nginx.conf

# Rate-limit zone for the TURN-credential endpoint (cheap to call, mints HMAC+JWT). Note:
# behind Docker's published port nginx usually sees a single masqueraded source address,
# so in practice this acts as a global backstop against credential-minting floods rather
# than a strict per-IP limit. Sized generously so normal use never trips it (clients cache
# credentials for ~5 min).
limit_req_zone $binary_remote_addr zone=credentials:10m rate=20r/s;

# Cache policy: HTML/JS/CSS aren't content-hashed, so 'no-cache' forces an ETag
# revalidation (304 when unchanged) and users pick up new releases immediately. Fonts and
# images rarely change, so they get a real lifetime. A map feeds the single server-level
# add_header below — an add_header inside a location would drop the inherited security headers.
map $uri $cache_control {
    default                            "no-cache";
    ~*\.(?:woff2?|png|jpe?g|gif|svg|ico)$  "public, max-age=604800";
}

server {
    listen 80;

    # Serve web static files
    root /filesync/web;
    index index.html;

    # Security headers
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' ws: wss: stun: turn: turns:; worker-src 'self'; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "same-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
    add_header Cache-Control $cache_control always;

    # Rate-limited proxy for the credential endpoint (exact match wins over /api/ below).
    location = /api/credentials {
        limit_req zone=credentials burst=40 nodelay;
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Proxy /api/ requests to FastAPI
    location /api/ {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Proxy /ws WebSocket signaling to FastAPI
    location /ws {
        proxy_pass http://127.0.0.1:8000/ws;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Keep idle signaling sockets alive — clients ping every 10s but proxies often
        # kill idle TCP at 60s by default.
        proxy_read_timeout 7d;
        proxy_send_timeout 7d;
    }

    # Handle root `/`
    location = / {
        try_files /index.html =404;
    }

    # Catch-all for SPA routes
    location / {
        try_files $uri $uri/ /index.html;
    }
}