handbook.nginx.conf

server {
    listen 8080 default_server;
    server_name _;

    # Emit relative Location headers so redirects work behind a reverse
    # proxy — otherwise nginx prepends the internal listen address and
    # the browser follows a host it cannot reach.
    absolute_redirect off;

    root /usr/share/nginx/html;
    index index.html;

    # Hide nginx version in Server header.
    server_tokens off;

    # Access gate. The htpasswd file is generated at container start from
    # HANDBOOK_USER / HANDBOOK_PASSWORD (see docker-entrypoint.sh) and is
    # never baked into the image. /healthz bypasses auth so HEALTHCHECK
    # and CI smoke stay credential-free.
    auth_basic "DFX Services Handbook";
    auth_basic_user_file /etc/nginx/handbook.htpasswd;

    # Security headers for a static, embed-safe handbook.
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    # Behind Basic Auth: never let a shared edge cache store responses.
    # With max-age, intermediaries have been observed caching 401s (then
    # served to authenticated clients) and authenticated 200s. Vary on
    # Authorization is ignored by common edge caches outside Enterprise
    # plans. The only safe answer for gated content is no-store.
    add_header Cache-Control "private, no-store" always;

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    # text/html is gzipped by default; do not list it again.
    gzip_types
        text/plain
        text/css
        text/javascript
        application/javascript
        application/json
        image/svg+xml;

    # Unauthenticated health endpoint — Dockerfile HEALTHCHECK and CI
    # smoke. nginx add_header is all-or-nothing per location, so server-
    # level security headers are restated here.
    location = /healthz {
        auth_basic off;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Cache-Control "no-store" always;
        default_type text/plain;
        return 200 "OK\n";
    }

    # PDFs inline in the browser (not forced download). Restate headers
    # because add_header is all-or-nothing per location.
    location ~* \.pdf$ {
        add_header Content-Disposition "inline" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Cache-Control "private, no-store" always;
        try_files $uri =404;
    }

    location / {
        try_files $uri $uri/ =404;
    }
}