Add deploy/ to .gitignore; backend index and openapi updates

Made-with: Cursor

.gitignore

@@ -35,6 +35,9 @@ backend/data/
 # Vite
 frontend/dist/
 
+# Deploy config (server-specific)
+deploy/
+
 # Misc
 *.local
 .cache/

backend/src/index.ts

@@ -2,7 +2,7 @@ import WebSocket from "ws";
 // @ts-expect-error Node 20 lacks global WebSocket; nostr-tools needs it
 globalThis.WebSocket = WebSocket;
 
-import express from "express";
+import express, { Request, Response, NextFunction } from "express";
 import cors from "cors";
 import rateLimit from "express-rate-limit";
 import swaggerUi from "swagger-ui-express";
@@ -45,9 +45,21 @@ async function main() {
     })
   );
 
-  const openapiUrl = config.publicBasePath ? `/${config.publicBasePath}/openapi.json` : "/openapi.json";
+  // Relative URL so Swagger resolves correctly: /docs -> ../openapi.json, /api/docs -> ../openapi.json
-  app.get("/openapi.json", (_req, res) => res.json(buildOpenApiSpec()));
+  const openapiUrl = "../openapi.json";
-  app.use("/docs", swaggerUi.serve, swaggerUi.setup(null, { swaggerUrl: openapiUrl }));
+  app.get("/openapi.json", (req, res) => res.json(buildOpenApiSpec(req)));
+  app.use(
+    "/docs",
+    (_req: Request, res: Response, next: NextFunction) => {
+      res.setHeader(
+        "Content-Security-Policy",
+        "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'"
+      );
+      next();
+    },
+    swaggerUi.serve,
+    swaggerUi.setup(null, { swaggerUrl: openapiUrl })
+  );
 
   app.use("/", publicRoutes);
   app.use("/auth", authRoutes);

backend/src/openapi/index.ts

@@ -1,3 +1,4 @@
+import type { Request } from "express";
 import { config } from "../config.js";
 import base from "./base.js";
 import schemas from "./schemas.js";
@@ -7,9 +8,11 @@ import claimPaths from "./paths/claim.js";
 import userPaths from "./paths/user.js";
 
 /** Build the full OpenAPI 3.0 spec by merging split files */
-export function buildOpenApiSpec(): Record<string, unknown> {
+export function buildOpenApiSpec(req?: Request): Record<string, unknown> {
-  const basePath = config.publicBasePath ? `/${config.publicBasePath.replace(/^\//, "")}` : "";
+  // Derive server URL from Host: API subdomain = root, frontend proxy = /api
-  const serverUrl = basePath || "/";
+  const host = (req?.headers?.host ?? "").split(":")[0];
+  const fallback = config.publicBasePath ? `/${config.publicBasePath.replace(/^\//, "")}` : "/";
+  const serverUrl = host === config.apiHost ? "/" : fallback;
 
   return {
     ...base,