53 lines
2.0 KiB
Plaintext
53 lines
2.0 KiB
Plaintext
server {
|
|
listen 80;
|
|
server_name _;
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# Security & privacy headers
|
|
add_header X-Content-Type-Options nosniff;
|
|
add_header X-Frame-Options SAMEORIGIN;
|
|
add_header Referrer-Policy strict-origin-when-cross-origin;
|
|
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()";
|
|
add_header X-XSS-Protection "1; mode=block";
|
|
# HSTS (only effective over HTTPS; harmless over HTTP)
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
# Content Security Policy:
|
|
# - Allow self-hosted assets
|
|
# - Inline styles allowed for critical CSS
|
|
# - Allow privacy-enhanced embeds
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; media-src 'self' https://*.youtube-nocookie.com https://*.vimeo.com; frame-src https://www.youtube-nocookie.com https://player.vimeo.com; connect-src 'self'; base-uri 'self'; form-action 'self' https://wa.me https://api.whatsapp.com; upgrade-insecure-requests";
|
|
|
|
# Compression
|
|
gzip on;
|
|
gzip_comp_level 5;
|
|
gzip_min_length 1024;
|
|
gzip_vary on;
|
|
gzip_types text/plain text/css application/javascript application/json image/svg+xml application/xml application/rss+xml font/woff2;
|
|
|
|
# HTML: no cache to ensure updates are seen
|
|
location ~* \.(?:html)$ {
|
|
add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
|
|
}
|
|
|
|
# Static assets: long cache
|
|
location ~* \.(?:css|js)$ {
|
|
add_header Cache-Control "public, max-age=31536000, immutable";
|
|
}
|
|
location ~* \.(?:png|jpg|jpeg|gif|webp|avif|svg|ico)$ {
|
|
add_header Cache-Control "public, max-age=31536000, immutable";
|
|
}
|
|
location ~* \.(?:mp4|webm|ogv|mp3|wav)$ {
|
|
add_header Cache-Control "public, max-age=31536000, immutable";
|
|
}
|
|
location ~* \.(?:woff2?|ttf|otf|eot)$ {
|
|
add_header Access-Control-Allow-Origin "*";
|
|
add_header Cache-Control "public, max-age=31536000, immutable";
|
|
}
|
|
|
|
location / {
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
}
|