user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 256;
    use epoll;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    access_log off;

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 15;
    keepalive_requests 100;
    types_hash_max_size 2048;
    client_max_body_size 1m;

    client_body_buffer_size 16k;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 8k;
    client_body_timeout 12s;
    client_header_timeout 12s;
    send_timeout 10s;

    open_file_cache max=100 inactive=60s;
    open_file_cache_valid 60s;
    open_file_cache_min_uses 2;
    open_file_cache_errors off;

    gzip on;
    gzip_static on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_disable "msie6";
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/json
        application/javascript
        application/x-javascript
        application/xml+rss
        image/svg+xml
        image/x-icon
        application/wasm
        font/woff
        font/woff2
        application/vnd.ms-fontobject
        application/x-font-ttf;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

    server {
        listen 80;
        listen [::]:80;
        server_name localhost ivanch.me www.ivanch.me;
        root /usr/share/nginx/html;
        index index.html;
        charset utf-8;

        error_page 404 /404.html;

        location / {
            try_files $uri $uri/ =404;
        }

        location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|webp|woff|woff2|ttf|otf|eot)$ {
            add_header Cache-Control "public, max-age=31536000, immutable" always;
            add_header X-Frame-Options "SAMEORIGIN" always;
            add_header X-Content-Type-Options "nosniff" always;
            add_header X-XSS-Protection "1; mode=block" always;
            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
            add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
            add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
        }

        location ~* \.html$ {
            expires off;
            add_header Cache-Control "no-cache, must-revalidate" always;
            add_header X-Frame-Options "SAMEORIGIN" always;
            add_header X-Content-Type-Options "nosniff" always;
            add_header X-XSS-Protection "1; mode=block" always;
            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
            add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
            add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
        }

        location ~ /\. {
            deny all;
            log_not_found off;
        }

        location ~ ~$ {
            deny all;
            log_not_found off;
        }
    }
}