funkwhale_ynh/conf/nginx.conf

    # HSTS
    more_set_headers Strict-Transport-Security "max-age=31536000";

    # General configs
    root __INSTALL_DIR__/front/dist;
    client_max_body_size 100M;
    charset utf-8;

    # headers
    more_set_headers Content-Security-Policy "default-src 'self'; connect-src https: wss: http: ws: 'self' 'unsafe-eval'; script-src 'self' 'wasm-unsafe-eval'; style-src https: http: 'self' 'unsafe-inline'; img-src https: http: 'self' data:; font-src https: http: 'self' data:; media-src https: http: 'self' data:; object-src 'none'";
    more_set_headers Referrer-Policy "strict-origin-when-cross-origin";
    more_set_headers X-Frame-Options "SAMEORIGIN" always;

    location /api/ {
        include /etc/nginx/conf.d/$domain.d/funkwhale_proxy.conf;
        # This is needed if you have file import via upload enabled.
        client_max_body_size 100M;
        proxy_pass   http://127.0.0.1:__PORT__;
    }

    location ~ ^/library/(albums|tracks|artists|playlists)/ {
        include /etc/nginx/conf.d/$domain.d/funkwhale_proxy.conf;
        proxy_pass   http://127.0.0.1:__PORT__;
    }

    location /channels/ {
        include /etc/nginx/conf.d/$domain.d/funkwhale_proxy.conf;
        proxy_pass   http://127.0.0.1:__PORT__;
    }

    location ~ ^/@(vite-plugin-pwa|vite|id)/ {
        include /etc/nginx/conf.d/$domain.d/funkwhale_proxy.conf;
        alias __INSTALL_DIR__/front/dist/;
        try_files $uri $uri/ /index.html;
    }

    location /@ {
        include /etc/nginx/conf.d/$domain.d/funkwhale_proxy.conf;
        proxy_pass   http://127.0.0.1:__PORT__;
    }

    location / {
        expires 1d;
        include /etc/nginx/conf.d/$domain.d/funkwhale_proxy.conf;
        alias __INSTALL_DIR__/front/dist/;
        try_files $uri $uri/ /index.html;
    }

    location ~ "/(front/)?embed.html/" {
        alias __INSTALL_DIR__/front/dist/;embed.html;
        more_set_headers Content-Security-Policy "connect-src https: http: 'self'; default-src 'self'; script-src 'self' unpkg.com 'unsafe-inline' 'unsafe-eval'; style-src https: http: 'self' 'unsafe-inline'; img-src https: http: 'self' data:; font-src https: http: 'self' data:; object-src 'none'; media-src https: http: 'self' data:";
        more_set_headers Referrer-Policy "strict-origin-when-cross-origin";

        expires 1d;
    }

    location /federation/ {
        include /etc/nginx/conf.d/$domain.d/funkwhale_proxy.conf;
        proxy_pass   http://127.0.0.1:__PORT__;
    }

    # You can comment this if you do not plan to use the Subsonic API.
    location /rest/ {
        include /etc/nginx/conf.d/$domain.d/funkwhale_proxy.conf;
        proxy_pass   http://127.0.0.1:__PORT__/api/subsonic/rest/;
    }

    location /.well-known/ {
        include /etc/nginx/conf.d/$domain.d/funkwhale_proxy.conf;
        proxy_pass   http://127.0.0.1:__PORT__;
    }

    # Allow direct access to only specific subdirectories in /media
    location /media/__sized__/ {
        alias __DATA_DIR__/data/media/__sized__/;
        more_set_headers "Access-Control-Allow-Origin: *";
    }

    # Allow direct access to only specific subdirectories in /media
    location /media/attachments/ {
        alias __DATA_DIR__/data/media/attachments/;
        more_set_headers "Access-Control-Allow-Origin: *";
    }

    # Allow direct access to only specific subdirectories in /media
    location /media/dynamic_preferences/ {
        alias __DATA_DIR__/data/media/dynamic_preferences/;
        more_set_headers "Access-Control-Allow-Origin: *";
    }

    # This is an internal location that is used to serve
    # media (uploaded) files once correct permission / authentication
    # has been checked on API side.
    # Comment the "NON-S3" commented lines and uncomment "S3" commented lines
    # if you're storing media files in a S3 bucket.
    location ~ /_protected/media/(.+)/ {
        internal;
        alias  __DATA_DIR__/data/media/$1;                                  # NON-S3
        # Needed to ensure DSub auth isn't forwarded to S3/Minio, see #932.
#       proxy_set_header Authorization "";                                  # S3
#       proxy_pass $1;                                                      # S3
        more_set_headers "Access-Control-Allow-Origin: *";
    }

    location /_protected/music/ {
        # This is an internal location that is used to serve
        # local music files once correct permission / authentication
        # has been checked on API side.
        # Set this to the same value as your MUSIC_DIRECTORY_PATH setting.
        internal;
        alias   __DATA_DIR__/data/music/;
        more_set_headers "Access-Control-Allow-Origin: *";
    }

    location /manifest.json {
        # If the reverse proxy is terminating SSL, nginx gets confused and redirects to http, hence the full URL
        return 302 https://__DOMAIN__/api/v1/instance/spa-manifest.json;
    }

    location /staticfiles/ {
        alias __DATA_DIR__/data/static/;
    }