nginx.conf.template

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    # Performance optimizations
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    
    # Enhanced gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/rss+xml;

    server {
        listen ${PORT};
        
        # Essential security headers
        add_header X-Content-Type-Options nosniff always;
        add_header X-Frame-Options DENY always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        
        # Content Security Policy
        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://unpkg.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data: https: http:; connect-src 'self' ${LINKDING_BASE_URL}; font-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none';" always;

        # CORS for API
        add_header Access-Control-Allow-Origin "*" always;
        add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;

        if ($request_method = 'OPTIONS') {
            return 204;
        }

        # Static files with optimized caching
        location / {
            root /usr/share/nginx/html;
            try_files $uri $uri/ /index.html;
            
            # Cache static assets longer
            location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
                expires 7d;
                add_header Cache-Control "public, immutable";
            }
            
            # Cache HTML briefly
            location ~* \.html$ {
                expires 1h;
                add_header Cache-Control "public, must-revalidate";
            }
        }

        # Health check
        location /health {
            access_log off;
            return 200 '{"status":"ok"}';
            add_header Content-Type application/json;
        }

        # Version endpoint (dynamic file)
        location /version.json {
            root /usr/share/nginx/html;
            add_header Content-Type application/json;
            add_header Cache-Control "no-cache, must-revalidate";
            expires 0;
        }

        # Config endpoint
        location /config {
            expires 10m;
            return 200 '{"status":"ok"}';
            add_header Content-Type application/json;
        }

        # Optimized API proxy
        location /api/ {
            # Disable logging to prevent token exposure
            access_log off;
            
            proxy_pass ${LINKDING_BASE_URL}/api/;
            proxy_set_header Authorization "Token ${LINKDING_API_TOKEN}";
            proxy_set_header Host ${LINKDING_HOST};
            proxy_set_header P-Access-Token-Id "${P_ACCESS_TOKEN_ID}";
            proxy_set_header P-Access-Token "${P_ACCESS_TOKEN}";
            
            # SSL optimizations
            proxy_ssl_server_name on;
            proxy_ssl_verify off;
            
            # Connection optimizations
            proxy_connect_timeout 10s;
            proxy_send_timeout 10s;
            proxy_read_timeout 10s;
            
            # Brief API response caching
            expires 2m;
            add_header Cache-Control "public, max-age=120";
        }
    }
}