🔧(addon) parametrize the frontend nginx configuration via a volume

Mount the nginx configuration used by the frontend image as a volume
so the default one can be overridden by a custom configuration at
deployment time.

Based on suggestions from @rouja to help parametrize the
configuration at deployment time.

src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl

@@ -23,6 +23,9 @@ frontend:
     - name: outlook-addon-manifest
       configMap:
         name: outlook-addon-manifest
+    - name: frontend-nginx-config
+      configMap:
+        name: frontend-nginx-config
 
   extraVolumeMounts:
     - name: outlook-addon-config
@@ -33,6 +36,10 @@ frontend:
       mountPath: /usr/share/nginx/html/addons/outlook/manifest.xml
       subPath: manifest.xml
       readOnly: true
+    - name: frontend-nginx-config
+      mountPath: /etc/nginx/conf.d/default.conf
+      subPath: default.conf
+      readOnly: true
 
   outlookAddon:
     enabled: true
@@ -41,3 +48,6 @@ frontend:
     feedbackForm: "https://tests.com/"
     appName: "Visio"
     id: "a025f0f6-757a-4790-97f3-99c66c4a5795"
+
+frontendNginxConfig:
+  enabled: true

src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl

@@ -53,3 +53,6 @@ agentSubtitles:
         items:
         - key: cacert.pem
           path: cert.pem
+
+frontendNginxConfig:
+  enabled: false

src/helm/extra/templates/frontend_nginx_cm.yaml

@@ -0,0 +1,91 @@
+{{- if .Values.frontendNginxConfig.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: frontend-nginx-config
+  namespace: {{ .Release.Namespace }}
+data:
+  default.conf: |
+    server {
+        listen 8080;
+        server_name localhost;
+        server_tokens off;
+
+        root /usr/share/nginx/html;
+
+        location = /.well-known/windows-app-web-link {
+            default_type application/json;
+            alias /usr/share/nginx/html/.well-known/windows-app-web-link;
+            add_header Content-Disposition "attachment; filename=windows-app-web-link";
+        }
+
+        # Manifest — fetched, never iframed
+        location = /addons/outlook/manifest.xml {
+            alias /usr/share/nginx/html/addons/outlook/manifest.xml;
+
+            add_header Access-Control-Allow-Origin "*";
+            add_header Cache-Control "no-cache, no-store, must-revalidate";
+            add_header X-Frame-Options "DENY";
+            add_header Content-Security-Policy "frame-ancestors 'none'";
+        }
+
+        location = /addons/outlook/assets/ {
+            return 404;
+        }
+
+        location ~* ^/addons/outlook/assets/(.+\.(?:css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot))/?$ {
+            root /usr/share/nginx/html;
+            expires 30d;
+            add_header Cache-Control "public, max-age=2592000, immutable" always;
+            add_header Access-Control-Allow-Origin "*";
+            add_header Vary "Origin" always;
+        }
+
+        location = /addons/outlook/ {
+            return 404;
+        }
+
+        location ~ ^/addons/outlook(/.*)?$ {
+            alias /usr/share/nginx/html/addons/outlook$1;
+            error_page 404 =200 /index.html;
+            add_header Cache-Control "no-cache, no-store, must-revalidate";
+            add_header Pragma "no-cache" always;
+            add_header Expires 0 always;
+
+            set $ms_domains "https://*.live.com https://*.office.com https://*.microsoft.com https://*.office365.com https://*.sharepoint.com";
+
+            set $nonce $request_id;
+
+            set $csp "upgrade-insecure-requests; ";
+            set $csp "${csp}frame-ancestors ${ms_domains}; ";
+            set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; ";
+            set $csp "${csp}connect-src 'self' ${ms_domains}; ";
+            set $csp "${csp}frame-src 'none'; ";
+            set $csp "${csp}object-src 'none'; ";
+            set $csp "${csp}base-uri 'none'; ";
+
+            add_header Content-Security-Policy $csp;
+
+            sub_filter 'NONCE_PLACEHOLDER' $nonce;
+            sub_filter_once off;
+        }
+
+        # Serve static files with caching
+        location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+            expires 30d;
+            add_header Cache-Control "public, max-age=2592000";
+        }
+
+        # Serve static files
+        location / {
+            try_files $uri $uri/ /index.html;
+            # Add no-cache headers
+            add_header Cache-Control "no-cache, no-store, must-revalidate";
+            add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
+            add_header Expires 0;
+        }
+
+        # Optionally, handle 404 errors by redirecting to index.html
+        error_page 404 =200 /index.html;
+    }
+{{- end }}

src/helm/meet/values.yaml

@@ -458,6 +458,7 @@ frontend:
     feedbackForm: ""
     id: ""
 
+
 ## @section posthog
 
 posthog: