Update default.conf

nginx/default.conf

@@ -40,6 +40,19 @@ server {
         try_files $uri =404;
     }
 
+    # Firebase Auth redirect handler — proxied through own domain so Safari ITP
+    # does not block storage access on firebaseapp.com (cross-site tracker).
+    # authDomain in firebase config must be set to this server's domain.
+    location ~ ^/__/auth/ {
+        proxy_pass https://grateful-journal-491109.firebaseapp.com;
+        proxy_http_version 1.1;
+        proxy_ssl_server_name on;
+        proxy_set_header Host grateful-journal-491109.firebaseapp.com;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
     location /api/ {
         client_max_body_size 5m;
         proxy_pass http://backend:8001/api/;