nginx-widget.conf

# Map to determine the external port from X-Forwarded-Port or use default 8080
map $http_x_forwarded_port $external_port {
    default $http_x_forwarded_port;
    ""      "8080";
}

# Map to determine the protocol
map $http_x_forwarded_proto $external_proto {
    default $http_x_forwarded_proto;
    ""      "http";
}

server {
    listen 80;
    server_name localhost;

    # Serve static files from the widget public directory
    location / {
        root /usr/share/nginx/html;
        index index.html;
        try_files $uri $uri/ =404;

        # Disable caching for development
        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
        add_header Pragma "no-cache" always;
        add_header Expires "0" always;

        # CORS headers for widget embedding
        add_header Access-Control-Allow-Origin "*" always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;
    }

    # Proxy API requests to the backend
    location /api/ {
        proxy_pass http://soliplex_backend:8000/api/;

        # Pass the host with the external port so backend constructs correct redirect URIs
        proxy_set_header Host $host:$external_port;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $external_proto;
        proxy_set_header X-Forwarded-Port $external_port;
        proxy_set_header X-Forwarded-Host $host:$external_port;
        proxy_read_timeout 120;

        # CORS headers
        add_header Access-Control-Allow-Origin "*" always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;

        # Handle preflight requests
        if ($request_method = 'OPTIONS') {
            add_header Access-Control-Allow-Origin "*";
            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
            add_header Access-Control-Allow-Headers "Authorization, Content-Type";
            add_header Content-Length 0;
            add_header Content-Type text/plain;
            return 204;
        }
    }
}