nginx.conf

# ── Cache-Control by asset class ──────────────────────────────────────────────
# Every asset is served from a ^~ prefix location below, and ^~ stops nginx from
# evaluating regex locations — so a caching policy has to be set inside those
# locations, not in a `location ~* \.(css|js)$` that can never be reached.
#
# Keyed on $request_uri, not $uri: add_header is evaluated after the prefix
# rewrite, when $uri has already lost /knowledge-base/.
#
#   immutable — only names that change when their bytes do: Astro's hashed
#               _astro/ output and the build's content-addressed _kb-inline/ scripts
#   no-cache  — everything else: HTML, style.css (a stable name pages and
#               external consumers reference literally) and sub-app assets, which
#               keep whatever names their generator gave them. Revalidated with
#               the ETag nginx sends, so an unchanged file is a 304, not a download.
#
# no-transform rides on both: an intermediate proxy (the web-fragments
# FragmentGateway) must not re-encode the body, or it leaks a Content-Encoding
# header the browser then fails to decode.
map $request_uri $kb_cache_control {
    default                                                     "no-cache, no-transform";
    ~^/(__wf/)?knowledge-base/_astro/                           "public, max-age=31536000, immutable, no-transform";
    "~^/(__wf/)?knowledge-base/[^?]*/_kb-inline/[0-9a-f]{16}\.js(\?|$)" "public, max-age=31536000, immutable, no-transform";
}

server {
    listen 8080;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    # ── Compression ───────────────────────────────────────────────────────────
    gzip on;
    gzip_vary on;
    # "off" prevents nginx from gzip-encoding responses to proxies/gateways that
    # already sent Accept-Encoding upstream. FragmentGateway decompresses server-side
    # but can leak Content-Encoding header to the browser causing ERR_CONTENT_DECODING_FAILED.
    gzip_proxied off;
    gzip_comp_level 6;
    gzip_types
        text/css
        text/javascript
        application/javascript
        application/json
        image/svg+xml
        font/woff2;
    # Omit text/html — the fragment gateway doesn't benefit from it

    # ── Shared CORS + security headers ────────────────────────────────────────
    # IMPORTANT: add_header does not merge across levels. Any location block
    # below that declares an add_header of its own MUST include this file too,
    # or it silently serves responses with no CORS and no security headers.
    # See nginx.headers.conf. Enforced by tests/nginx-config.spec.js.
    include /etc/nginx/kb-headers.conf;

    # Handle OPTIONS preflight without hitting try_files
    if ($request_method = OPTIONS) {
        return 204;
    }

    # ── Health check endpoint ────────────────────────────────────────────────
    location = /healthz {
        access_log off;
        # default_type, not add_header: a header added after `return` never
        # reaches the response.
        default_type text/plain;
        return 200 "ok\n";
    }

    # ── Knowledge base assets: /__wf/knowledge-base/* → serve from dist root ──
    # CSS, JS and other static assets are referenced as /__wf/knowledge-base/<file>
    # so the data-gateway routes the request to the fragment server (this container).
    # Rewrite strips the /__wf/knowledge-base prefix so try_files resolves against
    # the server root (e.g. /__wf/knowledge-base/style.css → /style.css).
    location ^~ /__wf/knowledge-base/ {
        include /etc/nginx/kb-headers.conf;
        rewrite ^/__wf/knowledge-base/(.*)$ /$1 break;
        # Not `always`: a 404 must not be cached for a year under an _astro/ name.
        add_header Cache-Control $kb_cache_control;
        try_files $uri =404;
    }

    # ── All knowledge base traffic: /knowledge-base/* ────────────────────────
    # Handles both the data-gateway fragment path and the dedicated hostname.
    # Strip the /knowledge-base/ prefix so files resolve from the dist root.
    location ^~ /knowledge-base/ {
        include /etc/nginx/kb-headers.conf;
        rewrite ^/knowledge-base/(.*)$ /$1 break;
        # Per asset class — see the map at the top of this file.
        add_header Cache-Control $kb_cache_control;
        try_files $uri $uri/index.html =404;
    }

    # ── /knowledge-base (no trailing slash) → internal rewrite ───────────────
    # Internal rewrite (not a redirect) so nginx serves /knowledge-base/ content
    # without sending a 301 to the client. A redirect would expose the internal
    # HTTP container address to the browser, causing a mixed-content error when
    # the host app (data-gateway) is served over HTTPS.
    location = /knowledge-base {
        rewrite ^ /knowledge-base/ last;
    }

    # ── Everything else ───────────────────────────────────────────────────────
    location / {
        try_files $uri $uri/ =404;
    }
}