nginx.conf

worker_processes 1;
pid /run/nginx.pid;

events {
  worker_connections 1024;
}

http {
  access_log off;
  error_log stderr error;
  server_tokens off;

  include mime.types;
  types {
    application/manifest+json webmanifest;
  }
  default_type application/octet-stream;
  charset_types application/javascript text/css application/manifest+json image/svg+xml;
  sendfile on;

  server {
    listen 8000;

    root /var/www;
    charset UTF-8;
    gzip_static on;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
    add_header X-Content-Type-Options "nosniff";
    add_header Content-Security-Policy "default-src 'none'; frame-ancestors 'none'; form-action 'none'; base-uri 'none'; img-src 'self'; font-src 'self'; style-src 'unsafe-inline' 'self'; script-src 'self'";

    if ($host ~ ^www\.(?<domain>.+)$) {
      return 301 https://$domain$request_uri;
    }

    if (-d $request_filename) {
      rewrite [^/]$ https://$http_host$uri/ permanent;
    }

    add_header Cache-Control "public";

    location ~* "(\.png|\.ico|\.woff2)$" {
      add_header Content-Security-Policy "";
    }

    location ~ ^/principles$ {
      try_files /principles.html =404;
    }
  }
}