nginx.conf

server {
    listen 8080;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    # ── Compression ───────────────────────────────────────────────────────────
    gzip on;
    gzip_vary on;
    # "off" prevents nginx from gzip-encoding responses to proxies/gateways that
    # already sent Accept-Encoding upstream. FragmentGateway decompresses server-side
    # but can leak Content-Encoding header to the browser causing ERR_CONTENT_DECODING_FAILED.
    gzip_proxied off;
    gzip_comp_level 6;
    gzip_types
        text/css
        text/javascript
        application/javascript
        application/json
        image/svg+xml
        font/woff2;
    # Omit text/html — the fragment gateway doesn't benefit from it

    # ── CORS — required for web-fragment fetch from a different origin ────────
    # The fragment HTML is fetched cross-origin by the host app (e.g. localhost
    # in dev, the data-gateway domain in production). Static content carries no
    # credentials so a wildcard origin is safe here.
    add_header Access-Control-Allow-Origin  "*"              always;
    add_header Access-Control-Allow-Methods "GET, OPTIONS"   always;
    add_header Access-Control-Allow-Headers "Content-Type, x-web-fragment-id, x-fragment-mode" always;

    # Handle OPTIONS preflight without hitting try_files
    if ($request_method = OPTIONS) {
        return 204;
    }

    # ── Security headers ──────────────────────────────────────────────────────
    add_header X-Content-Type-Options  "nosniff"         always;
    add_header X-Frame-Options         "SAMEORIGIN"      always;
    add_header X-XSS-Protection        "1; mode=block"   always;
    add_header Referrer-Policy         "strict-origin"   always;

    # ── Long cache for immutable assets (hashed filenames) ───────────────────
    location ~* \.(css|js|woff2?|ttf|eot|ico|svg|png|jpg|gif|webp)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # ── Health check endpoint ────────────────────────────────────────────────
    location = /healthz {
        access_log off;
        return 200 "ok\n";
        add_header Content-Type text/plain;
    }

    # ── Knowledge base assets: /__wf/knowledge-base/* → serve from dist root ──
    # CSS, JS and other static assets are referenced as /__wf/knowledge-base/<file>
    # so the data-gateway routes the request to the fragment server (this container).
    # Rewrite strips the /__wf/knowledge-base prefix so try_files resolves against
    # the server root (e.g. /__wf/knowledge-base/style.css → /style.css).
    location ^~ /__wf/knowledge-base/ {
        rewrite ^/__wf/knowledge-base/(.*)$ /$1 break;
        try_files $uri =404;
    }

    # ── All knowledge base traffic: /knowledge-base/* ────────────────────────
    # Handles both the data-gateway fragment path and the dedicated hostname.
    # Strip the /knowledge-base/ prefix so files resolve from the dist root.
    location ^~ /knowledge-base/ {
        rewrite ^/knowledge-base/(.*)$ /$1 break;
        # Tell any intermediate proxy (e.g. web-fragments FragmentGateway) not to
        # transcode/re-encode this response. Prevents Content-Encoding header
        # leakage when the gateway auto-decompresses but still forwards the header.
        add_header Cache-Control "no-transform" always;
        try_files $uri $uri/index.html =404;
    }

    # ── /knowledge-base (no trailing slash) → internal rewrite ───────────────
    # Internal rewrite (not a redirect) so nginx serves /knowledge-base/ content
    # without sending a 301 to the client. A redirect would expose the internal
    # HTTP container address to the browser, causing a mixed-content error when
    # the host app (data-gateway) is served over HTTPS.
    location = /knowledge-base {
        rewrite ^ /knowledge-base/ last;
    }

    # ── Everything else ───────────────────────────────────────────────────────
    location / {
        try_files $uri $uri/ =404;
    }
}