# Static server for the web UI (web/).
#
# The page decodes and analyses audio inside the visitor's browser. The CSP's
# `connect-src 'none'` (security-headers.conf) forbids the page and its worker
# from making any network request (fetch, XHR, WebSocket, beacon), so dropped
# audio has no way to leave the tab — enforced by the browser, not just promised
# by the code.

server {
    listen 8080;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    # Nothing the app does reaches the server beyond fetching these files, and
    # there is no reason to keep a record of who fetched them.
    access_log off;
    server_tokens off;

    gzip on;
    gzip_types text/css application/javascript;

    # The page names the current asset version, so it is always revalidated.
    # (Each location includes the security headers itself: nginx drops
    # server-level add_header in any location that adds its own.)
    location / {
        include /etc/nginx/snippets/ujm-security-headers.conf;
        add_header Cache-Control "no-cache" always;
        try_files $uri $uri/ =404;
    }

    # Assets live under v/<content hash>/ (see Dockerfile): a URL's content never
    # changes, so it can be cached indefinitely.
    location /v/ {
        include /etc/nginx/snippets/ujm-security-headers.conf;
        add_header Cache-Control "public, max-age=31536000, immutable" always;
        try_files $uri =404;
    }
}