embedded-wallet/nginx.conf at develop · 1Shot-API/embedded-wallet · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
# Successes: long immutable cache. Errors (esp. 404 during rolling deploys):
# short TTL so CDNs do not pin a missing hashed chunk for a year.
map $status $assets_cache_control {
    200     "public, max-age=31536000, immutable";
    206     "public, max-age=31536000, immutable";
    default "public, max-age=60";
}

server {
    listen 80;
    server_name _;
    root /usr/share/nginx/html;

    # Keep Location headers relative so published host ports (e.g. :8080) survive redirects.
    absolute_redirect off;

    # Hashed Vite build output — never SPA-fallback. A missing file must 404
    # (not return index.html as text/html), otherwise CDNs cache the HTML under
    # the .js/.css URL and browsers fail with NS_ERROR_CORRUPTED_CONTENT /
    # MIME mismatches.
    location /assets/ {
        try_files $uri =404;
        add_header Cache-Control $assets_cache_control always;
    }

    # Signing Layer — unbundled ES modules (same origin as branding).
    # Strict CSP: no network egress, self scripts/styles only.
    #
    # frame-ancestors is deliberately OMITTED. CSP evaluates it against every
    # ancestor (Host page included), so 'self' breaks the supported
    # Host (any site) -> Branding (this origin) -> /signer/ chain. "Only our
    # Branding Layer may drive the signer" is enforced at runtime instead: the
    # signer accepts requests only from window.parent, only when nested, and
    # only when event.origin === its own origin (ows-signer rpc.js
    # isValidParentMessage), so a foreign page framing /signer/ gets an inert
    # iframe. Do not re-add frame-ancestors here or in vite.config.ts.
    location /signer/src/ {
        add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'none'; img-src 'none'; font-src 'none'; media-src 'none'; object-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none'; upgrade-insecure-requests" always;
        try_files $uri =404;
        add_header Cache-Control "public, max-age=300" always;
    }

    location /signer/ {
        add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'none'; img-src 'none'; font-src 'none'; media-src 'none'; object-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none'; upgrade-insecure-requests" always;
        try_files $uri $uri/ /signer/index.html;
    }

    location = /signer {
        return 301 /signer/;
    }

    # First-party passkey create host (Safari cross-origin iframe workaround)
    location /create/ {
        try_files $uri $uri/ /create/index.html;
    }

    location = /create {
        return 301 /create/;
    }

    # First-party mobile PWA + WalletConnect host
    location /mobile/ {
        try_files $uri $uri/ /mobile/index.html;
    }

    location = /mobile {
        return 301 /mobile/;
    }

    # HTML entry points — avoid long CDN caches so deploys pick up new asset hashes
    location = /index.html {
        add_header Cache-Control "no-cache" always;
    }

    location = /create/index.html {
        add_header Cache-Control "no-cache" always;
    }

    location = /mobile/index.html {
        add_header Cache-Control "no-cache" always;
    }

    # Branding Layer SPA at domain root (/signer/, /create/, /mobile/, /assets/ above take precedence)
    location / {
        try_files $uri $uri/ /index.html;
    }
}