server {
    listen 8081;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    # Security & isolation headers for iframe embedding inside COEP parent
    add_header Cross-Origin-Resource-Policy "cross-origin" always;
    add_header Cross-Origin-Embedder-Policy "credentialless" always;
    add_header X-Frame-Options "SAMEORIGIN" always;

    # SPA fallback — tailscale serve strips the /flowchart/ mount point,
    # so nginx receives /assets/... and / (index.html)
    location / {
        try_files $uri $uri/ /index.html;
        add_header Cross-Origin-Resource-Policy "cross-origin" always;
        add_header Cross-Origin-Embedder-Policy "credentialless" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
    }

    location ~* \.(js|css|woff|woff2|ttf|eot|wasm|svg|png|jpg)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        add_header Cross-Origin-Resource-Policy "cross-origin" always;
        add_header Cross-Origin-Embedder-Policy "credentialless" always;
    }
}