fix and update

install.sh

@@ -1735,15 +1735,50 @@ build_ws_block() {
 EOF
 }
 
+# Блок location / для отдельного домена API (api.example.com).
+# Так как фронтенд и API на разных доменах (split-domain), браузер шлёт
+# cross-origin запросы и preflight (OPTIONS). Nginx сам отвечает на preflight
+# и проставляет CORS-заголовки, отражая Origin (нужно для credentials: cookie/JWT).
+# Заголовки CORS от upstream скрываем, чтобы не было дублей Access-Control-Allow-Origin.
+build_nginx_api_location_block() {
+  local upstream
+  upstream="$(nginx_upstream api)"
+  cat <<EOF
+    location / {
+        set \$cors_origin "";
+        if (\$http_origin) { set \$cors_origin \$http_origin; }
+
+        if (\$request_method = OPTIONS) {
+            add_header Access-Control-Allow-Origin \$cors_origin always;
+            add_header Access-Control-Allow-Credentials true always;
+            add_header Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, Accept, Origin, X-CSRF-Token" always;
+            add_header Access-Control-Max-Age 86400 always;
+            add_header Content-Length 0;
+            return 204;
+        }
+
+        proxy_hide_header Access-Control-Allow-Origin;
+        proxy_hide_header Access-Control-Allow-Credentials;
+        add_header Access-Control-Allow-Origin \$cors_origin always;
+        add_header Access-Control-Allow-Credentials true always;
+
+        proxy_pass ${upstream};
+        proxy_http_version 1.1;
+${nginx_proxy_headers}
+    }
+EOF
+}
+
 write_nginx_site_api() {
   local domain="$1"
   local ssl_type="${2:-none}"
   local ws_on_api="${3:-true}"
-  local conf upstream ws_block http_preamble ssl_block
+  local conf ws_block http_preamble ssl_block api_location
   conf="$(nginx_conf_target api)"
-  upstream="$(nginx_upstream api)"
   ws_block="$(build_ws_block "$ws_on_api")"
   http_preamble="$(nginx_http_server_preamble "$domain" "$ssl_type")"
+  api_location="$(build_nginx_api_location_block)"
 
   if [[ "$ssl_type" == "none" ]]; then
     nginx_write_conf "$conf" <<EOF
@@ -1753,11 +1788,7 @@ server {
     server_name ${domain};
     client_max_body_size 100m;
 ${ws_block}
-    location / {
-        proxy_pass ${upstream};
-        proxy_http_version 1.1;
-${nginx_proxy_headers}
-    }
+${api_location}
 }
 EOF
   else
@@ -1770,11 +1801,7 @@ ${http_preamble}server {
 ${ssl_block}
     client_max_body_size 100m;
 ${ws_block}
-    location / {
-        proxy_pass ${upstream};
-        proxy_http_version 1.1;
-${nginx_proxy_headers}
-    }
+${api_location}
 }
 EOF
   fi