nginx.conf

server {
    listen 80;
    server_name _;
    root /usr/share/nginx/html;

    # Keep Location headers relative so published host ports (e.g. :8080) survive redirects.
    absolute_redirect off;

    # Hashed Vite build output — never SPA-fallback. A missing file must 404
    # (not return index.html as text/html), otherwise CDNs cache the HTML under
    # the .js/.css URL and browsers fail with NS_ERROR_CORRUPTED_CONTENT /
    # MIME mismatches.
    location /assets/ {
        try_files $uri =404;
        add_header Cache-Control "public, max-age=31536000, immutable" always;
    }

    # Signing Layer — unbundled ES modules (same origin as branding)
    # Strict CSP: no network egress, self scripts/styles only. frame-ancestors
    # omitted so arbitrary Branding Layers may embed the signer iframe.
    location /signer/src/ {
        add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'none'; img-src 'none'; font-src 'none'; media-src 'none'; object-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none'; upgrade-insecure-requests" always;
        try_files $uri =404;
        add_header Cache-Control "public, max-age=300" always;
    }

    location /signer/ {
        add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'none'; img-src 'none'; font-src 'none'; media-src 'none'; object-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none'; upgrade-insecure-requests" always;
        try_files $uri $uri/ /signer/index.html;
    }

    location = /signer {
        return 301 /signer/;
    }

    # First-party passkey create host (Safari cross-origin iframe workaround)
    location /create/ {
        try_files $uri $uri/ /create/index.html;
    }

    location = /create {
        return 301 /create/;
    }

    # HTML entry points — avoid long CDN caches so deploys pick up new asset hashes
    location = /index.html {
        add_header Cache-Control "no-cache" always;
    }

    location = /create/index.html {
        add_header Cache-Control "no-cache" always;
    }

    # Branding Layer SPA at domain root (/signer/, /create/, /assets/ above take precedence)
    location / {
        try_files $uri $uri/ /index.html;
    }
}