webmail-client/docker/nginx-app.conf

# The webmail front door's shared body, included by BOTH listeners in
# nginx.conf (port 80 = public, port 81 = admin). Keeping it in one file is the
# point: a location that existed on only one listener would be a silent hole or
# a silent outage. Included at `server` scope, so everything here is server-level.

root /usr/share/nginx/html;
index index.html;

# Attachment uploads. Keep this comfortably above MAX_ATTACHMENT_MB (default
# 25) to leave room for multipart/base64 overhead.
client_max_body_size 64m;
client_body_timeout 300s;

# The NAS is doing other jobs too — don't buffer big uploads to disk twice.
proxy_request_buffering off;

gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css application/javascript application/json
           image/svg+xml application/manifest+json;

# Clickjacking / sniffing basics. The app's own CSP for mail HTML is applied
# server-side in app/indexer/sanitize.py; this is only the shell document.
add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options SAMEORIGIN always;
add_header Referrer-Policy no-referrer always;

# ---- API ----------------------------------------------------------------
location /api/ {
    proxy_pass http://webmail_api;
    proxy_http_version 1.1;

    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $fwd_proto;
    proxy_set_header X-Forwarded-Host  $host;

    # WebSocket (/api/ws) and any long-poll: no upgrade means no live mail.
    proxy_set_header Upgrade    $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

    # Live updates hold the connection open; don't cut them at 60 s.
    proxy_read_timeout  3600s;
    proxy_send_timeout  3600s;
    proxy_buffering off;
}

# ---- static -------------------------------------------------------------
# Vite emits content-hashed filenames into /assets, so they are immutable.
location /assets/ {
    expires 1y;
    add_header Cache-Control "public, immutable";
    try_files $uri =404;
}

location /fonts/ {
    expires 30d;
    add_header Cache-Control "public";
    try_files $uri =404;
}

location = /healthz {
    access_log off;
    return 200 "ok\n";
    add_header Content-Type text/plain;
}

# The SPA fallback lives in each server block, not here: the two listeners serve
# two different apps out of the same dist (index.html vs admin.html).

# An entry document must never be cached, or a deploy won't be picked up. Each
# listener adds its own entry document's rule; this one is harmless on both
# because the public listener 404s /admin.html before it can be served.
location = /index.html {
    add_header Cache-Control "no-store, must-revalidate";
}

# The offline-access service worker (frontend/public/sw.js): a fixed URL the
# browser re-checks for a new version, so it must not be cached either.
location = /sw.js {
    add_header Cache-Control "no-cache";
    try_files $uri =404;
}