nginx.conf

server {
  listen 80;
  server_name _;
  root /usr/share/nginx/html;

  # The panel imports remoteEntry.js cross-origin; allow any origin (public JS,
  # no credentials). Handled here in the container — not in the ingress.
  location / {
    add_header Access-Control-Allow-Origin "*" always;
    try_files $uri $uri/ =404;
  }

  # remoteEntry.js keeps a STABLE filename but its content changes every build,
  # so it must never be cached by a CDN (Cloudflare) — otherwise a stale copy
  # (or a cached 404) is served. Hashed /assets/* chunks stay cacheable.
  location = /assets/remoteEntry.js {
    add_header Access-Control-Allow-Origin "*" always;
    add_header Cache-Control "no-store, no-cache, must-revalidate" always;
    try_files $uri =404;
  }

  # Same reasoning: the panel re-reads the manifest to detect the plugin.
  location = /5stack-plugin.json {
    add_header Access-Control-Allow-Origin "*" always;
    add_header Cache-Control "no-store, no-cache, must-revalidate" always;
    try_files $uri =404;
  }
}