# Versioned walkthrough URLs are cacheable; unversioned URLs still revalidate.
map $arg_v $walkthrough_expiry {
  default -1;
  ~^[0-9]+-[0-9]+$ 7d;
}

server {
  listen 8080;
  server_name _;
  root /usr/share/nginx/html;
  index index.html;
  server_tokens off;
  gzip on;
  gzip_vary on;
  gzip_proxied any;
  gzip_comp_level 5;
  gzip_min_length 1024;
  gzip_types text/css text/javascript application/javascript application/json application/manifest+json image/svg+xml text/plain text/markdown;
  client_max_body_size 1k;
  add_header X-Content-Type-Options nosniff always;
  add_header Referrer-Policy strict-origin-when-cross-origin always;
  add_header X-Frame-Options DENY always;
  add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
  add_header Content-Security-Policy "default-src 'none'; style-src 'self'; script-src 'self' https://static.cloudflareinsights.com; img-src 'self'; font-src 'self'; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'" always;
  location = /healthz { access_log off; return 200 'ok'; }
  location ^~ /docs/ {
    default_type text/markdown;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy strict-origin-when-cross-origin always;
    add_header X-Frame-Options DENY always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; worker-src 'self' blob:; img-src 'self' data:; font-src 'self'; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'" always;
    try_files $uri $uri/ $uri.html =404;
  }
  location / { try_files $uri $uri/ $uri.html =404; }
  location ~ \.html$ { expires -1; }
  location ~ ^/learn/.*\.(js|css)$ { expires $walkthrough_expiry; try_files $uri =404; }
  # Font filenames carry a version; changed bytes must receive a new filename.
  location ~ ^/fonts/.*-v[0-9]+\.woff2$ { expires 1y; try_files $uri =404; }
  location /assets/ { expires 1y; try_files $uri =404; }
}