Nginx Configuration

The reference Nginx config is at deploy/docker/nginx.conf and covers the Docker Compose deployment. For binary deployments, adapt the same config as your TLS- terminating reverse proxy.

Key responsibilities

  • Serve the WASM frontend from /usr/share/nginx/html (or wherever you copied frontend/dist/).

  • Proxy /api/ to the backend* on port 3000.

  • Set the WASM MIME type explicitly — older Nginx builds default to application/octet-stream which the browser refuses to instantiate as WebAssembly.

  • Cache static assets aggressively (.wasm, .js, *.css, images) for 7 days with Cache-Control: immutable.

  • Disable cache for sw.js — service workers MUST always re-fetch to honour updates. Browsers ignore long-cache headers on the service-worker file by spec, but explicit no-store on top is belt-and-braces.

  • Short cache for manifest.json (1h) so PWA users pick up icon/name changes.

Security headers

The reference config sets:

  • X-Frame-Options: SAMEORIGIN (prevents clickjacking)

  • X-Content-Type-Options: nosniff (prevents MIME sniffing)

  • Referrer-Policy: strict-origin-when-cross-origin

  • Permissions-Policy: camera=(), microphone=(), geolocation=()

For TLS, add:

  • Strict-Transport-Security: max-age=31536000; includeSubDomains

Anubis bot protection

The Compose stack puts anubis in front of nginx for proof-of-work bot mitigation on the public surface. If you don’t need it, remove the anubis service and bind nginx directly to the host.

Customising

To embed your own VAPID public key for push notifications, set VAPID_PUBLIC_KEY as a build-time env when running trunk build (the frontend reads it via option_env!).

See Also