From 12dba95764abc01b09b82f15a6c8b198982d4e27 Mon Sep 17 00:00:00 2001 From: FenjuFu <92919259+FenjuFu@users.noreply.github.com> Date: Fri, 4 Sep 2026 11:29:23 +0800 Subject: [PATCH] fix(web): revalidate SPA entry point Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com> --- web/nginx.conf.template | 185 ++++++++++++++++++++-------------------- 1 file changed, 93 insertions(+), 92 deletions(-) diff --git a/web/nginx.conf.template b/web/nginx.conf.template index 49dff54b..7f9d886f 100644 --- a/web/nginx.conf.template +++ b/web/nginx.conf.template @@ -1,92 +1,93 @@ -server_tokens off; -server { - listen 80; - server_name _; - root /usr/share/nginx/html; - index index.html; - - client_max_body_size 100M; - - gzip on; - gzip_types text/plain text/css application/json application/javascript text/xml; - gzip_min_length 1000; - - # Ignore client-supplied forwarded proto by default. Operators may explicitly trust a - # sanitizing upstream proxy; only canonical http/https values are then accepted. - set $proxy_x_forwarded_proto $scheme; - set $forwarded_proto_source "${SKILLHUB_TRUST_FORWARDED_PROTO}:$http_x_forwarded_proto"; - if ($forwarded_proto_source ~* "^true:https$") { - set $proxy_x_forwarded_proto https; - } - if ($forwarded_proto_source ~* "^true:http$") { - set $proxy_x_forwarded_proto http; - } - - # Sub-path routing is generated by docker-entrypoint.d/20-base-path.sh. The glob - # tolerates its absence (root deployment or config-only tests); the default below - # keeps $skillhub_forwarded_prefix defined even when the file is not present. - set $skillhub_forwarded_prefix ""; - include /etc/nginx/skillhub-base-path*.conf; - - location / { - try_files $uri $uri/ /index.html; - } - - location /api/ { - proxy_pass ${SKILLHUB_API_UPSTREAM}; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; - proxy_set_header X-Forwarded-Prefix $skillhub_forwarded_prefix; - } - - location /oauth2/ { - proxy_pass ${SKILLHUB_API_UPSTREAM}; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; - proxy_set_header X-Forwarded-Prefix $skillhub_forwarded_prefix; - } - - location /login/oauth2/ { - proxy_pass ${SKILLHUB_API_UPSTREAM}; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; - proxy_set_header X-Forwarded-Prefix $skillhub_forwarded_prefix; - } - - location /.well-known/ { - proxy_pass ${SKILLHUB_API_UPSTREAM}; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; - proxy_set_header X-Forwarded-Prefix $skillhub_forwarded_prefix; - } - - location /assets/ { - expires 1y; - add_header Cache-Control "public, immutable"; - } - - location = /registry/skill.md { - default_type text/plain; - add_header Content-Disposition "inline"; - add_header X-Content-Type-Options "nosniff"; - try_files $uri =404; - } - - location = /runtime-config.js { - add_header Cache-Control "no-store"; - try_files $uri =404; - } - - location /nginx-health { - return 200 'ok'; - add_header Content-Type text/plain; - } -} +server_tokens off; +server { + listen 80; + server_name _; + root /usr/share/nginx/html; + index index.html; + + client_max_body_size 100M; + + gzip on; + gzip_types text/plain text/css application/json application/javascript text/xml; + gzip_min_length 1000; + + # Ignore client-supplied forwarded proto by default. Operators may explicitly trust a + # sanitizing upstream proxy; only canonical http/https values are then accepted. + set $proxy_x_forwarded_proto $scheme; + set $forwarded_proto_source "${SKILLHUB_TRUST_FORWARDED_PROTO}:$http_x_forwarded_proto"; + if ($forwarded_proto_source ~* "^true:https$") { + set $proxy_x_forwarded_proto https; + } + if ($forwarded_proto_source ~* "^true:http$") { + set $proxy_x_forwarded_proto http; + } + + # Sub-path routing is generated by docker-entrypoint.d/20-base-path.sh. The glob + # tolerates its absence (root deployment or config-only tests); the default below + # keeps $skillhub_forwarded_prefix defined even when the file is not present. + set $skillhub_forwarded_prefix ""; + include /etc/nginx/skillhub-base-path*.conf; + + location / { + add_header Cache-Control "no-cache, must-revalidate" always; + try_files $uri $uri/ /index.html; + } + + location /api/ { + proxy_pass ${SKILLHUB_API_UPSTREAM}; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; + proxy_set_header X-Forwarded-Prefix $skillhub_forwarded_prefix; + } + + location /oauth2/ { + proxy_pass ${SKILLHUB_API_UPSTREAM}; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; + proxy_set_header X-Forwarded-Prefix $skillhub_forwarded_prefix; + } + + location /login/oauth2/ { + proxy_pass ${SKILLHUB_API_UPSTREAM}; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; + proxy_set_header X-Forwarded-Prefix $skillhub_forwarded_prefix; + } + + location /.well-known/ { + proxy_pass ${SKILLHUB_API_UPSTREAM}; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; + proxy_set_header X-Forwarded-Prefix $skillhub_forwarded_prefix; + } + + location /assets/ { + expires 1y; + add_header Cache-Control "public, immutable"; + } + + location = /registry/skill.md { + default_type text/plain; + add_header Content-Disposition "inline"; + add_header X-Content-Type-Options "nosniff"; + try_files $uri =404; + } + + location = /runtime-config.js { + add_header Cache-Control "no-store"; + try_files $uri =404; + } + + location /nginx-health { + return 200 'ok'; + add_header Content-Type text/plain; + } +}