pdfcraft/nginx.conf at main · PDFCraftTool/pdfcraft · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
server {
    listen 80;
    server_name _;

    root /website/pdfcraft;
    index index.html;

    # ==========================================
    # Gzip Compression Settings
    # ==========================================
    gzip on;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_min_length 256;
    gzip_types
        text/plain
        text/css
        application/json
        application/javascript
        text/xml
        application/xml
        application/xml+rss
        text/javascript
        image/svg+xml
        application/wasm;

    # ==========================================
    # MIME Type Configuration
    # ==========================================
    include /etc/nginx/mime.types;
    types {
        application/wasm wasm;
        application/javascript mjs;
    }

    # ==========================================
    # Security Headers (server level)
    # ==========================================
    # NOTE: Any location block using add_header will override ALL of these.
    # Every location block must re-include via: include /etc/nginx/security-headers.conf;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin" always;
    add_header Cross-Origin-Embedder-Policy "require-corp" always;
    add_header Cross-Origin-Resource-Policy "cross-origin" always;

    # ==========================================
    # Caching Strategy
    # ==========================================

    # Static Assets (Images, Fonts, etc.) - Long Term Cache
    location ~* \.(ico|jpg|jpeg|png|gif|svg|webp|avif|woff|woff2|ttf|eot)$ {
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable";
        include /etc/nginx/security-headers.conf;
        access_log off;
    }

    # JS, CSS, MJS Files - Long Term Cache
    location ~* \.(js|css|mjs)$ {
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable";
        include /etc/nginx/security-headers.conf;
        access_log off;
    }

    # Next.js Build Assets (_next/static)
    location /_next/static/ {
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable";
        include /etc/nginx/security-headers.conf;
        access_log off;
    }

    # Runtime workers - must revalidate on deploy
    location ^~ /workers/ {
        expires -1;
        add_header Cache-Control "public, max-age=0, must-revalidate";
        include /etc/nginx/security-headers.conf;
    }

    # PyMuPDF WASM assets - must revalidate on deploy
    location ^~ /pymupdf-wasm/ {
        expires -1;
        add_header Cache-Control "public, max-age=0, must-revalidate";
        include /etc/nginx/security-headers.conf;
    }

    # Locale-prefixed asset fallback: /en/workers/* → /workers/*
    location ~* ^/[A-Za-z-]+/(workers|pymupdf-wasm)/(.+)$ {
        rewrite ^/[A-Za-z-]+/(workers|pymupdf-wasm)/(.+)$ /$1/$2 break;
        expires -1;
        add_header Cache-Control "public, max-age=0, must-revalidate";
        include /etc/nginx/security-headers.conf;
    }

    # ==========================================
    # LibreOffice WASM Files
    # ==========================================
    location ^~ /libreoffice-wasm/ {
        gzip_static always;
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable";
        types {
            application/wasm wasm;
            application/javascript js;
            application/octet-stream data;
        }
        include /etc/nginx/security-headers.conf;

        # Explicit overrides for renamed .bin files to ensure correct MIME types
        location ~* soffice\.wasm\.bin$ {
            default_type application/wasm;
        }
        location ~* soffice\.data\.bin$ {
            default_type application/octet-stream;
        }
    }

    # 404 Page
    error_page 404 /404.html;
    location = /404.html {
        internal;
    }

    # ==========================================
    # Core Routing Logic
    # ==========================================
    location / {
        try_files $uri $uri.html $uri/ =404;
        add_header Cache-Control "public, max-age=0, must-revalidate";
        include /etc/nginx/security-headers.conf;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    }
}