ttstd-infinite-canvas/nginx.conf

map $http_x_forwarded_proto $canvas_forwarded_proto {
    default $http_x_forwarded_proto;
    "" $scheme;
}

log_format canvas_no_query '$remote_addr - $remote_user [$time_local] '
                           '"$request_method $uri $server_protocol" $status $body_bytes_sent '
                           '"$http_referer" "$http_user_agent"';

server {
    listen 3000;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;
    # 业务配置最高允许 999MB；网关保留少量 multipart 开销，避免保存出无法生效的上限。
    client_max_body_size 1024m;
    access_log /var/log/nginx/access.log canvas_no_query;
    add_header Referrer-Policy "no-referrer" always;
    gzip on;
    gzip_comp_level 5;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_vary on;
    gzip_types application/json application/javascript text/css text/plain image/svg+xml;

    # Vite assets use content hashes, so they are safe to cache across deployments.
    # Keep index.html uncached below so it always points to the current asset manifest.
    location ^~ /assets/ {
        access_log off;
        try_files $uri =404;
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable" always;
    }

    location ^~ /api/public/canvas-shares/ {
        access_log off;
        proxy_pass http://backend:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $canvas_forwarded_proto;
        proxy_set_header X-Forwarded-Host $host;
        proxy_read_timeout 3600s;
    }

    # 文本任务事件流必须逐条转发；该规则只作用于 SSE，不改变其他 API 的缓存和超时策略。
    location ~ ^/api/(tasks/[^/]+/text-events|agent/runs/[^/]+/events)$ {
        proxy_pass http://backend:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $canvas_forwarded_proto;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        proxy_pass_header X-Accel-Buffering;
        gzip off;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }

    # 系统渠道的 OpenAI / Gemini 文本接口直接向浏览器返回模型事件流。
    location ~ ^/api/ai/system/[^/]+/(?:responses|chat/completions|models/[^/]+:streamGenerateContent)$ {
        proxy_pass http://backend:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $canvas_forwarded_proto;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        proxy_pass_header X-Accel-Buffering;
        gzip off;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }

    location /api/ {
        proxy_pass http://backend:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $canvas_forwarded_proto;
        proxy_set_header X-Forwarded-Host $host;
        # 自定义渠道共用一个入口；只把后端明确标记的 SSE 禁缓冲信号传给外层代理。
        proxy_pass_header X-Accel-Buffering;
        proxy_read_timeout 3600s;
    }

    location = /oauth/linuxdo/callback {
        proxy_pass http://backend:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $canvas_forwarded_proto;
        proxy_set_header X-Forwarded-Host $host;
        proxy_read_timeout 30s;
    }

    location = /assets {
        try_files /index.html =404;
    }

    location = /assets/ {
        try_files /index.html =404;
    }

    location ^~ /share/canvas/ {
        access_log off;
        try_files $uri $uri/ /index.html;
    }

    # /canvas 同时是 React 路由和静态模型资源目录；精确命中路由时必须优先回退到 SPA，
    # 否则 try_files 会把它当作目录并生成带容器端口的 301。
    location = /canvas {
        try_files /index.html =404;
    }

    location = /canvas/ {
        try_files /index.html =404;
    }

    # /welcome 是 React 路由，同时也是欢迎页静态素材目录；精确命中路由时优先回退到 SPA，
    # 避免 Nginx 把目录当作文件列表并返回 403，或生成带容器端口的 301。
    location = /welcome {
        try_files /index.html =404;
    }

    location = /welcome/ {
        try_files /index.html =404;
    }

    location / {
        try_files $uri $uri/ /index.html;
    }
}