91 lines
3.4 KiB
Nix
91 lines
3.4 KiB
Nix
#
|
|
# nginx for Solid Scribe on NixOS.
|
|
#
|
|
# Merge this into your configuration.nix and `nixos-rebuild switch`.
|
|
# Replace REPO_PATH with the absolute path of the repo clone on the server.
|
|
#
|
|
# Four things differ from the previous config, and the first two are required
|
|
# for the Vue 3 client to work at all:
|
|
#
|
|
# 1. SPA fallback. The old Vue 2 client used vue-router's default HASH mode
|
|
# (no `mode:` was set), so every request was just "/" and routing happened
|
|
# after the "#". That is why share links looked like /#/public/note/...
|
|
# The Vue 3 client uses createWebHistory, so /notes, /settings and
|
|
# /share-target are real HTTP requests. Without tryFiles they all 404.
|
|
#
|
|
# 2. root moves up to the vhost. It was inside locations."/", which left
|
|
# /assets/, /sw.js and /manifest.json unresolvable once they needed their
|
|
# own location blocks.
|
|
#
|
|
# 3. proxyWebsockets on /socket. recommendedProxySettings does NOT add the
|
|
# Upgrade/Connection headers, so Socket.IO has been silently falling back
|
|
# to long-polling -- that's the live note-sync path running degraded.
|
|
#
|
|
# 4. Cache headers. See the warning below.
|
|
#
|
|
# !! CLOUDFLARE !!
|
|
# The tunnel sits in front of this and Cloudflare caches .js by DEFAULT, which
|
|
# includes /sw.js. If the edge caches the service worker, the update check can
|
|
# never see a new one and the app is pinned to an old build with no remote way
|
|
# to recover. The nginx headers below are necessary but NOT sufficient --
|
|
# add a Cloudflare Cache Rule that BYPASSES cache for /sw.js (and /index.html)
|
|
# before cutting over.
|
|
#
|
|
# Also confirm which Host header cloudflared sends. This vhost is keyed on
|
|
# "192.168.1.7"; if the tunnel forwards the public hostname instead, nginx will
|
|
# not match this vhost and will fall through to the default server. Either add
|
|
# the public hostname to serverAliases or set the tunnel's httpHostHeader.
|
|
#
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
recommendedProxySettings = true;
|
|
recommendedGzipSettings = true;
|
|
|
|
virtualHosts."192.168.1.7" = {
|
|
# serverAliases = [ "notes.example.com" ]; # if the tunnel forwards the public host
|
|
|
|
root = "REPO_PATH/client/dist";
|
|
|
|
locations."/" = {
|
|
tryFiles = "$uri $uri/ /index.html";
|
|
};
|
|
|
|
# Never let the HTTP layer cache the service worker or the app shell.
|
|
locations."= /sw.js".extraConfig = ''
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|
expires -1;
|
|
'';
|
|
|
|
locations."= /index.html".extraConfig = ''
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|
expires -1;
|
|
'';
|
|
|
|
# The manifest changes rarely but should not be pinned for a year.
|
|
locations."= /manifest.json".extraConfig = ''
|
|
add_header Cache-Control "no-cache";
|
|
expires -1;
|
|
'';
|
|
|
|
# Vite content-hashes everything under /assets, so these are immutable.
|
|
locations."/assets/".extraConfig = ''
|
|
add_header Cache-Control "public, max-age=31536000, immutable";
|
|
'';
|
|
|
|
locations."/api" = {
|
|
proxyPass = "http://localhost:3000";
|
|
};
|
|
|
|
locations."/socket" = {
|
|
proxyPass = "http://localhost:3001";
|
|
proxyWebsockets = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
# Note on file access: nginx runs as its own user, so REPO_PATH/client/dist must
|
|
# be readable by it -- every parent directory needs +x. If the repo lives under
|
|
# /home/mab this usually means loosening the home directory's permissions, or
|
|
# putting the clone somewhere like /srv instead.
|