nginx.conf

# Default virtual host: the dashboard site (repo root). The host nginx reaches
# it through /boost/ and passes the original Host header.
server {
    listen 80 default_server;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    # The homepage is served only by the virtual host below, never under /boost/.
    location = /home   { return 404; }
    location ^~ /home/ { return 404; }

    # Git metadata, CI files and repo plumbing are not part of the site.
    location ~ /\. { return 404; }
    location ~* ^/(Dockerfile|nginx\.conf|docker-compose\.yml|deploy\.md|README\.md|_config\.yml)$ { return 404; }

    location / {
        try_files $uri $uri/ =404;
    }
}

# Homepage virtual host (see deploy.md, Part 3b). The host nginx sends
# "Host: insights-home.internal" for /, /assets/ and /robots.txt only, so
# these files are never reachable under /boost/.
server {
    listen 80;
    server_name insights-home.internal;
    root /usr/share/nginx/html/home;

    location = / {
        add_header Cache-Control "no-cache" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Content-Security-Policy "frame-ancestors 'none'" always;
        try_files /index.html =404;
    }

    location ^~ /assets/ {
        add_header Cache-Control "public, max-age=3600" always;
        add_header X-Content-Type-Options "nosniff" always;
        try_files $uri =404;
    }

    location = /robots.txt {
        try_files /robots.txt =404;
    }

    location / {
        return 404;
    }
}