nginx.conf

server {
    listen ${PORT};
    listen [::]:${PORT};
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    #add_header X-Frame-Options SAMEORIGIN;
    #add_header X-Content-Type-Options nosniff;
    #add_header Referrer-Policy strict-origin-when-cross-origin;
    #add_header X-Permitted-Cross-Domain-Policies none;
    #add_header Cross-Origin-Resource-Policy same-site;
    add_header Cross-Origin-Opener-Policy same-origin;
    add_header Cross-Origin-Embedder-Policy require-corp;
    #add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: blob:; style-src 'self' 'unsafe-inline' https: http:; img-src 'self' data: blob: https: http:; connect-src data: blob: https: http:; font-src 'self' https: http:; object-src 'none'; base-uri 'self'; form-action 'self';";

    include /etc/nginx/mime.types;
    types {
        # mime.types already maps js, remapping it here only emits a
        # "duplicate extension" warning on every startup.
        application/javascript mjs;
    }

    # `/it-tools` is the same place as `/it-tools/`, but only the second one gives the
    # browser the right directory to resolve the app's relative URLs against, so send the
    # first one there. Renders to `^$` -- which no request URI can match -- when the app is
    # served from the root. Relative Location headers, because $scheme is whatever the
    # reverse proxy used to reach the container, not what the browser used.
    absolute_redirect off;
    rewrite ^${BASE_URL_NO_SLASH_REGEX}$ ${BASE_URL} permanent;

    # Serving the app from a subpath (BASE_URL, normalised by
    # docker-entrypoint.d/18-resolve-base-url.envsh, `/` by default).
    #
    # The build is path-agnostic: every asset is referenced relatively, and the one
    # absolute anchor is a `<base href="/">` in index.html that the app itself reads its
    # base from (src/utils/base-url.ts). Rewriting that single tag on the way out is
    # therefore enough to move the whole app to another path -- no rebuild, no
    # subpath-specific image.
    #
    # sub_filter drops Last-Modified/ETag from every response it touches, and text/html is
    # always in scope (sub_filter_types can add types, not exclude HTML). So: index.html,
    # which an SPA must not cache anyway and which the service worker precaches regardless,
    # and the one other HTML document in the build -- the visual-subnet-calculator's iframe,
    # public/visualsubnetcalc/calc.html -- which loses conditional revalidation and is
    # refetched in full when that tool is opened.
    sub_filter '<base href="/">' '<base href="${BASE_URL}">';
    sub_filter_once on;

    # Hashed build output, with or without the deployment prefix in front of it: a reverse
    # proxy may pass `/it-tools/assets/...` through as-is or strip the prefix first, and
    # both have to land on the same file. Without this, a missing chunk falls through to
    # index.html below and is served as text/html with a 200, which the browser rejects
    # with an opaque MIME error instead of a plain 404.
    location ~ ^/(?:.*/)?assets/(?<asset>.+)$ {
        try_files /assets/$asset =404;
    }

    location / {
        # Same story for everything else the app fetches by path (the JSON config files,
        # the WASM helpers in public/): drop the deployment prefix when the proxy forwarded
        # it instead of stripping it. Renders to `^/(.*)$` -- a no-op -- for the default
        # BASE_URL of `/`.
        rewrite ^${BASE_URL_REGEX}(.*)$ /$1 break;
        # No `$uri/`: nothing in the build is a directory with an index in it, so the only
        # thing matching one ever produced was nginx's own "add the trailing slash"
        # redirect -- computed from the URI *after* the rewrite above, so under a subpath
        # `/it-tools/figlet-fonts` bounced the browser out of the app to `/figlet-fonts/`
        # (and then to a 403). Unknown paths belong to the SPA, which has a 404 page.
        try_files $uri /index.html;
    }
}