Fix Onion-Location on SPA responses behind nginx add_header.

Render the header inside location / so it is not dropped by other location headers; remove the ineffective server-level directive.

nginx/conf.d/clearnet.conf.template

@@ -22,7 +22,5 @@ server {
     ssl_certificate /etc/nginx/certs/live/${CLEARNET_DOMAIN}/fullchain.pem;
     ssl_certificate_key /etc/nginx/certs/live/${CLEARNET_DOMAIN}/privkey.pem;
 
-    ${ONION_LOCATION_HEADER}
-
     include /etc/nginx/snippets/private-image-locations.conf;
 }

nginx/docker-entrypoint.sh

@@ -9,7 +9,9 @@ UPLOAD_MAX_REQUEST_BODY_BYTES=$(( (max_image_bytes * 4 + 2) / 3 + json_padding )
 export UPLOAD_MAX_REQUEST_BODY_BYTES BACKEND_PORT
 
 render_locations() {
-    envsubst '${BACKEND_PORT} ${UPLOAD_MAX_REQUEST_BODY_BYTES}' \
+    export ONION_LOCATION_HEADER="add_header Onion-Location \"http://${ONION_HOSTNAME}\$request_uri\" always;"
+
+    envsubst '${BACKEND_PORT} ${UPLOAD_MAX_REQUEST_BODY_BYTES} ${ONION_LOCATION_HEADER}' \
         < /etc/nginx/templates/snippets/private-image-locations.conf.template \
         > /etc/nginx/snippets/private-image-locations.conf
 }
@@ -20,15 +22,9 @@ render_server() {
     surface="$3"
 
     if [ "$surface" = "clearnet" ]; then
-        if [ -n "${ONION_HOSTNAME:-}" ]; then
-            export ONION_LOCATION_HEADER="add_header Onion-Location \"http://${ONION_HOSTNAME}\$request_uri\";"
-        else
-            export ONION_LOCATION_HEADER=""
-        fi
-
         export CLEARNET_DOMAIN
 
-        envsubst '${CLEARNET_DOMAIN} ${ONION_LOCATION_HEADER}' \
+        envsubst '${CLEARNET_DOMAIN}' \
             < "$template_path" \
             > "$output_path"
 

nginx/snippets/private-image-locations.conf.template

@@ -40,6 +40,7 @@ location /pgadmin {
 }
 
 location / {
+    ${ONION_LOCATION_HEADER}
     add_header Referrer-Policy "no-referrer" always;
     add_header Cache-Control "no-store" always;