nginx.conf

events {
    worker_connections 1024; # increase if you have lots of clients
    accept_mutex off; # set to 'on' if nginx worker_processes > 1
    use epoll;
}
http {

    gzip on;
    gzip_proxied any;
    gzip_types *;
    gzip_min_length 250;

    # Map URI or query id to get project ID when using assets route (for auth checking)
    # This handles both the /assets case (uri path) and tiler's url=file:///assets/ (tquery)
    map "$request_uri $arg_url" $project_id {
        ~*/assets/([0-9]+)/      $1;       # e.g. /assets/3/...
        ~*file:///assets/([0-9]+)/  $1;     # e.g. ?url=file:///assets/3/...
        default                  "";
    }

    # Cache-Control for the public area: the versioned .pmtiles archives and their
    # companion layer .geojson are immutable so can be cached hard; manifest.json
    # changes nightly so it revalidates.
    map $uri $public_asset_cache_control {
        ~*\.pmtiles$   "public, max-age=31536000, immutable";
        ~*\.geojson$   "public, max-age=31536000, immutable";
        default        "no-cache";
    }
    server {
        include /etc/nginx/mime.types;
        client_max_body_size 1g;

        location / {

            # Preflighted requests
            if ($request_method = OPTIONS ) {
                add_header 'Access-Control-Allow-Origin' 'http://localhost:4200' always;
                add_header 'Access-Control-Allow-Credentials' 'true' always;
                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, HEAD, PUT, DELETE' always;
                add_header 'Access-Control-Allow-Headers' 'x-csrftoken-local,x-guest-uuid,content-type,x-geoapi-application,x-geoapi-ispublicview,x-tapis-token' always;
                add_header 'Access-Control-Max-Age' 86400 always;
                add_header 'Content-Length' 0 always;
                return 204;
            }

            add_header 'Access-Control-Allow-Origin' 'http://localhost:4200' always;
            add_header 'Access-Control-Allow-Credentials' 'true' always;
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, HEAD, PUT, DELETE' always;
            add_header 'Access-Control-Allow-Headers' 'x-csrftoken-local,x-guest-uuid,content-type,x-geoapi-application,x-geoapi-ispublicview,x-tapis-token' always;

            rewrite ^/api(.*) /$1 break;
            proxy_pass http://geoapi_backend:8000/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";

            proxy_redirect off;

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $server_name;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        # Assets available to everyone -- currently only the PMTiles archive of
        # all published DesignSafe projects (WG-703). A separate block from
        # `location /assets` so it skips that block's auth_request.
        location /assets/public/ {
            alias /assets/public/;

            # .pmtiles/.geojson aren't in the default mime.types; the consumer keys off them
            types {
                application/vnd.pmtiles pmtiles;
                application/geo+json geojson;
                application/json json;
            }
            default_type application/octet-stream;

            gzip off;
            add_header Accept-Ranges bytes always;

            add_header Cache-Control $public_asset_cache_control always;

            add_header Access-Control-Allow-Origin * always;
            add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
            add_header Access-Control-Allow-Headers "Range" always;
            add_header Access-Control-Expose-Headers
                "Content-Length, Content-Range, Accept-Ranges" always;

            if ($request_method = OPTIONS) {
                add_header Access-Control-Allow-Origin * always;
                add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
                add_header Access-Control-Allow-Headers "Range" always;
                add_header Access-Control-Max-Age 86400 always;
                add_header Content-Length 0 always;
                return 204;
            }
        }

        location /assets {
            # Call geoapi to check access before serving file
            auth_request /auth-check;

            alias /assets/;
            expires 30d;
            add_header "Access-Control-Allow-Origin" * always;
            add_header "Access-Control-Allow-Headers" * always;

            # Allow range requests for .bin files for potree point clouds
            #   Also, disable gzip for .bin files as it causes some browsers
            #   to send entire compressed file
            location ~ \.bin$ {
                add_header Accept-Ranges bytes;
                gzip off;
            }

            # PMTiles vector assets are read by the browser via cross-origin
            # HTTP range requests, so we must:
            #   * allow byte ranges and disable gzip (gzip breaks range reads)
            #   * answer the CORS preflight, advertising the x-tapis-token
            #     header the app sends to authenticate the request
            location ~ \.pmtiles$ {
                if ($request_method = OPTIONS) {
                    add_header "Access-Control-Allow-Origin" * always;
                    add_header "Access-Control-Allow-Methods" "GET, HEAD, OPTIONS" always;
                    add_header "Access-Control-Allow-Headers" * always;
                    add_header "Access-Control-Max-Age" "86400" always;
                    add_header "Content-Length" "0" always;
                    return 204;
                }

                add_header Accept-Ranges bytes;
                add_header "Access-Control-Allow-Origin" * always;
                add_header "Access-Control-Allow-Headers" * always;
                gzip off;
            }

            # Preflighted requests
            if ($request_method = OPTIONS) {
                add_header "Access-Control-Allow-Origin" "*" always;
                add_header "Access-Control-Allow-Methods" "GET, POST, OPTIONS, HEAD, PUT, DELETE" always;
                add_header "Access-Control-Max-Age" "86400" always;
                add_header "Content-Length" "0" always;
                return 204;
            }
        }

        # TiTiler health/docs endpoints (no auth needed)
        location ~ ^/tiles/(healthz|docs|openapi\.json) {
            add_header 'Access-Control-Allow-Origin' 'http://localhost:4200' always;
            add_header 'Access-Control-Allow-Credentials' 'true' always;

            rewrite ^/tiles/(.*) /$1 break;
            proxy_pass http://geoapi_titiler:80;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
        }

        location /tiles/ {
            # Call geoapi to check access (i.e. user has acccess to project or project is public) before serving file
            # auth_request /auth-check;

            # CRITICAL: Add CORS headers BEFORE proxy_pass
            add_header 'Access-Control-Allow-Origin' 'http://localhost:4200' always;
            add_header 'Access-Control-Allow-Credentials' 'true' always;
            add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
            add_header 'Access-Control-Allow-Headers' 'x-csrftoken,x-guest-uuid,content-type,x-geoapi-application,x-geoapi-ispublicview,x-tapis-token' always;

            if ($request_method = OPTIONS) {
                add_header 'Access-Control-Allow-Origin' 'http://localhost:4200' always;
                add_header 'Access-Control-Allow-Credentials' 'true' always;
                add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
                add_header 'Access-Control-Allow-Headers' 'x-csrftoken,x-guest-uuid,content-type,x-geoapi-application,x-geoapi-ispublicview,x-tapis-token' always;
                add_header 'Access-Control-Max-Age' 86400 always;
                add_header 'Content-Length' 0 always;
                return 204;
            }

            # Strip /tiles prefix and pass to TiTiler
            rewrite ^/tiles/(.*) /$1 break;
            proxy_pass http://geoapi_titiler:80;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $server_name;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            # Hide backend errors to prevent leaking info
            proxy_intercept_errors on;
        }


        location = /auth-check {
            internal;

            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Headers *;

            proxy_pass http://geoapi_backend:8000/projects/$project_id/check-access/;

            proxy_pass_request_body off;
            proxy_set_header Content-Length "";

            proxy_set_header X-Tapis-Token $http_x_tapis_token;
            proxy_set_header X-Original-URI $request_uri;
        }
    }
}