# Generators — a pinned, self-contained fork of misode.github.io (Minecraft
# data pack generators) at generators.${BASE_DOMAIN}. Full design: plan/21-generators.md.
#
# The container serves BOTH the app bundle and the ~107M offline data mirror
# (mcmeta + vanilla-mcdoc) that tooling/sync-generators-data.sh produces, so
# the whole thing is single-origin by construction.
#
# WHY THAT MATTERS: this app is 100% client-side. Every data fetch comes from
# the PLAYER'S BROWSER, not from this host. Blocking the container's egress
# proves nothing, and "cochi has no WAN at the party" protects nothing — a
# single leftover upstream URL simply fails in the browser, at the venue, with
# no internet available to debug it.
http://generators.{$BASE_DOMAIN} {
	# The CSP is the ENFORCEMENT mechanism for offline operation, not decoration.
	#
	# `connect-src 'self'` is the load-bearing directive: it hard-blocks any
	# fetch/XHR to an origin we do not serve. If an upstream URL survives the
	# fork patch — or a future upstream merge reintroduces one — it breaks
	# LOUDLY in prod, on an ordinary day with internet available to fix it,
	# instead of silently at the party. This is the same lesson as the filestash
	# `http://https://` incident: a 200 on `/` proves the server is up, never
	# that the app works.
	#
	# script-src/style-src stay permissive ON PURPOSE for now. Spyglass and
	# deepslate may need wasm/eval and this has NOT been characterised yet;
	# tightening them is a post-party task. Loosening `connect-src` is not —
	# that one is the whole point.
	header {
		Content-Security-Policy "default-src 'self'; connect-src 'self'; img-src 'self' data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; font-src 'self'; worker-src 'self' blob:; base-uri 'self'; form-action 'self'"
		# The mirror is pinned to one MC version and changes only when
		# sync-generators-data.sh is re-run, so let browsers keep it. This is
		# also what makes a second visit cheap on a LAN with no upstream.
		?Cache-Control "public, max-age=604800"
	}
	reverse_proxy generators:80
}