nginx.conf

# Web server to serve web client for staging and pull request previews

worker_processes 1;
pid /var/run/nginx.pid;

events {
  worker_connections 1024;
}

http {
  access_log off;
  error_log stderr error;
  server_tokens off;

  include mime.types;
  types {
    application/manifest+json webmanifest;
  }
  default_type application/octet-stream;
  charset_types application/javascript text/css application/manifest+json image/svg+xml;
  sendfile on;

  server {
    listen 8000;

    root /var/www;
    charset UTF-8;
    gzip_static on;

    gzip on;
    gzip_types text/css application/javascript application/json application/manifest+json image/svg+xml;

    error_page 404 /404.html;
    error_page 500 /500.html;

    absolute_redirect off;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
    add_header X-Content-Type-Options "nosniff";
    add_header Content-Security-Policy "object-src 'none'; frame-ancestors 'none'; form-action 'none'; base-uri 'none'; style-src 'sha256-SmAM1DSNiCCdAEabBHfOLWn8GuDZmajUjuFmodxWN5E=' 'sha256-MQAdkik2UpIegx87oj4jDzvVmtZQHZ8UHLkaMPDUYns=' 'sha256-6V2udMXGcrAVUt4WPmtKduau7GKHBV09b7CIdEvxvK4=' 'self'; script-src 'sha256-iliif2S6Fr8mQazzDJs2huHUeow98/TYx+Staat/56E=' 'self'; require-trusted-types-for 'script'; trusted-types dompurify slowreader-rich svelte-trusted-html slowreader-parse";

    location ~* __ROUTES__ {
      try_files /index.html =404;
    }

    location ~* ^(/ui)?/assets {
      expires 1y;
      add_header Cache-Control 'public';
    }

    rewrite ^/ui$ /ui/ permanent;

    location /ui/ {
      add_header Content-Security-Policy "";
      try_files $uri $uri/ =404;
    }

    location / {
      rewrite ^(.+)/$ $1 permanent;
      try_files $uri $uri/ =404;
    }
  }
}