# nginx server for the NestQuest admin PWA (Feature 24).  Replaces the
# image's /etc/nginx/conf.d/default.conf.  The shared Traefik on
# nukapi-03 (10.60.1.33) terminates TLS for nestquest.cubecraftlabs.com
# and forwards every path that is not the API (/api, /health,
# /openapi.json, /docs) here; see deploy/RUNBOOK.md section 10.
server {
    listen 80;
    server_name _;

    # Only the reverse proxy and the API box itself may connect; every
    # other source is refused (403) even if the port is reachable.
    allow 10.60.1.33;
    allow 10.60.1.14;
    deny all;

    root /usr/share/nginx/html;
    index index.html;
    server_tokens off;

    # Content-hashed bundle files: cache forever, and a missing asset is
    # a real 404 rather than the SPA shell.
    location /assets/ {
        try_files $uri =404;
        add_header Cache-Control "public, max-age=31536000, immutable";
    }

    # The service worker must be revalidated on every load so a new
    # release's worker (fresh revision, see admin/vite-sw-plugin.ts) is
    # picked up.
    location = /sw.js {
        try_files $uri =404;
        add_header Cache-Control "no-cache";
    }

    # nginx's stock mime.types has no .webmanifest entry.
    location = /manifest.webmanifest {
        types { }
        default_type application/manifest+json;
        try_files $uri =404;
        add_header Cache-Control "no-cache";
    }

    # SPA fallback: client routes such as /auth/callback resolve to the
    # app shell, which is never cached so it always names the current
    # hashed assets.
    location / {
        try_files $uri $uri/ /index.html;
    }

    location = /index.html {
        add_header Cache-Control "no-cache";
    }
}