stroblmeandClaude Opus 5.5
6c0ab2049b
script-src admits the bundle and the pre-paint theme script by hash, with no unsafe-inline or unsafe-eval; style-src keeps unsafe-inline for the <style> elements Monaco, Radix and the toasts insert. frame-ancestors 'self', nosniff and strict-origin-when-cross-origin go with it, and the Dockerfile adds the API origin to connect-src when the bundle calls one elsewhere. Zod runs jitless so its eval probe is not reported on every page. The embed widget keeps allow-same-origin: the demo's weather map does not render without it; the comment now says so and what it costs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
54 lines
1.5 KiB
Nginx Configuration File
54 lines
1.5 KiB
Nginx Configuration File
server {
|
|
listen 80;
|
|
|
|
# nginx's mime.types predates the manifest, so without this it goes out as
|
|
# application/octet-stream.
|
|
types {
|
|
application/manifest+json webmanifest;
|
|
}
|
|
include /etc/nginx/mime.types;
|
|
|
|
# The bundle is ~770 kB of JavaScript and ~85 kB of CSS, and nginx's base
|
|
# image ships gzip commented out — so every first load shipped all of it
|
|
# uncompressed. Roughly a third of the bytes with this on.
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_min_length 1024;
|
|
gzip_proxied any;
|
|
gzip_types
|
|
application/javascript
|
|
application/json
|
|
application/manifest+json
|
|
application/wasm
|
|
image/svg+xml
|
|
text/css
|
|
text/plain;
|
|
|
|
include /etc/nginx/security-headers.conf;
|
|
|
|
location / {
|
|
root /usr/share/nginx/html;
|
|
index index.html index.htm;
|
|
try_files $uri /index.html =404;
|
|
}
|
|
|
|
# Vite puts a content hash in every asset's name, so one can never change
|
|
# under its URL. Without this each of the ~50 of them cost a 304 round trip
|
|
# on every reload.
|
|
location /assets/ {
|
|
root /usr/share/nginx/html;
|
|
include /etc/nginx/security-headers.conf;
|
|
add_header Cache-Control "public, max-age=31536000, immutable";
|
|
}
|
|
|
|
# The one file that must not be cached: it is what names the current
|
|
# assets, so a stale copy pins the browser to the previous build.
|
|
location = /index.html {
|
|
root /usr/share/nginx/html;
|
|
include /etc/nginx/security-headers.conf;
|
|
add_header Cache-Control "no-cache";
|
|
}
|
|
|
|
include /etc/nginx/extra-conf.d/*.conf;
|
|
}
|