gateway.nginx.conf

# Compose app-profile gateway: the single public origin in front of the stack.
# Routes the backend prefixes to the API and everything else to the web SPA,
# matching the reverse-proxy contract in docs/self-hosting/deployment.mdx.

map $http_upgrade $connection_upgrade {
    default upgrade;
    ""      close;
}

server {
    listen 8080;
    server_name _;

    # Resolve service names per request so API/web container restarts do not
    # pin stale addresses. 127.0.0.11 is the Docker embedded DNS server.
    resolver 127.0.0.11 valid=10s ipv6=off;

    # The API enforces its own per-route body limits; stay above them.
    client_max_body_size 100m;

    location ~ ^/(?:api|mcp|install|\.well-known|healthz)(?:/|$) {
        set $api_upstream http://api:8080;
        proxy_pass $api_upstream;
        proxy_http_version 1.1;
        # The API pins the browser-facing Host header via OMNARA_PUBLIC_URL.
        proxy_set_header Host $http_host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        # Event streams and daemon sockets are long-lived; do not buffer.
        proxy_buffering off;
        proxy_request_buffering off;
        proxy_read_timeout 1h;
        proxy_send_timeout 1h;
    }

    location / {
        set $web_upstream http://web:8080;
        proxy_pass $web_upstream;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}