nginx.conf

server {
    listen 80;
    server_name _;

    root /usr/share/nginx/html;

    location = / {
        # Serve ASCII art for curl requests
        if ($http_user_agent ~* curl) {
            rewrite ^ /ascii.txt last;
        }
        try_files /index.html =404;
    }

    location / {
        try_files $uri $uri/ =404;
    }

    location = /ascii.txt {
        add_header Content-Type text/plain;
    }

    # cache static assets
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot|wasm|pagefind)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Hide server version
    server_tokens off;

    # security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    # CSP: Allowing unsafe-inline because of inline scripts/styles in the theme
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:;" always;

    # gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/json application/javascript;
}