nginx.conf.template

worker_processes auto;
daemon off;
pid $NGINX_PID_PATH;
error_log $NGINX_ERROR_LOG_PATH;
# Run worker processes as root so that they can access root-owned Unix domain sockets.
user root;

events {
    worker_connections 1024;
}

http {
    access_log $NGINX_ACCESS_LOG_PATH;
    default_type application/octet-stream;

    sendfile on;

    # See https://nginx.org/en/docs/http/websocket.html.
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    server {
        listen 3000;
        server_name localhost;

        # Dynamic per-user routes (written by main server)
        include $NGINX_CONF_DIR/user-routes/*.conf;

        # Block unmatched /_vs/* — only allow user routes installed above
        location /_vs/ {
            return 404;
        }

        # Target of `auth_request` in VSCode user routes.
        # See https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-subrequest-authentication/.
        # Mostly identical to the blanket forwarding route below,
        # but importantly skips Upgrade/Connection headers:
        # WebSocket connections to VSCode are broken if we forward these.
        location /api/auth-vsc/ {
            # Can only be reached by internal requests 
            internal;
            proxy_pass http://127.0.0.1:3002;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
            proxy_pass_request_body off;
            proxy_set_header Content-Length "";
        }

        # Everything else -> main server
        location / {
            proxy_pass http://127.0.0.1:3002;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
            # Allow WebSocket connections for Next.js HMR
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_buffering off;
        }
    }
}