# Static notice for bao.coulomb.social (RPF-WP-0047). Serves one page; proxies nothing.
server {
    listen 8080;
    server_name _;
    server_tokens off;
    root /usr/share/nginx/html;

    add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'" always;
    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer" always;
    add_header Cache-Control "no-store" always;
    add_header X-Robots-Tag "noindex, nofollow" always;

    location = / {
        try_files /index.html =404;
    }
    location = /robots.txt {
        default_type text/plain;
        return 200 "User-agent: *\nDisallow: /\n";
    }
    location = /healthz {
        access_log off;
        default_type text/plain;
        return 200 "ok\n";
    }
    # Any other path (e.g. /v1/sys/health, /ui/) is 404 with the same notice, never 200.
    location / {
        error_page 404 /index.html;
        return 404;
    }
    location = /index.html {
        internal;
    }
}