Nginx does not allow add_header inside if blocks at the server level.
Moving the OPTIONS preflight response into the location / block fixes the
emerg directive error and allows nginx to start correctly.
Replace direct host port mapping with an Nginx reverse proxy that properly
handles CORS for any origin, including Obsidian's app://obsidian.md.
- docker-compose.yml: Add nginx service on port 8666, route to internal
chroma:8000. Remove CORS env var from ChromaDB (handled by proxy now).
- nginx.conf (new): Minimal alpine config with permissive CORS headers,
preflight OPTIONS handling, and streaming support (proxy_buffering off).
This fixes cross-origin access from remote Obsidian clients connecting over
Tailscale or VPN.
fegger