devncode-2.0/nginx.conf at main · devncode/devncode-2.0 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
server {
    listen 80;
    server_name _;

    # Redirect all HTTP to HTTPS (if HTTPS is configured)
    # Uncomment when HTTPS is enabled:
    # return 301 https://$host$request_uri;

    root /usr/share/nginx/html;
    index index.html;

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/javascript application/json;

    # Favicon and icons - no cache to allow updates
    location ~* ^/(favicon|apple-touch-icon|icon-) {
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        add_header Pragma "no-cache" always;
        add_header Expires "0" always;
    }

    # Also handle /favicon.ico specifically (browsers often request this)
    location = /favicon.ico {
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        add_header Pragma "no-cache" always;
        add_header Expires "0" always;
        try_files /favicon.png /favicon.ico =404;
    }

    # Cache static assets (long cache with versioning)
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # HTML files - no cache to ensure fresh content
    location ~* \.(html)$ {
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Pragma "no-cache";
        add_header Expires "0";
        # Cloudflare cache control
        add_header CF-Cache-Status "BYPASS";
    }

    # Disable directory listing (prevents 403 on directory access)
    autoindex off;

    # Handle trailing slashes - redirect to non-trailing version
    location ~ ^(.+)/$ {
        try_files $1 $1.html /index.html;
    }

    # Handle client-side routing (SPA fallback)
    location / {
        # Don't cache HTML files
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        add_header Pragma "no-cache" always;
        add_header Expires "0" always;

        # Try exact file, try with .html extension, then fallback to index.html
        try_files $uri $uri.html /index.html;
    }

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

    # Content Security Policy
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.mixpanel.com https://static.cloudflareinsights.com https://tally.so; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: https:; connect-src 'self' https://api.mixpanel.com https://cdn.mixpanel.com https://static.cloudflareinsights.com https://tally.so; frame-src 'self' https://tally.so; frame-ancestors 'self';" always;

    # Strict Transport Security (for HTTPS)
    # Uncomment when HTTPS is enabled:
    # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # Security.txt route
    location = /.well-known/security.txt {
        try_files /security.txt =404;
    }

    # Robots.txt
    location = /robots.txt {
        try_files /robots.txt =404;
    }

    # Error pages
    error_page 404 /index.html;
}