nginx.conf

# Web server to serve web client for staging and pull request previews.
# Headers/redirect logics is duplicated between this file
# and server/modules/assets.ts.
# If you change anything here, change the second place too.

worker_processes 1;
pid /run/nginx.pid;
daemon off;

events {
  worker_connections 1024;
}

http {
  access_log off;
  error_log stderr error;
  server_tokens off;

  include mime.types;
  types {
    application/manifest+json webmanifest;
  }
  default_type application/octet-stream;
  charset_types application/javascript text/css application/manifest+json image/svg+xml;
  sendfile on;

  server {
    listen $PORT;

    root /var/www;
    charset UTF-8;
    gzip_static on;

    gzip on;
    gzip_types text/css application/javascript application/json application/manifest+json image/svg+xml;

    error_page 404 /404.html;
    error_page 500 /500.html;

    absolute_redirect off;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
    add_header X-Content-Type-Options "nosniff";
    add_header Content-Security-Policy "object-src 'none'; frame-ancestors 'none'; form-action 'none'; base-uri 'none'; style-src 'sha256-0QQ5SKWRwEIVeUEt8MjrdaPQAH6rGm8EUwRB/xh07IQ=' 'sha256-eJHzD9wIr2E84rPeZQeXO3bt9ihyOFLyeZZXh4m3BpE=' 'self'; script-src 'sha256-iliif2S6Fr8mQazzDJs2huHUeow98/TYx+Staat/56E=' 'self'";

    location ~* __ROUTES__ {
      try_files /index.html =404;
    }

    location ~* ^(/ui)?/assets {
      expires 1y;
      add_header Cache-Control 'public';
    }

    rewrite ^/ui$ /ui/ permanent;

    location /ui/ {
      add_header Content-Security-Policy "";
      try_files $uri $uri/ =404;
    }

    location / {
      rewrite ^(.+)/$ $1 permanent;
      try_files $uri $uri/ =404;
    }
  }
}