railiance-platform/argocd/platform-addons/bao-notice/default.conf
codex 9ee20967ca RPF-WP-0047: HSTS for bao.coulomb.social only (no includeSubDomains)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
2026-09-24 00:56:22 +02:00

35 lines
1.1 KiB
Text

# Static notice for bao.coulomb.social (RPF-WP-0047). Serves one page; proxies nothing.
server {
listen 8080;
server_name _;
server_tokens off;
root /usr/share/nginx/html;
add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'" always;
add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header Cache-Control "no-store" always;
add_header X-Robots-Tag "noindex, nofollow" always;
location = / {
try_files /index.html =404;
}
location = /robots.txt {
default_type text/plain;
return 200 "User-agent: *\nDisallow: /\n";
}
location = /healthz {
access_log off;
default_type text/plain;
return 200 "ok\n";
}
# Any other path (e.g. /v1/sys/health, /ui/) is 404 with the same notice, never 200.
location / {
error_page 404 /index.html;
return 404;
}
location = /index.html {
internal;
}
}