events {}

http {
	include mime.types;

	upstream homepage {
		server homepage:8000;
	}

	map $request_uri $expires {
		default off;
		"~-[0-9a-z]{10}\.js$" 1d;
		"~*(woff|woff2|ttf|eot)$" 1d;
	}

	map $sent_http_content_type $csp {
		default "";
		"~^text/html" "default-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'";
	}

	server {
		listen 80;
		expires $expires;
		add_header Content-Security-Policy $csp;
		add_header Strict-Transport-Security 'max-age=604800; includeSubDomains';
		add_header Referrer-Policy 'origin-when-cross-origin';
		add_header X-Content-Type-Options 'nosniff';
		add_header X-XSS-Protection '1; mode=block';

		location / {
			proxy_pass http://homepage;
			proxy_redirect off;
		}

		error_page 404 /custom_404.html;
		# in development, this handles empty responses by the pelican dev server which are 404s in the end
		error_page 502 /custom_404.html;
		location = /custom_404.html {
			internal;
			proxy_pass http://homepage/404.html;
			proxy_redirect off;
			add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive" always;
		}
	}
}