nginx.conf

server {
    # Port is set dynamically at container start by docker-entrypoint.sh
    listen __PORT__;

    root /usr/share/nginx/html;
    index index.html;

    # Gzip compression for faster loads
    gzip on;
    gzip_types
        text/plain
        text/css
        text/javascript
        application/javascript
        application/json
        image/svg+xml;
    gzip_min_length 1024;

    # Aggressive caching for Vite's hashed asset files (JS, CSS, images).
    # Vite puts a content hash in the filename (e.g. index-Dh3k9aB2.js)
    # so it's safe to cache these indefinitely — a new deploy = new hash.
    location ~* /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        try_files $uri =404;
    }

    # Don't cache the HTML entry point — it must always be fresh
    # so the browser picks up new asset hashes after a deploy.
    location = /index.html {
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    # SPA fallback: any route that doesn't match a real file
    # (e.g. /dashboard, /auth) returns index.html so React Router
    # can handle it client-side. Without this, refreshing a deep
    # route returns a 404 from nginx.
    location / {
        try_files $uri $uri/ /index.html;
    }

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Hide nginx version from error pages and headers
    server_tokens off;
}