# bot.dutyfreeprofessor.com: the reader's identity page. One static page, no listing,
# no scripts. Caddy terminates TLS in front; this only ever speaks to Caddy.
server {
    listen 80;
    server_name localhost;
    root /usr/share/nginx/html;
    index index.html;

    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; img-src 'self'; base-uri 'none'; form-action 'none'" always;
    add_header X-Frame-Options "DENY" always;

    location = /robots.txt { default_type text/plain; }
    location / {
        autoindex off;
        try_files $uri $uri/ =404;
        expires 1h;
    }
}