From adb1d7bca91d75d0da188b1b80ba4291d7d419fd Mon Sep 17 00:00:00 2001
From: nobswebdev <nobswebdev@noreply.git.nobswebdev.com>
Date: Wed, 28 Oct 2026 23:12:08 +0100
Subject: [PATCH] Fix Onion-Location on SPA responses behind nginx add_header.

Render the header inside location / so it is not dropped by other location headers; remove the ineffective server-level directive.
---
 nginx/conf.d/clearnet.conf.template                |  2 --
 nginx/docker-entrypoint.sh                         | 14 +++++---------
 .../snippets/private-image-locations.conf.template |  1 +
 3 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/nginx/conf.d/clearnet.conf.template b/nginx/conf.d/clearnet.conf.template
index d37991e..693ee34 100644
--- a/nginx/conf.d/clearnet.conf.template
+++ b/nginx/conf.d/clearnet.conf.template
@@ -22,7 +22,5 @@ server {
     ssl_certificate /etc/nginx/certs/live/${CLEARNET_DOMAIN}/fullchain.pem;
     ssl_certificate_key /etc/nginx/certs/live/${CLEARNET_DOMAIN}/privkey.pem;
 
-    ${ONION_LOCATION_HEADER}
-
     include /etc/nginx/snippets/private-image-locations.conf;
 }
diff --git a/nginx/docker-entrypoint.sh b/nginx/docker-entrypoint.sh
index e074dde..2c732a1 100644
--- a/nginx/docker-entrypoint.sh
+++ b/nginx/docker-entrypoint.sh
@@ -9,7 +9,9 @@ UPLOAD_MAX_REQUEST_BODY_BYTES=$(( (max_image_bytes * 4 + 2) / 3 + json_padding )
 export UPLOAD_MAX_REQUEST_BODY_BYTES BACKEND_PORT
 
 render_locations() {
-    envsubst '${BACKEND_PORT} ${UPLOAD_MAX_REQUEST_BODY_BYTES}' \
+    export ONION_LOCATION_HEADER="add_header Onion-Location \"http://${ONION_HOSTNAME}\$request_uri\" always;"
+
+    envsubst '${BACKEND_PORT} ${UPLOAD_MAX_REQUEST_BODY_BYTES} ${ONION_LOCATION_HEADER}' \
         < /etc/nginx/templates/snippets/private-image-locations.conf.template \
         > /etc/nginx/snippets/private-image-locations.conf
 }
@@ -20,15 +22,9 @@ render_server() {
     surface="$3"
 
     if [ "$surface" = "clearnet" ]; then
-        if [ -n "${ONION_HOSTNAME:-}" ]; then
-            export ONION_LOCATION_HEADER="add_header Onion-Location \"http://${ONION_HOSTNAME}\$request_uri\";"
-        else
-            export ONION_LOCATION_HEADER=""
-        fi
-
         export CLEARNET_DOMAIN
-        
-        envsubst '${CLEARNET_DOMAIN} ${ONION_LOCATION_HEADER}' \
+
+        envsubst '${CLEARNET_DOMAIN}' \
             < "$template_path" \
             > "$output_path"
 
diff --git a/nginx/snippets/private-image-locations.conf.template b/nginx/snippets/private-image-locations.conf.template
index 8abbb6b..51ad13c 100644
--- a/nginx/snippets/private-image-locations.conf.template
+++ b/nginx/snippets/private-image-locations.conf.template
@@ -40,6 +40,7 @@ location /pgadmin {
 }
 
 location / {
+    ${ONION_LOCATION_HEADER}
     add_header Referrer-Policy "no-referrer" always;
     add_header Cache-Control "no-store" always;