nginx.conf

# nginx.conf
worker_processes auto;

pid /tmp/nginx.pid;

events {
 worker_connections 1024;
}

http {
 include /etc/nginx/mime.types;
 client_body_temp_path /tmp/client_temp;
 proxy_temp_path       /tmp/proxy_temp_path;
 fastcgi_temp_path     /tmp/fastcgi_temp;
 uwsgi_temp_path       /tmp/uwsgi_temp;
 scgi_temp_path        /tmp/scgi_temp;
 default_type  application/octet-stream;
 server_tokens off;
 underscores_in_headers on;

 server {
   # Enable HTTP Strict Transport Security (HSTS) to force clients to always
   # connect via HTTPS (do not use if only testing)
   add_header Strict-Transport-Security "max-age=31536000;";

   # Enable cross-site filter (XSS) and tell browser to block detected attacks
   add_header X-XSS-Protection "1; mode=block";

   # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
   add_header X-Content-Type-Options "nosniff";

   # Disallow the site to be rendered within a frame (clickjacking protection)
   add_header X-Frame-Options "DENY";

   # Turn off all caddy caching
   add_header Cache-Control "no-cache,no-store,must-revalidate";
   add_header Pragma "no-cache";

   # Content Security Policy
   add_header Content-Security-Policy "default-src 'self'; frame-src 'self' *.gov.bc.ca *.hotjar.com *.googleapis.com https://*.nr-data.net https://*.newrelic.com https://*.cac1.pure.cloud; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.gov.bc.ca *.hotjar.com *.googleapis.com https://*.nr-data.net https://*.newrelic.com https://*.cac1.pure.cloud; style-src 'self' 'unsafe-inline' *.cloudflare.com; font-src 'self' *.gov.bc.ca *.hotjar.com *.cloudflare.com; img-src 'self' *.hotjar.com *.postescanada-canadapost.ca https://*.cac1.pure.cloud data:; connect-src 'self' *.gov.bc.ca *.launchdarkly.com *.hotjar.com *.postescanada-canadapost.ca *.sentry.io *.apigee.net wss://*.hotjar.com *.hotjar.io https://*.nr-data.net https://shyrka-prod-cac1.s3.ca-central-1.amazonaws.com https://*.newrelic.com https://*.cac1.pure.cloud wss://*.cac1.pure.cloud; manifest-src 'self'; media-src 'self' https://*.cac1.pure.cloud; object-src 'self' https://*.cac1.pure.cloud; child-src 'self' https://*.cac1.pure.cloud;";

   listen 8080;
   server_name _;

   index index.html;
   error_log /dev/stdout info;
   access_log /dev/stdout;
   root /app;

   location /businesses/create {
     alias /app;
     try_files $uri @index;
     gzip on;
     gzip_vary on;
     gzip_min_length 10240;
     gzip_proxied any;
     gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml;
     gzip_disable "MSIE [1-6]\.";
   }

   location @index {
     expires 0;
     try_files /index.html =404;
   }
 }
}