# Static server for the web UI (web/).
#
# The page decodes and analyses audio inside the visitor's browser. The CSP's
# `connect-src 'none'` forbids the page and its worker from making any network
# request (fetch, XHR, WebSocket, beacon), so dropped audio has no way to leave
# the tab — enforced by the browser, not just promised by the code.

server {
    listen 8080;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    # Nothing the app does reaches the server beyond fetching these files, and
    # there is no reason to keep a record of who fetched them.
    access_log off;
    server_tokens off;

    gzip on;
    gzip_types text/css application/javascript;

    add_header Content-Security-Policy "default-src 'none'; script-src 'self'; worker-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'none'; media-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
    add_header Referrer-Policy "no-referrer" always;
    add_header X-Content-Type-Options "nosniff" always;
    # Revalidate on every load so an update isn't stuck behind a proxy cache.
    add_header Cache-Control "no-cache" always;

    location / {
        try_files $uri $uri/ =404;
    }
}