servers.conf.erb

map $http_cache_control $cache_control {
    ""        "no-cache; max-age=0";
    default   $http_cache_control;
}

server {
    server_name localhost;
    listen <%= ENV['PORT'] %>;

    charset utf-8;

    resolver 8.8.8.8;

    port_in_redirect off;
    keepalive_timeout 5;
    root <%= ENV['BUILD_FOLDER'] || "/app/build/" %>;

    <% if not ENV['DISABLE_FORCE_HTTPS'] %>
        if ($http_x_forwarded_proto != "https") {
          return 301 https://$host$request_uri;
        }
    <% end %>

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
    add_header X-Frame-Options "deny";
    add_header X-Content-Type-Options "nosniff";
    # https://developers.google.com/tag-platform/security/guides/csp
    add_header Content-Security-Policy "object-src 'self'; connect-src 'self' https://client.crisp.chat https://api-adresse.data.gouv.fr https://sentry.incubateur.net wss://client.relay.crisp.chat https://stats.beta.gouv.fr https://client.axept.io/ https://api.axept.io https://google.com; base-uri 'self'; default-src 'self'; script-src 'self' https://client.crisp.chat https://stats.beta.gouv.fr https://static.axept.io/ https://www.googletagmanager.com/ https://www.googleadservices.com/ https://googleads.g.doubleclick.net https://www.google.com 'unsafe-eval' 'unsafe-inline'; img-src 'self' data: https://client.crisp.chat https://image.crisp.chat https://stats.beta.gouv.fr https://res.cloudinary.com https://images.unsplash.com https://axeptio.imgix.net https://favicons.axept.io https://t1.gstatic.com https://www.google.com/ https://www.google.fr/ https://googleads.g.doubleclick.net https://www.googleadservices.com https://beta.gouv.fr; style-src 'self' 'unsafe-inline' https://client.crisp.chat https://cdn.jsdelivr.net; font-src 'self' https://client.crisp.chat https://cdn.jsdelivr.net; frame-src https://metabase.mobilic.beta.gouv.fr https://www.slideshare.net https://fr.slideshare.net https://cgu.mobilic.beta.gouv.fr https://form.typeform.com https://player.vimeo.com https://bid.g.doubleclick.net/";
    add_header X-XSS-Protection "1; mode=block";
    add_header Cache-Control $cache_control;

    location / {
      try_files $uri.html $uri $uri/ /index.html;
    }

    location ~ \.html$ {
      try_files $uri @404;
    }

    location ^~ /static/ {
     try_files $uri.html $uri $uri/ @404;
    }

    location ~ ^/developers/playground$ {
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
        add_header X-Frame-Options "deny";
        add_header X-Content-Type-Options "nosniff";
        add_header Content-Security-Policy "script-src 'self' https://buttons.github.io; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com";
        add_header X-XSS-Protection "1; mode=block";
        add_header Cache-Control "no-cache; max-age=0";
      try_files /api-playground.html @404;
    }

    location ~ ^/developers.*$ {
       return 301 https://developers.mobilic.beta.gouv.fr;
    }

    location ~ ^/.*$ {
     try_files $uri.html $uri $uri/ /index.html;
    }


    # need this b/c setting $fallback to =404 will try #{root}=404 instead of returning a 404
    location @404 {
      return 404;
    }

    # fallback proxy named match

    set $upstream_endpoint_0 <%= ENV["API_HOST"] %>;
    location ^~ /api/ {
      rewrite ^/api//?(.*)$ /$1 break;
      # can reuse variable set above
      proxy_pass $upstream_endpoint_0;
      proxy_ssl_server_name on;

      proxy_hide_header Cache-Control;

      proxy_redirect $upstream_endpoint_0 /api/;
    }

    location = /service-worker.js {
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
        add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://storage.googleapis.com";
        add_header X-XSS-Protection "1; mode=block";
        add_header Cache-Control "no-cache; max-age=0";
        try_files /service-worker.js @404;
    }
}