nginx.web.conf

map $http_x_forwarded_for $spliit_forwarded_for {
  default $http_x_forwarded_for;
  '' $remote_addr;
}

map $http_x_real_ip $spliit_real_ip {
  default $http_x_real_ip;
  '' $remote_addr;
}

map $http_x_forwarded_proto $spliit_forwarded_proto {
  default $http_x_forwarded_proto;
  '' $scheme;
}

map $http_host $spliit_forwarded_host {
  default $http_host;
  '' $host;
}

server {
  listen 80;
  server_name _;

  root /usr/share/nginx/html;
  index index.html;

  # The Docker deployment is same-origin by default. Keep the API private on
  # the Compose network and forward only its public route surface through this
  # web container.
  proxy_http_version 1.1;
  proxy_set_header Host $spliit_forwarded_host;
  # The published port binds to loopback by default, so the host reverse proxy
  # is the trusted edge. Preserve the client identity and public scheme it
  # supplies; fall back to this connection for direct/local requests.
  proxy_set_header X-Real-IP $spliit_real_ip;
  proxy_set_header X-Forwarded-For $spliit_forwarded_for;
  proxy_set_header X-Forwarded-Host $spliit_forwarded_host;
  proxy_set_header X-Forwarded-Proto $spliit_forwarded_proto;

  # These are SPA pages, not Better Auth endpoints. Exact matches take
  # precedence over the API proxy below so refreshes and emailed redirects
  # continue to serve index.html.
  location = /auth/forgot-password {
    try_files $uri /index.html;
  }

  location = /auth/reset-password {
    try_files $uri /index.html;
  }

  location = /auth/complete-profile {
    try_files $uri /index.html;
  }

  location ~ ^/(trpc|auth)(/|$) {
    proxy_buffering off;
    proxy_pass http://api:3001;
  }

  location ^~ /.well-known/ {
    proxy_buffering off;
    proxy_pass http://api:3001;
  }

  location ~ ^/health(/|$) {
    proxy_pass http://api:3001;
  }

  location = /email/unsubscribe {
    proxy_pass http://api:3001;
  }

  location ~ ^/groups/[^/]+/expenses/export/(json|csv)$ {
    proxy_pass http://api:3001;
  }

  location = /openapi.json {
    proxy_pass http://api:3001;
  }

  location = /docs {
    proxy_pass http://api:3001;
  }

  location /assets/ {
    try_files $uri =404;
    add_header Cache-Control "public, max-age=31536000, immutable" always;
  }

  location = /index.html {
    add_header Cache-Control "no-cache, max-age=0, must-revalidate" always;
  }

  location = /sw.js {
    add_header Cache-Control "no-cache, max-age=0, must-revalidate" always;
  }

  location = /registerSW.js {
    add_header Cache-Control "no-cache, max-age=0, must-revalidate" always;
  }

  location = /manifest.webmanifest {
    add_header Cache-Control "no-cache, max-age=0, must-revalidate" always;
  }

  location / {
    add_header Cache-Control "no-cache, max-age=0, must-revalidate" always;
    try_files $uri $uri/ /index.html;
  }
}