romm/docker/nginx/templates/default.conf.template

# This template is used to generate the default.conf file for the nginx server,
# by using `envsubst` to replace the environment variables in the template with
# their actual values.

# Gunicorn upstream. Defined here (not in nginx.conf) so the port stays in sync
# with the ${DEV_PORT} gunicorn binds to.
upstream wsgi_server {
    server 127.0.0.1:${DEV_PORT};
}

# Helper to get scheme regardless if we are behind a proxy or not
map $http_x_forwarded_proto $forwardscheme {
    default $scheme;
    https https;
}

# COEP and COOP headers for cross-origin isolation, which are set only for the
# EmulatorJS and js-dos player paths, to enable SharedArrayBuffer support, which
# is needed for multi-threaded cores. Not $uri: try_files rewrites it to
# /index.html before add_header runs, so the query string is matched explicitly.
# frontend/scripts/playerIsolationHeaders.ts restates these entries for the dev server.
map $request_uri $coep_header {
    default        "";
    ~^/rom/.*/(ejs|jsdos)(\?|$) "require-corp";
    ~^/console/rom/[0-9]+/play "require-corp";
}
map $request_uri $coop_header {
    default        "";
    ~^/rom/.*/(ejs|jsdos)(\?|$) "same-origin";
    ~^/console/rom/[0-9]+/play "same-origin";
}

# The EasyRPG web player fetches each file of a game from games/<rom id>-<user id>/
# beside itself. Built from the raw $request_uri, so names keep the client's encoding.
map $request_uri $easyrpg_backend_uri {
    default "";
    ~^/assets/easyrpg/games/(?<rom_id>[0-9]+)-[0-9]+/(?<easyrpg_path>[^?]*) /api/roms/$rom_id/easyrpg/$easyrpg_path;
}

# Library resources under /assets/romm/resources/ are a mix. Covers (?ts=) and
# manuals (?v=) are versioned by a known cache-busting query, so they can be
# frozen; screenshots and RA badges reuse stable filenames (0.jpg, ...) and are
# overwritten on re-scrape, so they must revalidate. Freeze only when a
# recognized version param (ts or v) is present, not on any arbitrary query
# (e.g. ?download=1 must not pin a screenshot for a year).
map $args $resources_cache_control {
    default         "public, max-age=3600, must-revalidate";
    "~(^|&)(ts|v)=" "public, max-age=31536000, immutable";
}

server {
    root /var/www/html;
    listen ${ROMM_PORT};
    ${IPV6_LISTEN}
    server_name localhost;

    ${NGINX_ACCESS_LOG}

    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $forwardscheme;

    # Serve the .gz siblings the frontend build writes. Scoped to the build output:
    # the internal /library/ and /cache/ locations must never match a ROM's own
    # .gz sibling, and library resources have no precompressed form.
    location / {
        gzip_static on;
        try_files $uri $uri/ /index.html;
        proxy_redirect off;
        add_header Cache-Control "no-cache";
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods *;
        add_header Access-Control-Allow-Headers *;
        add_header Cross-Origin-Embedder-Policy $coep_header;
        add_header Cross-Origin-Opener-Policy $coop_header;
    }

    # Freeze content-hashed frontend bundles (fingerprinted files under /assets)
    location ~* "^/assets/[^/]+-[A-Za-z0-9_-]{8,}\.(js|mjs|css|map|woff2?|ttf|otf|eot|svg|png|jpe?g|gif|webp|avif|ico|json|wasm)$" {
        add_header Cache-Control "public, max-age=31536000, immutable";
        gzip_static on;
        try_files $uri $uri/ =404;
    }

    # Freeze library resources carrying cache-busting query
    location /assets/romm/resources/ {
        add_header Cache-Control $resources_cache_control;
        try_files $uri $uri/ =404;
    }

    location ^~ /assets/easyrpg/games/ {
        if ($easyrpg_backend_uri = "") {
            return 404;
        }
        proxy_pass http://wsgi_server$easyrpg_backend_uri;
    }

    # Everything else under /assets keeps a stable URL across image upgrades
    location /assets {
        add_header Cache-Control "public, max-age=3600, must-revalidate";
        gzip_static on;
        try_files $uri $uri/ =404;
    }

    # OpenAPI for swagger and redoc
    location /openapi.json {
        proxy_pass http://wsgi_server;
    }

    # Backend api calls
    location /api {
        proxy_pass http://wsgi_server;
        proxy_request_buffering off;
        proxy_buffering off;
        proxy_read_timeout 300s;
    }
    location ~ ^/(ws|netplay) {
        proxy_pass http://wsgi_server;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    # Internally redirect download requests
    location /library/ {
        internal;
        alias "${ROMM_BASE_PATH}/library/";
    }

    # Internally redirect cached zip file requests (Range-resumable downloads)
    location /cache/ {
        internal;
        alias "${ROMM_BASE_PATH}/cache/";
    }

    # Internal decoding endpoint, used to decode base64 encoded data
    location /decode {
        internal;
        js_content decode.decodeBase64;
    }
}