mikkeli
5420975f8e
Cloudflare forces browser caching of .js/.css to max-age=14400 regardless of the origin's no-cache, while the page itself stays uncached. After a deploy, browsers paired the new index.html with the old app.js, which failed on upload with "Cannot set properties of null (setting 'innerHTML')". The image build now copies every asset into v/<content hash>/ and rewrites index.html's references; nginx serves v/ as immutable and the page as no-cache, so each deploy changes every asset URL. Security headers move to a snippet included per location, since nginx drops server-level add_header in locations that set their own. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015UXA39Sh9coAx4FhRkd8R2
40 lines
1.4 KiB
Nginx Configuration File
40 lines
1.4 KiB
Nginx Configuration File
# Static server for the web UI (web/).
|
|
#
|
|
# The page decodes and analyses audio inside the visitor's browser. The CSP's
|
|
# `connect-src 'none'` (security-headers.conf) forbids the page and its worker
|
|
# from making any network request (fetch, XHR, WebSocket, beacon), so dropped
|
|
# audio has no way to leave the tab — enforced by the browser, not just promised
|
|
# by the code.
|
|
|
|
server {
|
|
listen 8080;
|
|
server_name _;
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# Nothing the app does reaches the server beyond fetching these files, and
|
|
# there is no reason to keep a record of who fetched them.
|
|
access_log off;
|
|
server_tokens off;
|
|
|
|
gzip on;
|
|
gzip_types text/css application/javascript;
|
|
|
|
# The page names the current asset version, so it is always revalidated.
|
|
# (Each location includes the security headers itself: nginx drops
|
|
# server-level add_header in any location that adds its own.)
|
|
location / {
|
|
include /etc/nginx/snippets/ujm-security-headers.conf;
|
|
add_header Cache-Control "no-cache" always;
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
|
|
# Assets live under v/<content hash>/ (see Dockerfile): a URL's content never
|
|
# changes, so it can be cached indefinitely.
|
|
location /v/ {
|
|
include /etc/nginx/snippets/ujm-security-headers.conf;
|
|
add_header Cache-Control "public, max-age=31536000, immutable" always;
|
|
try_files $uri =404;
|
|
}
|
|
}
|