nginx.conf

# Minimal nginx config for the static SPA on HF Spaces.
# Container runs as UID 1000 (non-root), hence the writable paths under /tmp.

pid        /tmp/nginx/nginx.pid;
worker_processes auto;

events {
    worker_connections 1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    client_body_temp_path /tmp/nginx/client_body;
    proxy_temp_path       /tmp/nginx/proxy;
    fastcgi_temp_path     /tmp/nginx/fastcgi;
    uwsgi_temp_path       /tmp/nginx/uwsgi;
    scgi_temp_path        /tmp/nginx/scgi;

    sendfile        on;
    tcp_nopush      on;
    gzip            on;
    gzip_types      text/plain text/css application/json application/javascript
                    application/wasm text/xml application/xml application/xml+rss
                    image/svg+xml;

    server {
        listen       7860 default_server;
        server_name  _;
        root         /usr/share/nginx/html;
        index        index.html;

        location /assets/ {
            expires 1y;
            add_header Cache-Control "public, immutable";
        }

        location = /index.html {
            add_header Cache-Control "no-cache";
        }

        # Same-origin proxy to OpenAI: Realtime + chat-completions.
        # OpenAI's endpoints don't expose CORS for user API keys, so the
        # browser cannot hit them directly. The Authorization header
        # (the user's sk- key) passes through untouched.
        location /openai/ {
            proxy_pass https://api.openai.com/;
            proxy_ssl_server_name on;
            proxy_ssl_name api.openai.com;
            proxy_set_header Host api.openai.com;

            proxy_read_timeout 600s;
            proxy_send_timeout 600s;

            proxy_buffering off;
            proxy_cache off;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }

        location / {
            try_files $uri $uri/ /index.html;
        }
    }
}