# openGym — standalone web server: serves the static app AND proxies /api to the backend,

# so the whole app lives on ONE origin (required for WebAuthn / passkeys).

server {

listen 80;

root /usr/share/nginx/html;

index index.html;

# API → backend container

location /api/ {

proxy_pass http://api:3000;

proxy_http_version 1.1;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

}

# SPA fallback

location / {

try_files $uri $uri/ /index.html;

}

# App shell: always revalidate so updates show up immediately

location ~* \.(js|css|json|html)$ {

add_header Cache-Control "no-cache, must-revalidate";

}

# Exercise images/GIFs never change → cache hard

location ~* \.(png|jpg|jpeg|gif|ico|svg|woff|woff2|webp|avif)$ {

expires 30d;

add_header Cache-Control "public, max-age=2592000, immutable";

}

gzip on;

gzip_types text/plain text/css application/json application/javascript image/svg+xml;

gzip_vary on;

gzip_min_length 1024;

}