server {
  listen 80;
  server_name _;
  root /usr/share/nginx/html;
  index index.html;

  # Security & privacy headers
  add_header X-Content-Type-Options nosniff;
  add_header X-Frame-Options SAMEORIGIN;
  add_header Referrer-Policy strict-origin-when-cross-origin;
  add_header Permissions-Policy "geolocation=(), microphone=(), camera=()";
  add_header X-XSS-Protection "1; mode=block";
  # HSTS (only effective over HTTPS; harmless over HTTP)
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

  # Content Security Policy:
  # - Allow self-hosted assets
  # - Inline styles allowed for critical CSS
  # - Allow privacy-enhanced embeds
  add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; media-src 'self' https://*.youtube-nocookie.com https://*.vimeo.com; frame-src https://www.youtube-nocookie.com https://player.vimeo.com; connect-src 'self'; base-uri 'self'; form-action 'self' https://wa.me https://api.whatsapp.com; upgrade-insecure-requests";

  # Compression
  gzip on;
  gzip_comp_level 5;
  gzip_min_length 1024;
  gzip_vary on;
  gzip_types text/plain text/css application/javascript application/json image/svg+xml application/xml application/rss+xml font/woff2;

  # HTML: no cache to ensure updates are seen
  location ~* \.(?:html)$ {
    add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
  }

  # Static assets: long cache
  location ~* \.(?:css|js)$ {
    add_header Cache-Control "public, max-age=31536000, immutable";
  }
  location ~* \.(?:png|jpg|jpeg|gif|webp|avif|svg|ico)$ {
    add_header Cache-Control "public, max-age=31536000, immutable";
  }
  location ~* \.(?:mp4|webm|ogv|mp3|wav)$ {
    add_header Cache-Control "public, max-age=31536000, immutable";
  }
  location ~* \.(?:woff2?|ttf|otf|eot)$ {
    add_header Access-Control-Allow-Origin "*";
    add_header Cache-Control "public, max-age=31536000, immutable";
  }

  location / {
    try_files $uri $uri/ =404;
  }
}