nginx-meai.conf

# /etc/nginx/sites-available/meai.devsnest.app
# MEAI client site — static SPA on devsnest-01, behind Cloudflare.

server {
    listen 80;
    listen [::]:80;
    server_name meai.devsnest.app;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name meai.devsnest.app;

    root /var/www/meai;
    index index.html;

    # ssl_certificate     /etc/letsencrypt/live/meai.devsnest.app/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/meai.devsnest.app/privkey.pem;

    real_ip_header CF-Connecting-IP;

    # Security headers — replace <SUPABASE_URL> after the project is chosen.
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://challenges.cloudflare.com; style-src 'self'; font-src 'self'; img-src 'self' data:; connect-src 'self' <SUPABASE_URL> https://challenges.cloudflare.com; frame-src https://challenges.cloudflare.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests" always;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin" always;
    add_header Cross-Origin-Resource-Policy "same-origin" always;
    add_header X-Permitted-Cross-Domain-Policies "none" always;

    # Single page with hash anchors only — no client-side routes, so we do NOT
    # fall back to index.html. Unknown paths get a real 404 (no soft-404).
    location / { try_files $uri $uri/ =404; }

    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|webp|ico|woff2?|json|map)$ {
        try_files $uri =404;
        location /assets/ { expires 1y; add_header Cache-Control "public, immutable"; }
    }

    error_page 404 /404.html;
    location = /404.html { internal; }
    location = /index.html { add_header Cache-Control "public, max-age=0, must-revalidate"; }

    access_log /var/log/nginx/meai.access.log;
    error_log  /var/log/nginx/meai.error.log;
}