luzzle/packages/web/proxy/templates/default.conf.template

proxy_cache_path /tmp/cache levels=1:2 keys_zone=luzzle:10m inactive=365d max_size=10g;

upstream luzzle-upstream {
    server ${LUZZLE_PROXY_EXPLORER_UPSTREAM};
    keepalive 2;
}

upstream luzzle-lsp-upstream {
    server ${LUZZLE_PROXY_LSP_UPSTREAM};
    keepalive 2;
}

# Determine the correct protocol to pass forward
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
    default $http_x_forwarded_proto;
    ''      $scheme;
}

# WebSocket support: only set upgrade headers when the client requests it
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      "";
}

# Cache status based on dev environment
map "${LUZZLE_DEV}" $luzzle_cache_status {
    "true"  off;
    default luzzle;
}

# Font URLs are versioned by filename; do not cache development font changes.
map "${LUZZLE_DEV}" $luzzle_font_cache_control {
    "true"  "no-store";
    default "public, max-age=31536000, immutable";
}

server {
    listen 8080;
    server_name localhost;

    access_log ${LUZZLE_PROXY_ACCESS_LOG};
    error_log  ${LUZZLE_PROXY_ERROR_LOG};

    gzip            on;
    gzip_vary       on;
    gzip_proxied    any;
    gzip_min_length 256;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/javascript
        application/json
        application/xml
        application/rss+xml
        application/atom+xml
        image/svg+xml;

    client_max_body_size 256M;

    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;
    
    # Shared Proxy & Cache Headers
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
    proxy_set_header Accept-Encoding "";
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

    proxy_cache             $luzzle_cache_status;
    proxy_cache_revalidate  on;
    proxy_cache_min_uses    1;
    proxy_cache_lock        on;
    proxy_cache_use_stale   error timeout http_502 http_504 updating;
    proxy_cache_valid       200 302 365d;
    proxy_cache_valid       404 365d;
    proxy_cache_key         "$scheme$request_method$proxy_host$request_uri";

    add_header X-Cache-Status $upstream_cache_status;

    # Private routes must take precedence over extension-based asset caching.
    location ~ ^/(?:admin|api/admin)(?:/|$) {
        proxy_cache       off;
        proxy_buffering   off;
        proxy_hide_header Cache-Control;
        add_header        Cache-Control "private, no-store" always;
        add_header        X-Accel-Buffering "no" always;
        proxy_pass        http://luzzle-upstream;
    }

    # Configured assets revalidate even when their filenames look immutable.
    location ^~ /assets/ {
        proxy_cache off;
        proxy_pass  http://luzzle-upstream;
    }

    location ~* "\.(?:woff2?|ttf|otf)$" {
        proxy_cache       off;
        proxy_hide_header Cache-Control;
        add_header        Cache-Control $luzzle_font_cache_control;
        proxy_pass        http://luzzle-upstream;
    }

    location ~* "^/(?:pieces|rss|search|$)" {
        proxy_pass http://luzzle-upstream;
    }

    location ~* "\.(?:txt|jpg|jpeg|png|webp|avif|css)$" {
        proxy_pass http://luzzle-upstream;
    }

    location = /api/session/verify {
        internal;
        proxy_cache             off;
        proxy_pass              http://luzzle-upstream;
        proxy_pass_request_body off;
        proxy_set_header        Content-Length "";
        proxy_set_header        Upgrade "";
        proxy_set_header        Connection "close";
        proxy_set_header        Host $host;
        proxy_set_header        Cookie $http_cookie;
        proxy_set_header        X-Original-URI $request_uri;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto $proxy_x_forwarded_proto;
    }

    location ^~ /admin/lsp {
        auth_request       /api/session/verify;
        proxy_cache        off;
        proxy_hide_header  Cache-Control;
        add_header         Cache-Control "private, no-store" always;
        proxy_buffering    off;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
        proxy_pass         http://luzzle-lsp-upstream;
    }

    location / {
        proxy_cache     off;
        proxy_pass      http://luzzle-upstream;
    }
}