43 lines
1.8 KiB
Plaintext
43 lines
1.8 KiB
Plaintext
# Replace every double-underscore placeholder before validation or deployment.
|
|
# Generate the deployable file with scripts/generate-host-config.mjs; this file
|
|
# intentionally contains no real production hostname, certificate path, or root.
|
|
|
|
# Requires standard MIME mappings and static-file defaults in the parent Nginx http context.
|
|
max_ranges 1;
|
|
|
|
map $uri $portfolio_cache_control {
|
|
default "public, max-age=0, must-revalidate";
|
|
__EXACT_HASHED_ASSET_RULES__
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name __CANONICAL_HOST__ __ALTERNATE_HOSTS__;
|
|
return 308 https://__CANONICAL_HOST__$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
server_name __CANONICAL_HOST__;
|
|
ssl_certificate __TLS_CERTIFICATE_PATH__;
|
|
ssl_certificate_key __TLS_KEY_PATH__;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
root __DOCUMENT_ROOT__;
|
|
index index.html;
|
|
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' '__JSON_LD_CSP_HASH__'; style-src 'self'; img-src 'self' data:; media-src 'self'; font-src 'self'; connect-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=()" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
add_header Cache-Control $portfolio_cache_control always;
|
|
add_header Strict-Transport-Security "max-age=31536000" always;
|
|
|
|
location = / { try_files /index.html =404; }
|
|
location = /index.html { try_files /index.html =404; }
|
|
location = /robots.txt { try_files /robots.txt =404; }
|
|
location = /sitemap.xml { try_files /sitemap.xml =404; }
|
|
location /assets/ { try_files $uri =404; }
|
|
location / { return 404; }
|
|
}
|