kokkoja-rel/deploy/nginx-site.conf

# nginx server block for a Kokkoja web site: the client's files at
# https://app.kokkoja.com/ and the relay at wss://app.kokkoja.com/relay.
# Installed by deploy/setup_vps.sh as /etc/nginx/sites-available/kokkoja.
#
# This is the plain HTTP form.  certbot --nginx -d app.kokkoja.com -d
# kokkoja.andykopra.com adds the TLS listeners and turns the HTTP blocks
# into redirects.

server {
    listen 80;
    server_name app.kokkoja.com;

    root /var/www/kokkoja;
    index index.html;

    # The relay.  The client connects to <relay address>/room/<room id>,
    # so /relay/room/<id> here becomes /room/<id> at the relay.
    location /relay/ {
        proxy_pass http://127.0.0.1:8770/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Forwarded-For $remote_addr;
        # The relay pings every 20 seconds; a quiet lesson must not be cut off.
        proxy_read_timeout 1h;
        proxy_send_timeout 1h;
    }

    location / {
        try_files $uri $uri/ =404;
    }

    # The client is a few small files that change with every deployment:
    # browsers ask whether they have changed rather than keeping old ones.
    add_header Cache-Control "no-cache" always;
    # The client loads nothing from anywhere else, and may not be framed.
    add_header Content-Security-Policy "default-src 'self'; connect-src 'self' wss://app.kokkoja.com; img-src 'self' blob: data:; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer" always;
}

# The old name, kept so that bookmarks and links to the SITE still reach
# it: everything is redirected to app.kokkoja.com.  The browser carries a
# link's #join fragment across the redirect, so the join page opens; but
# an invitation made before the move names the old relay inside that
# fragment, and a WebSocket does not follow the 301 (and the new CSP
# forbids the old host), so a pre-move invitation opens but cannot
# connect.  Invitations made from app.kokkoja.com name the new relay and
# are fine; live invitations are per-session, so none is affected in
# practice.
server {
    listen 80;
    server_name kokkoja.andykopra.com;
    return 301 https://app.kokkoja.com$request_uri;
}