unsocial.conf

server {
    listen 443 ssl;
    server_name unsocial.localhost;

    ssl_certificate /etc/nginx/certs/unsocial.crt;
    ssl_certificate_key /etc/nginx/certs/unsocial.key;

    location / {
        # next devのHMRでWebSocketを使うため
        # https://uorat.hatenablog.com/entry/2016/09/19/203939
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # ServerActionsはX-Forwarded-HostかHostがOriginと一致する必要がある
        # https://github.com/vercel/next.js/blob/058638643ca90e992e7b39aced50c883386ad541/packages/next/src/server/app-render/action-handler.ts#L292-L294
        proxy_set_header X-Forwarded-Host $host;

        # ActivityPubのホストヘッダー検証で使うため
        proxy_set_header Host $host;

        # next devにプロキシ
        proxy_pass http://host.docker.internal:3000;
    }
}