor hits this container
    # directly (localhost:8090), since the API builds the verification link from
    # the forwarded host.
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    # Hand the API the scheme the visitor actually used (TLS is terminated by
    # Nginx Proxy Manager in front of this container) so it can mark the session
    # cookie Secure. Falls back to nothing when that header is absent.
    proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
    # Room for a full-size upload (the API caps photo bodies at 12m itself).
    client_max_body_size 16m;
  }

  # SPA fallback: /app, /login and /signup are all index.html.
  location / {
    try_files $uri $uri/ /index.html;
  }
}