# used by compose.static.yml
server {
    listen 80;
    server_tokens off;
    root /srv;

    # mirrors the uploads `Plug.Static` in Bonfire's endpoint
    location /data/uploads/ {
        # uploads (e.g. SVG) are served from the instance's origin, so stop any script in them from running if opened directly
        add_header Content-Security-Policy "sandbox; default-src 'none'; style-src 'unsafe-inline'" always;
        gzip_static on;
        try_files $uri =404;
    }

    # anything else only reaches this service while the app is down (see the maintenance router in compose.static.yml)
    location / {
        return 503;
    }

    error_page 503 /maintenance.html;

    location = /maintenance.html {
        root /srv/maintenance;
        add_header Retry-After 30 always;
        add_header Cache-Control "no-store" always;
    }
}