Build immutable policy publication artifact

deploy/nginx.conf

@@ -0,0 +1,38 @@
+map $uri $policy_cache_control {
+    default "no-cache";
+    ~^/standards/.+/revisions/ "public, max-age=31536000, immutable";
+}
+
+server {
+    listen 8080 default_server;
+    listen [::]:8080 default_server;
+    server_name _;
+    server_tokens off;
+    absolute_redirect off;
+
+    root /usr/share/nginx/html;
+    index index.html;
+    charset utf-8;
+    etag on;
+
+    add_header Cache-Control $policy_cache_control always;
+    add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:; font-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
+    add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+    add_header Referrer-Policy "no-referrer" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+
+    location = /healthz {
+        access_log off;
+        default_type text/plain;
+        return 200 "ok\n";
+    }
+
+    location = /tenancy-posture.html {
+        return 308 /standards/tenancy-posture/v0.1/index.html;
+    }
+
+    location / {
+        try_files $uri $uri/ $uri/index.html =404;
+    }
+}