lukasandClaude Opus 5.5
a2c52f33a8
An opt-in per device (Settings → Security → Offline access) installs a service worker that keeps the newest 50 Inbox conversations, and the ones opened recently, for reading when the server cannot be reached. While online everything still comes from the server; the saved copy is only the fallback, marked X-WM-Offline so the app knows it is offline. Offline, an amber cloud next to the theme toggle says so and when mail was last saved; actions that need the server are greyed out and say "Not available offline"; conversations and folders not saved here are faded or say so. A probe notices the server coming back, shows "Back online" and refreshes everything. Saved mail is wiped on sign-out, on any 401, and when another user signs in. nginx never caches /sw.js, so releases reach it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
86 lines
3.0 KiB
Plaintext
86 lines
3.0 KiB
Plaintext
# The webmail front door's shared body, included by BOTH listeners in
|
|
# nginx.conf (port 80 = public, port 81 = admin). Keeping it in one file is the
|
|
# point: a location that existed on only one listener would be a silent hole or
|
|
# a silent outage. Included at `server` scope, so everything here is server-level.
|
|
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# Attachment uploads. Keep this comfortably above MAX_ATTACHMENT_MB (default
|
|
# 25) to leave room for multipart/base64 overhead.
|
|
client_max_body_size 64m;
|
|
client_body_timeout 300s;
|
|
|
|
# The NAS is doing other jobs too — don't buffer big uploads to disk twice.
|
|
proxy_request_buffering off;
|
|
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_min_length 1024;
|
|
gzip_types text/plain text/css application/javascript application/json
|
|
image/svg+xml application/manifest+json;
|
|
|
|
# Clickjacking / sniffing basics. The app's own CSP for mail HTML is applied
|
|
# server-side in app/indexer/sanitize.py; this is only the shell document.
|
|
add_header X-Content-Type-Options nosniff always;
|
|
add_header X-Frame-Options SAMEORIGIN always;
|
|
add_header Referrer-Policy no-referrer always;
|
|
|
|
# ---- API ----------------------------------------------------------------
|
|
location /api/ {
|
|
proxy_pass http://webmail_api;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $fwd_proto;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
|
|
# WebSocket (/api/ws) and any long-poll: no upgrade means no live mail.
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
# Live updates hold the connection open; don't cut them at 60 s.
|
|
proxy_read_timeout 3600s;
|
|
proxy_send_timeout 3600s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
# ---- static -------------------------------------------------------------
|
|
# Vite emits content-hashed filenames into /assets, so they are immutable.
|
|
location /assets/ {
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location /fonts/ {
|
|
expires 30d;
|
|
add_header Cache-Control "public";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location = /healthz {
|
|
access_log off;
|
|
return 200 "ok\n";
|
|
add_header Content-Type text/plain;
|
|
}
|
|
|
|
# The SPA fallback lives in each server block, not here: the two listeners serve
|
|
# two different apps out of the same dist (index.html vs admin.html).
|
|
|
|
# An entry document must never be cached, or a deploy won't be picked up. Each
|
|
# listener adds its own entry document's rule; this one is harmless on both
|
|
# because the public listener 404s /admin.html before it can be served.
|
|
location = /index.html {
|
|
add_header Cache-Control "no-store, must-revalidate";
|
|
}
|
|
|
|
# The offline-access service worker (frontend/public/sw.js): a fixed URL the
|
|
# browser re-checks for a new version, so it must not be cached either.
|
|
location = /sw.js {
|
|
add_header Cache-Control "no-cache";
|
|
try_files $uri =404;
|
|
}
|