Allow range headers and respond to option requests

flake.nix

@@ -76,11 +76,27 @@
               root = "/var/www/static";
               forceSSL = true;
               enableACME = true;
-              extraConfig = ''
-                add_header 'Access-Control-Allow-Credentials' 'true';
-                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
-                add_header 'Access-Control-Allow-Origin' '*';
-              '';
+
+              locations."/" = {
+                extraConfig = ''
+                  if ($request_method = GET) {
+                    add_header Access-Control-Allow-Origin *;
+                    add_header Access-Control-Allow-Credentials true;
+                    add_header Access-Control-Allow-Methods "GET, OPTIONS";
+                    add_header Access-Control-Allow-Headers "origin, accept, range";
+                  }
+
+                  if ($request_method = OPTIONS ) {
+                    add_header Access-Control-Allow-Origin *;
+                    add_header Access-Control-Allow-Credentials true;
+                    add_header Access-Control-Allow-Methods "GET, OPTIONS";
+                    add_header Access-Control-Allow-Headers "origin, accept, range";
+                    add_header Content-Length 0;
+                    add_header Content-Type text/plain;
+                    return 204;
+                  }
+                '';
+              };
             };
 
             services.nginx.virtualHosts."phantomthieves.net" = {