Strip upstream CORS

nginx.conf

@@ -12,7 +12,9 @@ http {
     proxy_cache_path /etc/nginx/data/cache levels=1:2 keys_zone=api_cache:10m max_size=100g inactive=365d;
 
     error_log /dev/stdout warn;
-    access_log /dev/stdout;
+
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" cache:$upstream_cache_status';
+    access_log /dev/stdout main;
 
     resolver 127.0.0.11 valid=60s;
 
@@ -30,8 +32,27 @@ http {
             proxy_set_header Host $proxy_host;
             proxy_ssl_server_name on;
 
+            # Strip upstream CORS so we only send our own (duplicate = browser reject)
+            proxy_hide_header Access-Control-Allow-Origin;
+            proxy_hide_header Access-Control-Allow-Methods;
+            proxy_hide_header Access-Control-Allow-Headers;
+            proxy_hide_header Access-Control-Expose-Headers;
+            proxy_hide_header Access-Control-Max-Age;
+
+            # CORS headers — replace with our own *
+            add_header Access-Control-Allow-Origin * always;
+            add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH" always;
+            add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-Cache,X-NoCache,X-Status" always;
+            add_header Access-Control-Expose-Headers "X-Cache-Status" always;
+
+            # Handle preflight OPTIONS requests
+            if ($request_method = 'OPTIONS') {
+                return 204;
+            }
+
             proxy_cache api_cache;
             proxy_cache_valid 200 201 202 203 204 205 206 207 208 226 365d;
+            proxy_ignore_headers Cache-Control Expires;
 
             proxy_cache_bypass $http_x_nocache;
             proxy_no_cache $http_x_nocache;
@@ -43,6 +64,15 @@ http {
 
         location = /index.html {
             root /usr/share/nginx/html;
+            # CORS headers for HTML interface
+            add_header Access-Control-Allow-Origin * always;
+            add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type" always;
+
+            # Handle preflight OPTIONS requests
+            if ($request_method = 'OPTIONS') {
+                return 204;
+            }
         }
     }
 }