Chosen Architecture — nginx static preview route

Decision

Serve previews from the existing nginx static bind mount under a dedicated /ui-preview/ path on vps.incomexsaigoncorp.vn. No new container, no Nuxt change.

host dir   /opt/incomex/docker/nginx/static/ui-preview/<project>/<surface>/<version>/
  ⇅ (bind, ro)
container   /usr/share/nginx/static/ui-preview/...
  ⇅ (nginx location)
public URL  https://vps.incomexsaigoncorp.vn/ui-preview/<project>/<surface>/<version>/

Note on the GPT-proposed path /srv/incomex-preview/ui/...: that directory is not a nginx mount, so using it would require recreating the nginx container to add a volume (production restart risk). We therefore reuse the already-mounted static dir and keep the same public URL shape the proposal specified. The chosen host dir is the safe equivalent of the proposed /srv/incomex-preview.

The nginx block (applied)

Inserted in the vps.incomexsaigoncorp.vn 443 server block, immediately before location / { (Nuxt catch-all):

# --- S-UIPREVIEW: AI shared UI static preview (additive, draft, isolated from Nuxt prod) ---
location /ui-preview/ {
    root /usr/share/nginx/static;
    index index.html;
    try_files $uri $uri/ =404;
    autoindex on;
}

• root (not alias) → avoids the alias+try_files gotcha; maps cleanly to /usr/share/nginx/static/ui-preview/....
• No location-level add_header → the server-level security headers (CSP, X-Frame-Options, HSTS, nosniff) are inherited intact.
• autoindex on → directory listing of versions for quick navigation.
• nginx longest-prefix matching → /ui-preview/ wins over / without reordering risk.

Apply steps (executed)

1. cp -p default.conf default.conf.bak-ui-preview-20260530T034017Z (backup).
2. Idempotency guard on marker S-UIPREVIEW.
3. Python insert before the unique # Nuxt Frontend (default) anchor.
4. docker exec incomex-nginx nginx -t → syntax ok.
5. docker exec incomex-nginx nginx -s reload → reloaded.
6. Verified: preview URLs HTTP 200 (correct content-types); production / still 200 via Nuxt.

Rollback (verified-safe, one move)

cp -p /opt/incomex/docker/nginx/conf.d/default.conf.bak-ui-preview-20260530T034017Z \
      /opt/incomex/docker/nginx/conf.d/default.conf
docker exec incomex-nginx nginx -t && docker exec incomex-nginx nginx -s reload
# optional: rm -rf /opt/incomex/docker/nginx/static/ui-preview

Additive + reversible: route removal returns /ui-preview/* to the Nuxt catch-all (404/app), nothing else changes.