From e290fa43a49d557a3ae5d8a6568f9d7482cdb446 Mon Sep 17 00:00:00 2001
From: Atridad Lahiji <me@atri.dad>
Date: Fri, 13 Feb 2026 00:40:23 -0700
Subject: [PATCH] =?UTF-8?q?Praying=F0=9F=99=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 modules/nginx.nix | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/modules/nginx.nix b/modules/nginx.nix
index 4285db1..6cd620c 100644
--- a/modules/nginx.nix
+++ b/modules/nginx.nix
@@ -395,32 +395,29 @@ in
         enableACME = true;
         forceSSL = true;
 
+        # lk-jwt-service (handles its own CORS)
         locations."~ ^(/sfu/get|/healthz)" = {
           priority = 400;
           proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}";
           extraConfig = ''
             proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $scheme;
-
-            add_header Access-Control-Allow-Origin "*" always;
-            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
-            add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;
-
-            if ($request_method = OPTIONS) {
-              return 204;
-            }
           '';
         };
 
+        # livekit
         locations."/" = {
           proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}";
           proxyWebsockets = true;
           extraConfig = ''
-            proxy_send_timeout 120;
-            proxy_read_timeout 120;
-            proxy_buffering off;
-            proxy_set_header Accept-Encoding gzip;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_read_timeout 300;
+            proxy_send_timeout 300;
           '';
         };
       };