nginx.conf

server {
    listen       ${PORT};
    listen  [::]:${PORT};
    server_name  localhost;

    root                    /usr/share/nginx/html;
    index                   index.html;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Referrer-Policy "no-referrer-when-downgrade";
    # add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; worker-src 'self' blob: https://apps.powerhouse.io; connect-src 'self' https://*.sentry.io https://renown.id https://www.renown.id; img-src * data:; object-src 'none'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com";
   
    # Gzip Settings
    gzip on;
    gzip_types text/plain application/xml text/css text/javascript application/javascript application/json;
    gzip_min_length 256;
    gzip_comp_level 6;
    gzip_vary on;
    gzip_proxied any;
    gzip_disable "msie6";

    # Brotli Settings
    brotli on;
    brotli_types text/plain application/xml text/css text/javascript application/javascript application/json;
    brotli_comp_level 6;

    location ${BASE_PATH}/assets {
        alias /usr/share/nginx/html/assets;
        expires 1y;
        access_log off;
        add_header Cache-Control "public";
    }

    location ${BASE_PATH}/icons.svg {
        alias /usr/share/nginx/html/icons.svg;
        expires 1y;
        access_log off;
        add_header Cache-Control "public";
    }

    location ${BASE_PATH}/service-worker.js {
        alias /usr/share/nginx/html/service-worker.js;
        expires -1;
        access_log off;
        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
    }

    location ${BASE_PATH} {
        root /usr/share/nginx/html;
        index index.html;
        try_files $uri $uri/ /index.html;
        expires -1;
        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
    }

    # Health check endpoints
    location /healthz {
        access_log off;
        return 200 'OK';
        add_header Content-Type text/plain;
    }

    location /readiness {
        access_log off;
        return 200 'OK';
        add_header Content-Type text/plain;
    }
}