Stirling-PDF/docker/unified/nginx.conf

# Run nginx as non-root user
pid /tmp/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # Add .mjs MIME type mapping
    types {
        text/javascript mjs;
    }

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json;

    server {
        listen 8080;
        server_name _;
        root /usr/share/nginx/html;
        index index.html index.htm;

        # Global settings for file uploads
        client_max_body_size 100m;

        # Handle client-side routing - support subpaths
        location / {
            try_files $uri $uri/ /index.html;
        }

        # Proxy API calls to backend
        location /api/ {
            proxy_pass ${BACKEND_URL}/api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Port $server_port;

            # Additional headers for proper API proxying
            proxy_set_header Connection '';
            proxy_http_version 1.1;
            proxy_buffering off;
            proxy_cache off;

            # Timeout settings for large file uploads
            proxy_connect_timeout 60s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;

            # Request size limits for file uploads
            client_max_body_size 100m;
            proxy_request_buffering off;
        }

        # Proxy Swagger UI to backend (including versioned paths)
        location ~ ^/swagger-ui(.*)$ {
            proxy_pass ${BACKEND_URL}/swagger-ui$1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Port $server_port;

            proxy_set_header Connection '';
            proxy_http_version 1.1;
            proxy_buffering off;
            proxy_cache off;
        }

        # Proxy API docs to backend (with query parameters and sub-paths)
        location ~ ^/v3/api-docs(.*)$ {
            proxy_pass ${BACKEND_URL}/v3/api-docs$1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Port $server_port;
        }

        # Proxy v1 API docs to backend (with query parameters and sub-paths)
        location ~ ^/v1/api-docs(.*)$ {
            proxy_pass ${BACKEND_URL}/v1/api-docs$1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Port $server_port;
        }

        # Serve .mjs files with correct MIME type (must come before general static assets)
        location ~* \.mjs$ {
            try_files $uri =404;
            add_header Content-Type "text/javascript; charset=utf-8" always;
            expires 1y;
            add_header Cache-Control "public, immutable";
        }

        # Cache static assets
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
            expires 1y;
            add_header Cache-Control "public, immutable";
        }

        # Security headers
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    }
}