Initial public ModelForge release

frontend/nginx.conf

@@ -0,0 +1,44 @@
+# Static serving for the ModelForge operator console.
+#
+# The console is a single-page application that talks to the control plane directly from the
+# browser, so this server only ever returns files from its own build output. It proxies nothing,
+# which keeps it out of the request path between an operator and an authenticated admin route.
+#
+# nginx only inherits `add_header` into a location that declares none of its own, so the security
+# headers are included in every location rather than set once on the server. Setting them at the
+# server level alone silently drops them from exactly the responses that matter most.
+server {
+    listen 3000;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+    server_tokens off;
+
+    # The console holds an operator credential in memory. These headers cost nothing and remove
+    # the easiest ways to get someone else's script or frame near it.
+    include /etc/nginx/conf.d/security-headers.inc;
+
+    # Hashed assets are immutable; the entry document must never be cached, or an operator can be
+    # left driving a console that no longer matches the control plane it is talking to.
+    location /assets/ {
+        include /etc/nginx/conf.d/security-headers.inc;
+        add_header Cache-Control "public, max-age=31536000, immutable" always;
+        try_files $uri =404;
+    }
+
+    location = /index.html {
+        include /etc/nginx/conf.d/security-headers.inc;
+        add_header Cache-Control "no-store" always;
+    }
+
+    location / {
+        include /etc/nginx/conf.d/security-headers.inc;
+        add_header Cache-Control "no-store" always;
+        try_files $uri $uri/ /index.html;
+    }
+
+    # Nothing else is served: no directory listings, no dotfiles, no source maps by path guess.
+    location ~ /\. {
+        deny all;
+    }
+}