add bentopdf

bentopdf/rootfs/etc/nginx/nginx.conf

@@ -0,0 +1,63 @@
+daemon off;
+pid /tmp/nginx.pid;
+error_log /proc/1/fd/1 warn;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    client_body_temp_path /tmp/client_body;
+    proxy_temp_path       /tmp/proxy;
+    fastcgi_temp_path     /tmp/fastcgi;
+    uwsgi_temp_path       /tmp/uwsgi;
+    scgi_temp_path        /tmp/scgi;
+
+    access_log /proc/1/fd/1;
+
+    include /etc/nginx/mime.types;
+    types {
+        application/javascript mjs;
+    }
+    default_type application/octet-stream;
+
+    gzip_static on;
+
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_comp_level 9;
+    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json application/wasm application/x-javascript text/x-component;
+
+    # HTTP on 8080 — redirect to HTTPS; root path returns 200 for HA watchdog
+    server {
+        listen 8080;
+        listen [::]:8080;
+        server_name localhost;
+
+        location = / {
+            return 200 "ok";
+        }
+
+        location / {
+            return 301 https://$host:8443$request_uri;
+        }
+    }
+
+    # HTTPS on 8443 — main browser access with SharedArrayBuffer support
+    server {
+        listen 8443 ssl;
+        listen [::]:8443 ssl;
+        server_name localhost;
+        root /usr/share/nginx/html;
+        index index.html;
+        absolute_redirect off;
+
+        ssl_certificate     /config/bentopdf/ssl/cert.pem;
+        ssl_certificate_key /config/bentopdf/ssl/key.pem;
+        ssl_protocols       TLSv1.2 TLSv1.3;
+        ssl_ciphers         HIGH:!aNULL:!MD5;
+
+        include /etc/nginx/snippets/bentopdf-locations.conf;
+    }
+}

bentopdf/rootfs/etc/nginx/snippets/bentopdf-locations.conf

@@ -0,0 +1,86 @@
+location ~ ^/(en|ar|be|da|de|es|fr|id|it|nl|pt|tr|vi|zh|zh-TW)(/.*)?$ {
+    try_files $uri $uri/ $uri.html /$1/index.html /index.html;
+    expires 5m;
+    add_header Cache-Control "public, must-revalidate";
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+}
+
+location ~ ^/(.+?)/(en|ar|be|da|de|es|fr|id|it|nl|pt|tr|vi|zh|zh-TW)(/.*)?$ {
+    try_files $uri $uri/ $uri.html /$1/$2/index.html /$1/index.html /index.html;
+    expires 5m;
+    add_header Cache-Control "public, must-revalidate";
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+}
+
+location ~* \.html$ {
+    expires 1h;
+    add_header Cache-Control "public, must-revalidate";
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+}
+
+location ~* /libreoffice-wasm/soffice\.wasm\.gz$ {
+    gzip off;
+    types {} default_type application/wasm;
+    add_header Content-Encoding gzip;
+    add_header Vary "Accept-Encoding";
+    add_header Cache-Control "public, immutable";
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+}
+
+location ~* /libreoffice-wasm/soffice\.data\.gz$ {
+    gzip off;
+    types {} default_type application/octet-stream;
+    add_header Content-Encoding gzip;
+    add_header Vary "Accept-Encoding";
+    add_header Cache-Control "public, immutable";
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+}
+
+location ~* \.(wasm|wasm\.gz|data|data\.gz)$ {
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+}
+
+location ~* \.(js|mjs|css|woff|woff2|ttf|eot|otf)$ {
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+}
+
+location ~* \.(png|jpg|jpeg|gif|ico|svg|webp|avif|mp4|webm)$ {
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+}
+
+location ~* \.json$ {
+    expires 1w;
+    add_header Cache-Control "public, must-revalidate";
+}
+
+location ~* \.pdf$ {
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+}
+
+location / {
+    try_files $uri $uri/ $uri.html /index.html;
+    expires 5m;
+    add_header Cache-Control "public, must-revalidate";
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+}
+
+add_header X-Frame-Options "SAMEORIGIN" always;
+add_header X-Content-Type-Options "nosniff" always;
+add_header X-XSS-Protection "1; mode=block" always;
+add_header Cross-Origin-Opener-Policy "same-origin" always;
+add_header Cross-Origin-Embedder-Policy "require-corp" always;
+add_header Cross-Origin-Resource-Policy "cross-origin" always;