# VisionClaw Development Nginx Configuration

# Provides unified entry point on port 3001 for all services

pid /var/run/nginx.pid;

error_log /var/log/nginx/error.log crit;

events {

worker_connections 1024;

}

http {

include /etc/nginx/mime.types;

default_type application/octet-stream;

charset utf-8;

# Custom MIME types for development

# 'ts' and 'js' are removed as they are often predefined, causing warnings.

types {

text/jsx jsx;

text/tsx tsx;

}

# Logging

log_format main '$remote_addr - $remote_user [$time_local] "$request" '

'$status $body_bytes_sent "$http_referer" '

'"$http_user_agent" "$http_x_forwarded_for" '

'rt=$request_time uht="$upstream_header_time" urt="$upstream_response_time"';

access_log /var/log/nginx/access.log main;

# Performance

sendfile on;

tcp_nopush on;

tcp_nodelay on;

keepalive_timeout 65;

client_max_body_size 100M;

# WebSocket upgrade mapping

map $http_upgrade $connection_upgrade {

default upgrade;

'' close;

}

# Upstream services

upstream rust_backend {

server 127.0.0.1:4000;

keepalive 32;

}

upstream vite_frontend {

server 127.0.0.1:5173;

keepalive 32;

}

# Main server block - Development entry point

server {

listen 3001 default_server;

server_name localhost;

# Codescape (ADR-2143 A4): the code-graph section, reached on this port

# under /codescape/ as a NETWORK PEER, never a local process. The

# upstream is resolved lazily through Docker DNS so nginx still starts

# (and answers 502 here) when the `codescape` compose service is down.

# Owner decision 2026-10-18: :3001 is already LAN-published in dev, so

# this is a deliberate dev-LAN publication of an open-auth service

# until P6 lands NIP-98.

resolver 127.0.0.11 valid=10s ipv6=off;

# Without the trailing slash the SPA's ./assets paths resolve outside

# the prefix and the page is blank; redirect.

location = /codescape {

return 301 /codescape/;

}

location ^~ /codescape/ {

set $codescape_upstream codescape:4100;

rewrite ^/codescape/(.*)$ /$1 break;

proxy_pass http://$codescape_upstream;

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection $connection_upgrade;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_set_header X-Forwarded-Host $http_host;

proxy_set_header X-Forwarded-Prefix /codescape;

# WebSockets (positions, events, voice, /wss, presence) stay open.

proxy_read_timeout 3600s;

proxy_send_timeout 3600s;

proxy_buffering off;

proxy_cache off;

# The server sets COOP/COEP/CORP itself; a second copy from this

# server block would make the browser fall back to unsafe-none.

proxy_hide_header Cross-Origin-Opener-Policy;

proxy_hide_header Cross-Origin-Embedder-Policy;

proxy_hide_header Cross-Origin-Resource-Policy;

proxy_intercept_errors off;

}

# Security headers for SharedArrayBuffer and cross-origin isolation

add_header Cross-Origin-Opener-Policy "same-origin" always;

add_header Cross-Origin-Embedder-Policy "require-corp" always;

add_header X-Content-Type-Options "nosniff" always;

# === BACKEND ROUTES ===

# REST API endpoints

location ^~ /api/ {

proxy_pass http://rust_backend;

proxy_http_version 1.1;

proxy_set_header Host $host;

proxy_set_header X-Forwarded-Host $http_host; # keep the dialled port: NIP-98 u-tags sign host:port (owner decision 2026-10-02, Q3)

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

# Timeouts for long-running operations

proxy_connect_timeout 60s;

proxy_send_timeout 300s;

proxy_read_timeout 300s;

# Disable buffering for SSE/streaming responses

proxy_buffering off;

proxy_cache off;

}

# WebSocket endpoint for graph data

location /wss {

proxy_pass http://rust_backend;

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection $connection_upgrade;

proxy_set_header Host $host;

proxy_set_header X-Forwarded-Host $http_host; # keep the dialled port: NIP-98 u-tags sign host:port (owner decision 2026-10-02, Q3)

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

# Long timeout for persistent connections

proxy_read_timeout 3600s;

proxy_send_timeout 3600s;

# Disable buffering for real-time data

proxy_buffering off;

tcp_nodelay on;

}

# WebSocket endpoint for speech services

location /ws/speech {

proxy_pass http://rust_backend;

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection $connection_upgrade;

proxy_set_header Host $host;

proxy_set_header X-Forwarded-Host $http_host; # keep the dialled port: NIP-98 u-tags sign host:port (owner decision 2026-10-02, Q3)

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

# Long timeout for persistent connections

proxy_read_timeout 3600s;

proxy_send_timeout 3600s;

# Disable buffering for real-time data

proxy_buffering off;

tcp_nodelay on;

}

# WebSocket endpoint for MCP relay

location /ws/mcp-relay {

proxy_pass http://rust_backend;

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection $connection_upgrade;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

# Long timeout for persistent connections

proxy_read_timeout 3600s;

proxy_send_timeout 3600s;

# Disable buffering for real-time data

proxy_buffering off;

tcp_nodelay on;

}

# === SOLID PROTOCOL ENDPOINTS → Rust backend (pod mgmt + LDP proxy to JSS) ===

# Solid WebSocket notifications

location ^~ /solid/.notifications {

proxy_pass http://rust_backend/api/solid/.notifications;

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection $connection_upgrade;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_set_header X-Forwarded-Host $host;

proxy_set_header Authorization $http_authorization;

proxy_read_timeout 3600s;

proxy_send_timeout 3600s;

proxy_connect_timeout 10s;

proxy_buffering off;

proxy_cache off;

}

# All /solid/* → Rust backend at /api/solid/* (pod management + LDP proxy to JSS)

location ^~ /solid/ {

proxy_pass http://rust_backend/api/solid/;

proxy_http_version 1.1;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_set_header X-Forwarded-Host $host;

proxy_set_header Authorization $http_authorization;

proxy_set_header X-Forwarded-URI $request_uri;

proxy_pass_header Accept;

proxy_pass_header Content-Type;

proxy_pass_header Link;

proxy_pass_header Slug;

proxy_pass_header If-Match;

proxy_pass_header If-None-Match;

proxy_read_timeout 60s;

proxy_send_timeout 60s;

proxy_connect_timeout 10s;

client_max_body_size 50m;

}

# User pods shortcut → Rust backend at /api/solid/pods/

location ^~ /pods/ {

proxy_pass http://rust_backend/api/solid/pods/;

proxy_http_version 1.1;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_set_header X-Forwarded-Host $host;

proxy_set_header Authorization $http_authorization;

proxy_pass_header Accept;

proxy_pass_header Content-Type;

proxy_pass_header Link;

proxy_pass_header Slug;

client_max_body_size 50m;

}

# === COPYPARTY FILE BROWSER ===

location = /browser-test {

return 200 "COPYPARTY ROUTE WORKS\n";

add_header Content-Type text/plain;

}

location ^~ /browser/ {

rewrite ^/browser/(.*) /$1 break;

proxy_pass http://172.18.0.4:3923/;

# WebSocket support

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection $connection_upgrade;

# Standard reverse proxy headers

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

# Disable buffering for better streaming performance

proxy_buffering off;

proxy_request_buffering off;

# Timeouts for long uploads

proxy_connect_timeout 3600s;

proxy_send_timeout 3600s;

proxy_read_timeout 3600s;

send_timeout 3600s;

# Allow large file uploads

client_max_body_size 0;

}

location = /browser {

return 301 /browser/;

}

# === VITE DEV SERVER ROUTES ===

# WebSocket for Vite HMR (Hot Module Replacement)

location /vite-hmr {

proxy_pass http://vite_frontend; # Pass to the vite_frontend upstream

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection $connection_upgrade;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_read_timeout 3600s; # Keep connection open

}

# Vite special endpoints

location ~ ^/(\.vite|node_modules|@vite|@react-refresh|@id|@fs|src) {

proxy_pass http://vite_frontend;

proxy_http_version 1.1;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

# Cache control for development

add_header Cache-Control "no-cache, no-store, must-revalidate";

add_header Pragma "no-cache";

add_header Expires "0";

}

# Static assets with proper MIME types

location ~* \.(js|jsx|ts|tsx|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {

proxy_pass http://vite_frontend;

proxy_http_version 1.1;

proxy_set_header Host $host;

# Development cache headers

add_header Cache-Control "no-cache, must-revalidate";

}

# Root - Frontend application (must be last)

location / {

proxy_pass http://vite_frontend;

proxy_http_version 1.1;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

# Support for client-side routing

proxy_intercept_errors on;

error_page 404 = @vite_fallback;

}

# Fallback for client-side routing

location @vite_fallback {

# Rewrite the request to the root index.html for the SPA.

# This is the correct way to handle proxy_pass in a named location.

rewrite ^ /index.html break;

proxy_pass http://vite_frontend;

proxy_http_version 1.1;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

}

# Health check endpoint

location /health {

access_log off;

return 200 "healthy\n";

add_header Content-Type text/plain;

}

}

}