secubox-deb/common/nginx/webui.conf

server {
    listen 0.0.0.0:9080;
    root /usr/share/secubox/www;
    index index.html;

    # Revalidate versioned webui assets so a package deploy is picked up
    # immediately (ETag makes revalidation a cheap 304). Without this, browsers
    # heuristically cache luci-static JS/CSS and serve a stale UI after updates.
    location ^~ /luci-static/ {
        add_header Cache-Control "no-cache" always;
        try_files $uri =404;
    }

    location / {
        try_files $uri $uri/ /index.html;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:8001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    location /shared/ {
        alias /usr/share/secubox/www/shared/;
    }

    # CrowdSec Dashboard static files
    location /crowdsec/ {
        alias /usr/share/secubox/www/crowdsec/;
        index index.html;
        try_files $uri $uri/ /crowdsec/index.html;
    }

    # CrowdSec API proxy
    location /api/v1/crowdsec/ {
        proxy_pass http://unix:/run/secubox/crowdsec.sock:/;
        include /etc/nginx/snippets/secubox-proxy.conf;
    }

    # WAF Dashboard static files
    location /waf/ {
        alias /usr/share/secubox/www/waf/;
        index index.html;
        try_files $uri $uri/ /waf/index.html;
    }

    # WAF API proxy
    location /api/v1/waf/ {
        proxy_pass http://unix:/run/secubox/waf.sock:/;
        include /etc/nginx/snippets/secubox-proxy.conf;
    }

    # System Hub Dashboard static files
    location /system/ {
        alias /usr/share/secubox/www/system/;
        index index.html;
        try_files $uri $uri/ /system/index.html;
    }

    # System Hub API proxy
    location /api/v1/system/ {
        proxy_pass http://unix:/run/secubox/system.sock:/;
        include /etc/nginx/snippets/secubox-proxy.conf;
    }

    # #65: per-module routes self-register here. Every module package drops a
    # /etc/nginx/secubox-routes.d/<module>.conf (location-only snippet) at
    # install time, so a newly added module's /<module>/ + /api/v1/<module>/
    # routes are picked up automatically — no more hand-editing this file per
    # module. This is the ACTIVE include (matches the deployed webui.conf).
    # The crowdsec/waf/system blocks above stay hardcoded: those core packages
    # only ship the legacy secubox.d/ snippet, so they would NOT duplicate here.
    include /etc/nginx/secubox-routes.d/*.conf;
}