uPortal2/frontend/nginx.conf.example

# Example single-origin deployment for goChat.
#
#   browser ──▶ nginx ──▶ /        static frontend build (dist/)
#                     └─▶ /api/…   Go backend on :8080
#
# Build the frontend first:
#   cd frontend && npm install && npm run build
# then point `root` at the dist/ directory.

server {
    listen 80;
    server_name gochat.example.com;

    # Serve the bundled SPA.
    root /srv/gochat/dist;
    index index.html;

    # Hashed/static bundles can be cached aggressively; index.html must not be.
    location / {
        try_files $uri $uri/ /index.html;
    }

    location = /index.html {
        add_header Cache-Control "no-store";
    }

    # Reverse proxy the API to the Go service. Keeping the same origin means
    # the session cookie (SameSite=Lax) and CSRF cookie work without CORS.
    #
    # $proxy_add_x_forwarded_for appends the immediate peer to X-Forwarded-For,
    # so when a parent proxy resolves the real client IP first, the backend
    # (which reads the leftmost value) still sees it. Only switch to $remote_addr
    # if this nginx is the outermost/edge proxy and you want to reject
    # client-supplied X-Forwarded-For.
    location /api/ {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# For TLS, terminate HTTPS at nginx and set COOKIE_SECURE=true on the backend
# so the session/csrf cookies are only sent over HTTPS.